The evidence chain
From an effect, back to the person who wrote the sentence.
Two receipts, produced by two different products, that join. This is the capability we have found nowhere else, and the one an auditor, a risk officer or a regulator will care about most. An auditor starts at the effect and walks back. Every step is pinned.
The walk
Five steps, right to left.
Open any step to see it happen.
Step 1 of 5 · The walk
A person
The chain begins with a sentence a person wrote in plain English. It is locked and hashed before anything is built from it, and it carries the name of the person who wrote it. Every step to its right is derived from this sentence.
Picture this
On 3 March the head of finance writes one sentence: “Any payment over 25,000 needs a second person.” It is locked and hashed, with their name on it, before anything is built from it.
The question it settlesWho meant this, and exactly what they said. Hashing the sentence ends any argument about which intent was used. Whether it was the right sentence to write stays a human judgment — and now it is the only thing left to argue about.
Step 2 of 5 · Receipt of Truth
The proof
Written by the engine when the rule is built, and sealed with it. It carries the calculus, the Lean proof manifest, the invariants, the scorecard, the conformance record and the locked intent the whole thing was derived from — including the Oracle’s answer to one question: does the executable rule do what the sentence said?
Picture this
The engine builds the payments rule from that sentence and proves the limit holds for every amount. Months later, when an auditor asks how you know 40,000 could not leave without a second person, you do not answer with a screenshot or an engineer’s word. You open the proof — checked by a machine, not argued in a meeting.
The question it settlesWhy the rule can be trusted to do what the sentence says.
Step 3 of 5 · The join
The rule that fired
The decision does not merely name a rule. It pins the exact rule set by its digest — a fingerprint of the rule’s contents — at the moment it decides. Rules change; the pin does not. This is where the two receipts, written by two different products, meet.
Picture this
On Wednesday the payments rule is updated. On Friday night a payment is decided. Old rule or new? The digest on the receipt answers it outright. No digging through release notes, no “I think it had been deployed by then.”
The question it settlesWhich version of which rule applied, with no room for doubt.
Step 4 of 5 · Decision receipt
What was decided
Written by the control plane every time it decides. It carries the request and its exact arguments, the scope, the rule set pinned by hash, who was asked, what they answered, how long the answer holds, whether it executed — and the hash of the receipt before it, so removing or altering one breaks every receipt after it.
Picture this
Friday, 23:12. The finance agent asks to release payment 1,204 for 40,000. That is over the limit, so the rule asks a person: the controller approves this one payment only. It executes at 23:14. The receipt records all of it, and nobody has to reconstruct Friday night from memory.
The question it settlesWho decided, on exactly what request, and whether it ran.
Step 5 of 5 · The walk
An effect
Something happened in the world — not a log line, a consequence somebody now has to explain. This is where an auditor, a risk officer or a regulator starts, and walks back through every step to its left.
Picture this
Monday morning, finance sees that 40,000 left for a supplier on Friday at 23:14, and nobody on the team remembers approving it. The auditor starts here and walks back: the decision, the rule that fired, its proof, and the person and the sentence. One unbroken line.
The question it settlesWhat happened, and when — and, walking back, why.
The two receipts
Written by two different products. They join on the digest of the rule.
Decision receipt
Written by the control plane every time it decides. Carries the request and its exact arguments, the scope, digests of both, the rule set pinned by hash, who was asked, what they answered, how long it holds, whether it executed — and the hash of the receipt before it.
Receipt of Truth
Written by the engine when a rule is built. Carries the proof, the invariants, the scorecard, the conformance record, the provenance, and the locked intent the whole thing was derived from.
The join
The decision does not merely name a rule. It pins the exact rule set by digest at the moment it decided, so the rule you land on is provably the rule that fired.
The ledger is a chain, not a list
Each receipt carries the hash of the receipt before it. Remove or alter one entry and every entry after it breaks.
What an auditor actually does with it
The same evidence, whoever is asking.
Internal audit, second-line risk, the control owner, an external auditor, a supervisor, or the executive who has to sign the assurance statement. They are all asking one question in different words: show me.
Start at the effect
A branch was deleted, a payment left, a record changed.
Read the decision
What was requested, with which arguments, under which rule set, decided by whom, with what scope, and whether it executed.
Cross into the rule
The rule set is pinned by digest, so there is no question which version applied.
Open its proof
The calculus, the Lean proof manifest, the invariants, the scorecard, the oracle's conformance result.
Finish at a person
The locked natural-language intent, and who wrote it.
Why nobody has it
Both halves are missing from the market independently.
The proof does not travel
Across the formal-methods and verified-compiler industry, no product ships a proof into production with the artifact. The idea has existed since 1997 and was never commercialised. The attestation standards have no slot for it.
The record is not sealed
Not one product in the agent-security market signs or chains a decision record. The integrity technology exists — it is attached to build provenance and log files, never to the decision.
The closest things have one leg
AWS's Cedar has a prover and an independent executed check and gates releases on both — with no intent at the root and no per-release receipt. Cryptographic validation at NIST has a specification-derived oracle run by an independent lab — with no prover. The railway safety platforms compare two independently built binaries every cycle — and explicitly decline to emit a receipt.
And the honest limit at the far end: hashing the intent removes any argument about which intent was used. It does not make the intent correct. The most successful formal-methods programme in the world puts it plainly — a fully proven system is not a guarantee against failure, because the proof relates the implementation to the specification, not the specification to reality. One metro train once failed to stop at a platform because of a specification error.
Start at one seam
Read a real ledger, not a screenshot of one.
Twenty minutes: connect your own coding agent, ask it to do something that writes, deny it, verify in your own environment that nothing happened, then read the chain back to the rule and the rule back to the sentence.