Completeness
Records are sequenced. A gap in a monotonic sequence is detectable. A
gap in a log directory is invisible.
Integrity
Records are Merkle-sealed in batches, so altering one changes a root
that has already been published.
Existence in time
Roots are anchored externally, so a record can be shown to have existed
by a certain moment without trusting our clock.
Inclusion proofs
A reviewer can verify that a specific record belongs to a sealed set without access to your systems. They need the record, the proof, and the published root. Not a login, not an export, not a call with your team. That is the property that makes evidence portable, and it is why the verifier runs entirely in a browser with nothing sent anywhere.Refusals are evidence
The half that most systems discard. An agent stopped 40 times last quarter is a control demonstrating that it operated. An agent never stopped is either perfectly bounded or entirely unbounded, and from the outside those are indistinguishable. Systems built to log successes cannot produce this, because the refusal is the path where the code returned early and returning early is exactly where the logging is not.What is sealed into a decision
The fields that make a record readable years later without knowing which release was deployed:- the grant it drew on, and the accountable principal behind it
- the enforcement mode at that moment, not the mode configured now
- the limits that applied, and what remained
- the gate that stopped it, and which gates were never reached
- the taint present, by source and step