What is the unenforced boundary in game AI?

Every 2026 production game AI system separates strategic reasoning (LLM proposing actions at 0.5–2 Hz) from deterministic execution (behaviour trees or RL policies applying actions at 10–50 Hz). NVIDIA ACE, CASCADE, Hierarchical Control, Personica AI, and mnehmos.rpg.mcp all use this split. The boundary is enforced by code structure and code review — not by a cryptographic gate. A patch, a prompt injection, or model drift can cross it, and there is no way to prove after the fact that it held. The boundary exists architecturally in every system and is cryptographically enforced in none of them.

Why does game AI need a pre-execution gate?

An AI NPC proposing actions inside a game — deciding to attack, trade, speak, or move — is an autonomous agent modifying a shared world state. Without a gate, three things are missing: (1) enforcement: nothing prevents the agent from skipping a safety check or jumping a step in its declared sequence; (2) proof: there is no signed receipt chain showing what the agent proposed, what the engine accepted, and in what order; (3) accountability: if the agent harms another player, crashes the economy, or produces illegal content, no third-party-verifiable record exists. A pre-execution gate enforces the sequence and seals each step — the same role a firewall plays at a network boundary, applied to the reasoning-execution boundary inside an AI character.

How has the GPU become an agent runtime?

Three converging shifts in 2026: (1) NVIDIA ACE runs AI NPCs locally on consumer RTX GPUs — PUBG Ally uses a 2B-parameter SLM on the player's own card, with cloud rejected due to latency; (2) every RTX 50-series card has 5th-gen Tensor Cores with native FP4, giving even an entry-level RTX 5060 421 AI TOPS — these cards are marketed as AI inference devices that also game; (3) players deploy their own AI agents (126,000 in ClawQuest) that run on their hardware and compete autonomously. The GPU renders the game and runs the agents inside it on the same silicon. The gating infrastructure for those agents does not exist.

What gaming uses does a sequence enforcement gate have?

Four direct fits: (1) esports match integrity — seal each match phase as a signed receipt chain so tournament results are provable to third parties without trusting the platform; (2) AI NPC governance — gate between the LLM reasoning layer and the world-state execution layer so an NPC cannot skip a safety check or validation step; (3) game testing QA certification — seal AI-driven test runs (Capcom runs 30,000 hours per month of automated playtesting) into cryptographically verifiable evidence that a build was tested; (4) player-deployed agent accountability — when 126,000 AI agents compete autonomously, a receipt chain proves what each agent did. Each use case currently has zero cryptographic enforcement.

Are there any products enforcing this boundary in games today?

No. As of mid-2026, at least eight products or protocols sign AI agent actions into verifiable receipts (Traceseal, Diagrid Dapr 1.18, agent-receipts.ai, Tervos Protocol, ActionProof, Sello, the IETF Proof-of-Behavior draft, and Talus/Doppel for on-chain gaming). None of them enforce step sequence before execution — they record what happened, not prevent the wrong thing from happening. The agent-receipt layer is commoditising; the enforcement layer has zero hosted competitors in any domain, and zero implementations in gaming specifically.

Reference 2026-07-24 Kade Cowper

Game AI's Missing Gate

This note is written in a flat, machine-readable register: definitions first, claims stated atomically, each qualifier attached to the claim it limits. The intent is that any single sentence can be quoted without losing the condition that makes it true. A full research synthesis with sources is available in the project repository.

Every 2026 game AI architecture separates strategic reasoning from deterministic execution. The LLM proposes actions at 0.5–2 Hz; the engine executes them at 10–50 Hz via behaviour trees, utility AI, or RL policies. NVIDIA ACE, CASCADE, Hierarchical Control, Personica AI, and mnehmos.rpg.mcp all converge on this split. The boundary between reasoning and execution is architectural — enforced by code structure, type systems, and code review — and is cryptographically unenforced in every case. A patch can weaken it. A prompt injection can cross it. Model drift can bypass it. After the fact, there is no way to prove it held. At the same time, the GPU on a gamer's desk has become an agent-hosting platform — rendering the game and running AI agents on the same silicon — with no gating infrastructure. Zero products enforce the reasoning-execution boundary with a pre-execution sequence gate. This note maps the gap, the hardware shift that makes it urgent, and where a deterministic enforcement layer fits.

