Trust & traceability

Where authority sits

The lifecycle is event-sourced. An append-only event log is the only authority for what state a record is in; the visible current state is a derived projection that can be rebuilt from the log at any time. There is no editable status field anywhere in the system.

The registry itself is immutable data, pinned by digest: Project Shadow R1.0.1, state-machine-v1.json, 26 states and 71 transitions. Guard rules are a separately versioned registry, so a rule change is visible as a rule change rather than as a quietly different outcome.

What the system proves

That a specific transition was declared, by whom, when, and against which pinned bundle.
That the receipt chain for a record is unbroken and internally consistent.
That a given claim cites a given evidence span, and in which direction.
That an effectiveness plan existed, sealed, before the work was reported complete.
That a refused command was refused, by which rule, with which blockers.

What it deliberately does not prove

That a decision was correct, lawful, ethical or safe. No receipt asserts that.
That a signature or approval is present — those are separate records with their own scope, expiry and revocation.
That an external authority applies. A cited authority is a citation, not an approval.
That an UNKNOWN is benign. An unresolved UNKNOWN is never read as low risk or as consent.

Reopening a closed record

There is no toggle that reopens a case, and history is never rewritten. New information about a closed record follows the exact registry path: a challenge is filed by someone with standing, with a reason and an evidence reference; if it is upheld, the record re-enters assessment. A new assessment pass appends. It does not replace the original.

Pre-live posture

This deployment runs in BETA-ACTIVE-TESTING / PRELIVE. It ships no outbound effector, no worker and no adapter allowlist. Every record you can see is fictional and labelled synthetic. Execution states in the demonstrations are documentary replays with proof of no external side effect — they are not emitted by a simulator pretending to act.