The verdict log is shaped like Certificate Transparency: every signed verdict is a leaf, and the operator signs tree heads. This policy says who runs it, what it promises, and what happens when something goes wrong.
What is logged, and by whom#
- What. Every verdict the operator signs is appended to the log. Retries and failover resubmissions are appended too, so the auditor sees everything. Counts read distinct judgements.
- Who. The operator runs the log. Today that is the hosted operator, run by the maintainer.
- Nothing is ever deleted from it. Erasure is by crypto-shredding the secrets that make its contents linkable (see retention). The log itself stays intact.
What anyone can check#
| Check | Route |
|---|---|
| The signed head: size and root | /anchor/head |
| That a later head extends an earlier one | /anchor/consistency |
| That one entry was logged before another existed | /anchor/order |
| Witness co-signatures over a head | /anchor/witness |
| That the heads different members were shown agree | /anchor/gossip |
| That a reference was never cleared | /absence/head, /absence/prove |
Promises#
- One history. The operator never signs two heads of the same size with different roots, and never a head that does not extend an earlier one it signed.
- Heads are frequent enough to matter. A head is available on demand at
/anchor/head. A member should fetch and keep one at least daily, and gossip it. - Mirroring is welcome. Anyone holding verdicts and heads can rebuild and check the log. Members hold every verdict on which their legs authenticated, and the recovery drill proves the log rebuilds from those copies to the same root.
If the operator is compelled#
The operator will not fork the log. If it were compelled to show different parties different histories, the construction makes that detectable: gossip turns a split view into two signed heads that cannot both be true, which is a provable fork. The operator cannot prevent members from comparing what they hold.
No warrant canary is published. The detection mechanism is the protection, not a statement.
When a fork is detected#
- The two conflicting signed heads are the evidence. Anyone can verify them offline.
- Members stop relying on new heads from the operator until the fork is explained. Their own signed verdicts remain valid.
- The corridors can move to a successor operator (
mirror-succession). The handover is itself a signed record.
Witnesses of the log#
Members and ratified witnesses may co-sign heads (/anchor/witness). A head co-signed by k independent parties cannot be forked without all of them. Today no independent log witness is connected.