Saphan StudioDocs
Security

The record: what you can prove afterwards

Registries of actors, delegations, machines, seats and capabilities are one Ed25519-signed append-only log.

Registries of actors, delegations, machines, seats and capabilities are one Ed25519-signed append-only log. The human-readable files you browse are projections, not the source. Nothing is edited: a status change is a new entry and a read resolves to the latest entry for a subject. The row identifier is excluded from the signed bytes, so re-identification during a store merge does not break verification.

A third party holding only the root public key can verify the fleet's entire governance history — who was admitted, by whom, when, with what authority — without trusting the machine that produced it.

Three record classes with three different strengths, distinguished because conflating them would overstate what we offer:

ClassProtectionWhat it proves
Governance logEd25519, root-signedNon-repudiation. Verifiable by any third party against the root public key.
Gate decisionsHMAC-SHA-256 over a canonical seven-field tuple, re-verified at mergeTamper-evidence. Any later edit of any field, including the actor, breaks verification. It does not prove which holder of the workspace key wrote it.
Run recordsUnsigned, content-pinnedContent provenance: binary path and SHA-256, version, configuration hash, the standing law injected and its SHA-256, verified source tree, cost, timing, process identifier, and — on a refusal — the rule and the reason.

Ingestion of channel artifacts is a pure, replayable function of what is on disk, deduplicated by content digest, so the record can be rebuilt from its inputs.

The gate-decision row closes a real hole. Before it, the actor field on an acceptance was a field, not an identity — anything reaching the store could write an acceptance as the owner. Now: no key means no owner-class decision, and a wrong or missing signature means no merge. Records that predate the mechanism are separated by a recorded epoch boundary, so genuinely historical unsigned rows are distinguishable from hand-inserted ones.

The management interface is an OIDC resource server: JWKS with a short freshness window, stale-as-miss so rotated keys are picked up promptly, and a refetch cooldown. OAuth identities are bound to actor-registry names, so read authorisation and signing authority resolve through the same identity vocabulary — while never sharing a cryptographic mechanism.

The controls in this document are tested, not asserted. A conformance suite of twelve end-to-end scenarios covers, among others, prompt-injection resistance, a misrouted instruction, dispatch locking, the OAuth code flow, bearer authorisation on the management interface, remote seat operation, and the refusals in the seat-binding surface.