Definitions

Hybrid game AI architecture: A two-layer design present in every 2026 production game AI system. The strategic reasoning layer — an LLM or small language model, operating at 0.5–2 Hz — observes the world state and proposes actions. The deterministic execution layer — behaviour trees, utility AI, or RL policies at 10–50 Hz — validates and applies those actions to world state. The separation is enforced by code structure, type systems, and code review. It is not enforced by a cryptographic gate. Examples: NVIDIA ACE (System 1 behaviour trees for reflexes / System 2 SLM for reasoning), CASCADE (Macro State Director / Coordination Hub / Tag-Driven NPCs), Hierarchical Control (Gemma 3 27B meta-controller at 2 Hz selecting RL skill policies at 12.5 Hz), mnehmos.rpg.mcp (LLM proposes intentions via MCP tools; engine validates against D&D 5e rules and executes — invariant stated as "LLMs never directly mutate world state").
The unenforced boundary: The interface between the strategic reasoning layer and the deterministic execution layer in a hybrid game AI architecture. Every system listed above has this boundary. None cryptographically enforce it. The boundary is present in the architecture — the LLM does not write directly to world state — but a patch can remove the guard, a prompt injection can persuade the model to output a forbidden action, and model drift can change behaviour without changing code. After an incident, there is no signed receipt chain showing what the reasoning layer proposed, what the execution layer accepted or rejected, and in what sequence. The boundary exists; the proof it held does not.
Pre-execution sequence gate: A deterministic enforcement point that evaluates each proposed action before it reaches world state. It applies ordered rules: the step must be in the declared sequence (no skipping), the nonce must be unique (no replay), the timestamp must be within 300 seconds of now (freshness), and the action type must be permitted for this function. A denied step is blocked and the denial is recorded with a reason code. An allowed step is sealed into an Ed25519-signed, SHA-256-hash-chained receipt. The gate enforces step ordering before execution; the receipt chain proves it held. Both the enforcement and the proof are independently verifiable by any third party with the published public keys. No such gate exists in any shipped game AI system as of mid-2026.
GPU as agent runtime: The observation that a consumer gaming GPU in mid-2026 is simultaneously a rendering device and an AI inference platform. Three converging facts: every RTX 50-series card carries 5th-generation Tensor Cores with native FP4 precision (421 AI TOPS on an entry-level RTX 5060); NVIDIA ACE runs AI NPC models locally on the same GPU that renders the game (PUBG Ally uses a 2B-parameter SLM with a minimum 8 GB VRAM, cloud rejected due to latency); and players deploy their own AI agents (126,000 in ClawQuest Agent Fire, MoltQuest's persistent MMO agents) that run on their hardware. The GPU on a gamer's desk is already an agent-hosting platform. The infrastructure to gate those agents does not exist.
Player-deployed AI agent: An autonomous AI agent deployed by a player into a live game to act on their behalf — fighting, trading, exploring, or competing. In mid-2026, at least three platforms enable this at scale: ClawQuest Agent Fire (126,000 agents competing 24/7, launched July 2026), MoltQuest (persistent 3D fantasy MMO, LLM-agnostic — Claude, GPT, Mistral, Ollama all supported, earns tokens on Base L2), and iAgent Protocol (train agents from your own gameplay footage via Visual Learning Models, NFT-ownable, 5,000+ verification nodes, $3M raised). No platform provides cryptographic proof of what a deployed agent did. No regulatory framework addresses agent accountability. If a player's agent cheats, crashes an economy, or produces illegal content, the only recourse is the platform's existing anti-cheat framework — designed for human cheaters, not autonomous agents.

Evidence: the universal split

The following systems were examined. Every one converges on the same two-layer architecture. The boundary between layers is architectural in every case and cryptographically enforced in none.

