Cognitive Attestation: Signing Interpretable Decompositions of Latent Model State in AI Agent Governance

An AI agent denies a loan application. It signs a record of what it did: the decision, the applicant, the delegation under which it acted. An auditor can verify the record. The auditor cannot ask which learned features engaged, at what intensity, during the tokens of that output. This paper begins closing that gap. We specify cognitive attestation: a cryptographic commitment, attached to an agent's action record, to which sparse-autoencoder features were active during the decision, at what intensity, over which tokens. The commitment is tamper-evident, replayable, and composable with existing attestation infrastructure (APS, SCITT, ACTA). It does not sign the agent's cognition. It signs a declared interpretability pipeline's measurement of the model's internal state during the declared output, under a declared aggregation policy, with known limits. We specify the envelope format (normative JSON Schema in the companion repository), canonical comparison rules, a three-stage verification semantics, three completeness regimes with mandatory-coverage allowlists, and a required_signer_roles mechanism that closes signaturestripping attacks. We define four dispute primitives, separated into computational disputes that resolve by replay and interpretive disputes that produce durable governance annotations with required evidence. We report two experimental results against Llama-3.1-8B and the LlamaScope layer-19 residual-stream sparse autoencoder via Neuronpedia's public inference API. First, feature activations for a fixed prompt are bit-exact reproducible across repeated hosted calls: 32 of 32 features matched with max absolute difference 0.000000. Second, on paired prompts (10 benign controls, 10 borderline-but-compliant), 110 features engaged only in the borderline group. Among these, features whose current dictionary labels suggest security, vulnerability, and detection semantics engaged on content-sensitive prompts while the model produced benignlooking completions. Cognitive attestation surfaces this engagement; action-only attestation cannot. We report alongside the finding that linguistic-surface features (first-person framing, question structure) also differentiate the two groups, which bounds the interpretive claims. The paper's load-bearing claim is narrow. Agent attestation protocols commit to an action ontology that is insufficient for audit questions about internal model state. A concrete, composable extension exists today to attach signed interpretable decompositions to agent action records. The extension enables a governance surface-feature-level policy, feature-level dispute, feature-level audit-that action-only attestation cannot express.