How proof works
Every Control test reads the whole population from an append-only, hash-chained log and seals a Proof that anyone holding a published root can check.
A Proof is the sealed result of one Control test: the records it read, the published root they roll up to, and every exception. Anyone can check one without trusting the platform.
Every record, not a sample
Each Control's test is a query and an assertion. Change approval selects every merged Change to a definition. It asserts that a Decision approved each one, by an approver other than its author.
The test reads every member of the population, every day. An automated Control tested over everything tolerates zero deviations. Only the human floor, a few signatures per period, is sampled, with a seed the auditor commits before the period ends.
Complete by construction
A test over everything proves nothing if records can go missing. Three properties close that gap.
| Property | How it holds |
|---|---|
| Append-only | Writers hold insert rights only. No Worker, agent or person, can change or delete an Event. |
| Hash-chained | Each Event in a namespace commits to the hash of the Event before it, by sequence number. |
| Published | Head hashes roll up hourly from each Startup to its Studio to the platform, which publishes each root and sends it to an outside witness. |
An auditor's script checks that sequence numbers run without gaps and recomputes the root. When both hold, the population is complete, and the Control's test read all of it.
What a Proof records
Each run writes a Control.tested Event and seals a Proof.
| Field | Holds |
|---|---|
control | The Control tested |
from, to | The range of Events read |
root | The published root that range rolls up to |
count | How many Events the test read |
exceptions | How many failed; each opens an Issue |
The test is itself a definition, so it changes only through a Change. Its history shows that no one quietly loosened it.
Preventive Controls
A preventive Control stops a failure, so its population of failures is empty by design. It passes a period when three facts hold:
- Its Guard Version did not change.
- No bypass Event exists.
- The control tester recorded at least one refusal.
The Tester attacks every preventive Control each day in the test environment. Each refused attempt is recorded, and shows the Control firing.
Exceptions close by Decision
A failing test opens an Issue at a stakes tier. The Issue closes only through a Decision that records the cause, the fix and management's response.
A report's deviations section renders from those Decisions. An auditor reruns the failure query to show the list is complete, and Deviation closure tests the rule itself.
Any period, any date
Records are kept forever, so a past period is a range query, and a type 1 report is the same query at one instant. A Control added today replays its test over the full history.
Proofs render through a Dashboard: Markdown for agents, screens for people, JSON for clients. Trust status serves the live results between reports, so a reviewer never waits for a bridge letter.
Next
- Frameworks: which Criteria each Control satisfies.
- Auditors: how a firm reads Proofs.