System	Reasoning layer	Execution layer	Boundary enforcement
NVIDIA ACE + PUBG Ally	2B-param SLM, local GPU inference, voice/text understanding, tactical reasoning	Behaviour trees for reflexes, navigation, combat	Architectural only
CASCADE (CHI 2026)	Macro State Director (causal system) + Coordination Hub	Tag-Driven NPCs via behaviour trees and utility AI; LLM only for player-facing dialogue	Architectural only
Hierarchical Control (arXiv, June 2026)	Gemma 3 27B meta-controller at ~2 Hz, selecting among RL skill policies	RL skill policies (Navigate, Combat, Secure, Retreat) at 12.5 Hz	Architectural only
Personica AI (Unreal Engine)	LLM suggests actions; utility AI can override via reflex threshold	Behaviour trees execute chained utility actions	Architectural only
mnehmos.rpg.mcp	LLM proposes intentions via 28 MCP tools	Engine validates against D&D 5e rules and executes; invariant: "LLMs never directly mutate world state"	Architectural only
UE ReAct → Behaviour Tree	DeepSeek runs ReAct loop, outputs structured JSON tool calls	Unreal Engine executes via behaviour trees and Blackboard	Architectural only
KRAFTON CPC vision (ICML 2026)	Language model + human-AI interaction layer	Reinforcement learning for game-consistent behaviour	Architectural only

Claim 1Every 2026 production game AI system separates strategic reasoning from deterministic execution. This is not a coincidence — it is the only architecture that delivers both expressive intelligence (via the LLM) and real-time performance (via the deterministic executor). The split is universal because it solves the latency problem: the LLM is too slow for 60 fps gameplay, and the behaviour tree cannot generate novel dialogue or adaptive tactics.

Claim 2The boundary between these two layers is architectural — code structure, type systems, code review, and the mnehmos invariant ("LLMs never directly mutate world state") — and is cryptographically unenforced in every case. A patch can remove the guard. A prompt injection can persuade the model to output a forbidden action. Model drift can change behaviour without changing code. After the fact, there is no proof the boundary held.

Evidence: the GPU shift

Claim 3NVIDIA's gaming revenue was 5.4% of total company revenue in the most recent reported quarter (Q4 FY2026: $3.7B of $68.1B). The datacenter division is over 16 times larger ($62.3B). The company has evolved from a gaming GPU business into an AI infrastructure provider — stated plainly by the CEO. The global DRAM supply chain allocates approximately 70% of output to HBM for AI accelerators; GDDR7 for gaming cards receives the remainder.

Claim 4Every RTX 50-series GPU is simultaneously a rendering device and an AI inference platform. Fifth-generation Tensor Cores with native FP4 precision deliver 421 AI TOPS on an entry-level RTX 5060 and 1,801 AI TOPS on an RTX 5080. These cards are marketed as AI inference devices that happen to game. NVIDIA ACE runs AI NPC models locally on the same GPU that renders the frame — PUBG Ally's 2B-parameter SLM runs on the player's own card, with cloud rejected due to latency. The silicon that draws the world now also runs the agents inside it.

Claim 5Used gaming GPUs have become a de facto distributed AI inference market. RTX 3090s (24 GB, $700–900 used) are the sweet spot for running 32B-parameter models locally. Compute rental platforms (Vast.ai, RunPod) turn gaming rigs into $500–$1,000/month inference nodes. China has a dedicated market for blower-fan RTX 5080s sold explicitly as "AI inference" devices — consumer gaming cards repurposed as datacenter substitutes. The boundary between a gaming PC and an AI server has dissolved at the hardware layer. The software boundary — what gates the agents running on this hardware — was never built.

Evidence: the accountability vacuum

Claim 6At least 126,000 player-deployed AI agents were competing autonomously in live games as of July 2026 (ClawQuest Agent Fire, launched July 2026). MoltQuest operates a persistent 3D fantasy MMO where player-deployed agents fight, trade, explore, and gather resources — LLM-agnostic, any model from Claude to Ollama supported. iAgent Protocol lets players train agents from their own gameplay footage, tokenise them as NFTs, and trade them on a marketplace. These are not demos or test environments; they are live, tokenised, real-money-adjacent games with autonomous agents acting on behalf of human players.

Claim 7No platform — not Steam, not Epic Games Store, not Xbox, not PlayStation, not Nintendo — has a published policy on AI agent accountability. The liability framework for what a player-deployed AI agent does in a game is the platform's existing anti-cheat Terms of Service, written for human cheaters and aimbots. No "Know Your Agent" infrastructure exists that cryptographically proves what a deployed agent did, in what order, and whether it violated game rules.

Claim 8The WinZO case (India, 2025–2026) demonstrates the fraud vector from the operator side: the platform deployed AI-driven bots against real players without disclosure, causing approximately $88M in user losses. The Enforcement Directorate froze ~$97M in assets and arrested the co-founders. The case confirms that in-game agent economies are vulnerable to systematic cheating by the platform itself — the exact threat model a third-party gate and independent archive addresses.

