Evidence

Both the authorizer and the executor keep an append-only evidence log. Each record is chained to the previous one by a SHA-256 hash, so a removed, reordered or edited record breaks the chain.

Record

Field	Notes
seq	Monotonic sequence number. Not part of the hash.
ts	Timestamp
kind	What happened, for example intent.authorized
actor	Who did it
ref_id	The object it concerns, or null
payload	Details
prev_hash	Hash of the previous record. The first record uses 64 zeros.
hash	sha256(canonical({prev_hash, kind, actor, ref_id, payload, ts})), hex

Verification

Walk the chain in seq order. For each record, recompute the hash and check that prev_hash equals the previous record’s hash and that seq strictly increases. A page of the chain can be verified from a known previous hash and sequence number. The authorizer exposes GET /v1/evidence/verify.

In the reference implementation, updates and deletes on the evidence tables are rejected by the database.

Kinds recorded today

Intents and decisions: intent.checked, intent.authorized, intent.rejected, decision.consumed, decision.voided, approval.requested, approval.approved.

Holds: reservation.held, reservation.settled, reservation.released.

Orders: order.transition, order.fill, order.external_fill, order.tca.

Control plane: mandate.issued, mandate.revoked, agent.registered, agent.revoked, agent.token_reissued, kill_switch.set, oauth_binding.created, oauth_binding.deleted, buying_power.set, account.opened, account.cash_set, budget.created, user.created, tenant.created, api_key.created, api_key.revoked.

A chain can be replayed to rebuild the state of every decision, order and reservation.