The record: what you can prove afterwards
Registries of actors, delegations, machines, seats and capabilities are one Ed25519-signed append-only log.
Registries of actors, delegations, machines, seats and capabilities are one Ed25519-signed append-only log. The human-readable files you browse are projections, not the source. Nothing is edited: a status change is a new entry and a read resolves to the latest entry for a subject. The row identifier is excluded from the signed bytes, so re-identification during a store merge does not break verification.
A third party holding only the root public key can verify the fleet's entire governance history — who was admitted, by whom, when, with what authority — without trusting the machine that produced it.
Three record classes with three different strengths, distinguished because conflating them would overstate what we offer:
| Class | Protection | What it proves |
|---|---|---|
| Governance log | Ed25519, root-signed | Non-repudiation. Verifiable by any third party against the root public key. |
| Gate decisions | HMAC-SHA-256 over a canonical seven-field tuple, re-verified at merge | Tamper-evidence. Any later edit of any field, including the actor, breaks verification. It does not prove which holder of the workspace key wrote it. |
| Run records | Unsigned, content-pinned | Content provenance: binary path and SHA-256, version, configuration hash, the standing law injected and its SHA-256, verified source tree, cost, timing, process identifier, and — on a refusal — the rule and the reason. |
Ingestion of channel artifacts is a pure, replayable function of what is on disk, deduplicated by content digest, so the record can be rebuilt from its inputs.
The gate-decision row closes a real hole. Before it, the actor field on an acceptance was a field, not an identity — anything reaching the store could write an acceptance as the owner. Now: no key means no owner-class decision, and a wrong or missing signature means no merge. Records that predate the mechanism are separated by a recorded epoch boundary, so genuinely historical unsigned rows are distinguishable from hand-inserted ones.
The management interface is an OIDC resource server: JWKS with a short freshness window, stale-as-miss so rotated keys are picked up promptly, and a refetch cooldown. OAuth identities are bound to actor-registry names, so read authorisation and signing authority resolve through the same identity vocabulary — while never sharing a cryptographic mechanism.
The controls in this document are tested, not asserted. A conformance suite of twelve end-to-end scenarios covers, among others, prompt-injection resistance, a misrouted instruction, dispatch locking, the OAuth code flow, bearer authorisation on the management interface, remote seat operation, and the refusals in the seat-binding surface.