Evidence: the competitive landscape

Claim 9At least eight independent products or protocols sign AI agent actions into verifiable receipts as of mid-2026: Traceseal (signed JSON, Ed25519), Diagrid Dapr 1.18 (workflow history signing, SPIFFE-backed), agent-receipts.ai (open protocol, Ed25519 + hash chains + MCP proxy), Tervos Protocol (hash-chained verifiable event log), ActionProof (zero-backend offline receipts, Ed25519 + SHA-256), Sello (receiver-side signing, HPKE + Merkle transparency log), the IETF Proof-of-Behavior draft (signed receipts + hash-chain + pre-execution policy gate), and Talus x Doppel Games (on-chain verifiable AI agent competitions on Sui).

Claim 10Zero of these products enforce step sequence before execution. They record what an agent did; they do not prevent the wrong action from running in the first place. The agent-receipt layer is commoditising — the signing, chaining, and verifying pattern is now a common specification with multiple shipping implementations. The enforcement layer — a pre-execution gate that says DENY before a bad step reaches world state — has zero hosted competitors in any domain. In gaming specifically, zero implementations exist at any layer.

Evidence: regulatory pressure is rising

Multiple jurisdictions now require some form of transparency about AI used in games. The common structure matters more than any single regime: each asks "was AI used here, and how?", none has built infrastructure to verify the answer, and every one currently accepts the platform's own self-certification. The specific regimes below are examples of that shape, not a compliance checklist — and a receipt chain produces evidence toward the record-keeping parts, not the user-facing disclosure or content-marking duties, which stay with the developer.

Claim 11One example, and the nearest in time: the EU AI Act's Article 50 transparency obligations become fully enforceable on 2 August 2026 — 9 days from the date of this note. From that date, players in the EU must be informed when interacting with an AI system in a game (NPCs, lobby bots, voice agents). AI-generated content must be machine-readable marked (the marking duty for content placed on the market before that date is delayed to 2 December 2026 under the Digital Omnibus). Fines reach €15M or 3% of global turnover. A specific exemption exists for ephemeral real-time content where marking is technically infeasible — contingent on in-experience alternative notice. No enforcement infrastructure exists to prove compliance. A receipt chain that records which AI system acted, when, and within what boundaries produces evidence toward the record-keeping side of these obligations. It does not by itself satisfy the user-facing disclosure duty, which requires informing the player in the experience, nor the on-asset marking duty — those remain the developer's to implement.

Claim 12Korea's AI Framework Act (effective January 2026) requires mandatory labelling of AI-generated content in games — NPC dialogue, character art, BGM. Extraterritorial: applies to Steam, Epic, and any overseas platform serving Korean users. China's AI Content Labelling Method (effective September 2025) requires dual watermarks — explicit and machine-readable — on all AI-generated game assets, with a minimum six-month record retention period. Steam requires AI content disclosure from developers; over 10,000 titles have disclosed as of end of 2025. Every one of these obligations asks the same question: "was AI used here, and how?" Every one currently accepts platform self-certification as the answer.

The gap

Gap 1 — enforcementThe reasoning-execution boundary in every hybrid game AI architecture is enforced by code, not by a cryptographic gate. A patch, a prompt injection, or model drift can cross it. After the fact, there is no proof it held. The boundary that every architect draws is the one no one enforces.

Gap 2 — proofGame studios running AI-powered testing (Capcom: 30,000 hours per month of automated playtesting on Monster Hunter Stories 3; EA: 85% of QA AI-driven; Square Enix targeting 70% by 2027) produce telemetry and internal logs but no cryptographically verifiable evidence that a test run occurred as claimed. A publisher or platform holder receiving a build certification has no third-party-verifiable proof the tests were run, in the claimed order, without tampering.

Gap 3 — accountabilityWhen a player deploys an AI agent into a game, neither the platform nor other players can prove what that agent did. The Blockchain Game Alliance's "Know Your Agent" framework proposes agent identity. It does not propose agent action verification. Identity without an action record is a name without a receipt.

Gap 4 — independenceEvery anti-cheat system (Aegis with ZK proofs, Anybrain's behavioural biometrics, Valve's VACnet) is operated by the platform being asked to trust it. The evidence of a cheat is held by the same party that issues the ban. When a banned player sues — and they increasingly do, as accounts carry real financial value — the platform produces its own records as proof. A third-party-verifiable receipt chain, with an independent archive copy held by a different custodian, would convert a platform's self-attested ban evidence into third-party evidence.

Where a deterministic enforcement layer fits

Fit	What gets gated	What a sealed receipt chain proves	Current state
AI NPC governance	Every proposed action between the LLM reasoning layer and the world-state execution layer	The NPC did not skip a safety check or validation step; the sequence of proposals and acceptances is independently verifiable	Unenforced — architectural only
Esports match integrity	Each phase of a competitive match (champion select, early game, mid game, late game, victory)	The match was played in the correct sequence, without skipped phases, by verified participants; provable to a third party without trusting the platform	Video review + community policing only
Game testing QA certification	Each step of an AI-driven test run (test plan → setup → execute → observe → assert → teardown → report)	The test was actually run, not fabricated; the steps ran in the declared order; the results have not been tampered with; model and hardware fingerprints are recorded	Internal logs only — editable, not third-party-verifiable
Player-deployed agent accountability	Every action a player's autonomous agent takes in a live game	What the agent did, in what order; whether it violated game rules; cryptographic proof available to the platform, the player, and any third party	No infrastructure exists
AI content provenance	Each step of an AI content generation pipeline (seed → model invoke → output evaluate → human approve → commit)	The asset was generated by the claimed model at the claimed time with the claimed seed; evidence toward Korea's labelling law and EU AI Act record-keeping, not a substitute for the required on-asset watermark	Self-certification only

What a gate does not do

Limit 1A pre-execution gate enforces step ordering and records decisions. It does not verify that the LLM's reasoning was correct, ethical, or safe — only that the step it proposed was permitted, in sequence, and not a replay. The gate enforces procedure; it does not evaluate the content of a decision. A procedurally valid sequence of bad decisions produces a clean receipt chain. The receipt proves the procedure was followed, not that the outcome was good.

Limit 2A gate on the player's GPU (local enforcement) defends against the agent skipping steps. It does not defend against the player who holds the GPU. A player with physical access to the hardware can disable the gate. The enforcement model that resists the operator requires the gate to run on infrastructure the operator does not control — the same custody argument made in the self-signed-evidence note.

Limit 3A gate at the reasoning-execution boundary catches an NPC skipping a validation step. It does not catch the validation step itself being badly written. The gate enforces that the sequence ran; it does not enforce that the sequence was the right one. Sequence design remains a human responsibility.

Limit 4The independent archive (Rongo) model — a write-once copy of the sealed receipt held by a second custodian — catches the platform operator rewriting history. In a single-account deployment, the archive is inside the operator's own Cloudflare account with a bucket lock, which raises the cost of a rewrite but does not prevent it. The full guarantee requires the archive to be held by a party that does not operate the gate. For gaming, this means a tournament archive held by a regulator, a platform archive held by an independent auditor, or a studio archive held by a publisher. The technical mechanism exists; the custodial relationship is a deployment decision.

Corroborating signals

Signal 1 — KRAFTON at ICML 2026The studio behind PUBG laid out a "Three Fronts" strategy for AI in gaming: in-game AI agents, interactive world models (video-generating engines), and production AI. The first front — in-game AI agents — is already shipped (PUBG Ally). The company that operates the most-played game on Steam is publicly committed to agentic NPCs as a strategic direction. The enforcement question follows directly: if every character in a PUBG match could be an AI agent, who proves which ones played fair?

Signal 2 — the 10BET "SkyNet" scandal (China, July 2026)A professional League of Legends team used an AI system with sub-0.01-second reaction times and a 100% win rate in a tournament. Detected only by anomaly, not by any cryptographic proof. Players received lifetime bans. The platform was shut down. Criminal charges were filed against the CEO. Three government agencies jointly issued an emergency notice banning AI-powered cheating in games. The entire enforcement response was post-hoc, investigative, and evidentially fragile — based on replays, server logs, and behavioural analysis, all held by the platform. A gate-sealed match receipt held by an independent archive would have turned detection into proof.

Signal 3 — the autonomous QA scaleCapcom runs 30,000 hours per month of AI-driven automated playtesting on a single game. EA reports 85% of QA work is AI-driven. Square Enix targets 70% QA automation by 2027. Razer's QA Companion-AI generates pass/fail summaries from autonomous gameplay agents. The volume of automated testing is industrial. The verifiability of that testing is zero. A publisher accepting a build certification from a developer is accepting an internal log file as proof the tests ran. If a shipped bug is later traced to a test that was claimed to have passed, there is no way to determine whether the test was run, was run and fabricated, or was run correctly and the bug was genuinely missed.

Signal 4 — the Crash and the Overwatch mergerThe 2025 blockchain gaming crash (market cap down ~68%, investment from $10B in 2022 to ~$293M in 2025, major studios shut down) eliminated the most natural early-adopter segment for verifiable game actions. The surviving verification infrastructure (UVS v3 for provably fair outcomes, Talus/Doppel for on-chain agent transparency) is not sequence enforcement — it covers randomness proofs and economic transparency, not step ordering. Meanwhile, the Activision Blizzard King integration into Xbox Game Studios under Microsoft (the "largest acquisition in gaming history," closed 2023) places the Call of Duty, World of Warcraft, and Candy Crush ecosystems under a single platform operator with the scale to set enforcement standards. The largest platform has not yet set any.

The numbers

Stat	What it means
5.4%	NVIDIA gaming as share of total revenue — the company that defined PC gaming is now an AI infrastructure provider. The GPU on a gamer's desk is an AI inference device that also renders games.
126,000	Player-deployed AI agents competing autonomously in ClawQuest Agent Fire at launch (July 2026). The number of ungated autonomous agents in live games is already six figures.
30,000 hrs/month	Capcom's AI-driven automated game testing on a single product. Industrial-scale agent activity with zero cryptographic verifiability.
7	Shipped or announced game AI systems examined. All seven converge on the same hybrid architecture. Zero enforce the reasoning-execution boundary cryptographically.
8	Independent agent-receipt products or protocols identified. All sign what happened. Zero enforce step sequence before execution.
0	Products enforcing step sequence with a pre-execution gate in gaming, or in any domain, as a hosted service.
9 days	Until the EU AI Act Article 50 transparency obligations become fully enforceable (2 August 2026). The compliance infrastructure — cryptographic proof of which AI acted and how — does not exist.
$88M	User losses in the WinZO case from AI bots deployed against real players without disclosure. The liability gap for undisclosed AI agents in games is measured in tens of millions of dollars.
421 AI TOPS	FP4 inference throughput on an entry-level RTX 5060. The cheapest current-generation gaming GPU is also an AI inference accelerator. The hardware is ready; the gate is not.

Relationship to existing AgenticRail infrastructure

FactAgenticRail is a deterministic sequence enforcement gate in production. It evaluates each step of an agent sequence against ordered rules, returns ALLOW or DENY, and seals every decision into an Ed25519-signed receipt with a SHA-256 hash chain linking each receipt to its predecessor. A denied step is blocked and must be retried or the sequence abandoned. A sealed sequence cannot be modified without breaking the prev_receipt_hash chain — detectable, not impossible, and stated that way. On seal, a copy of the final signed receipt is written to a separate write-once archive (Rongo) under its own credential, so comparison against the live chain detects a rewrite by the key holder. Public verification keys are published. Any third party can verify a receipt offline with no account and no callback.

FactThe gate is spine-agnostic: it enforces whatever step order the caller declares. The enforcement spec spine (intake → disruption → instability → state_read → internal_driver → execution → boundary → settle) maps naturally onto game loops, and custom spines can be declared per use case — an AI NPC decision loop could be observe → reason → propose → validate → execute → confirm → seal; a tournament match could be select → ban → load → play → end → verify → seal; a QA test run could be test_plan → setup → execute → observe → assert → report. The gate enforces whatever sequence is declared; the spine is configured, not hardcoded.

Fact — tested at production scaleThe gate has processed over 1.19 million decisions in production. It has been adversarially pressure-tested at 1,995 requests with 66-worker concurrency, including deliberately malformed payloads, injection attempts, and oversized attestations — zero enforcement failures, zero incorrect denials. It has not been tested against game-engine workloads, AI NPC decision loops, or esports match phases. The enforcement mechanism is proven; the gaming integration is not.

Run a sequence through the gate, seal it, and verify the receipt against the published keys — no account, no callback, no trust required. The same gate that enforces step ordering for AI agent sequences can enforce the reasoning-execution boundary in a game.

Try the demo Verify a receipt