A log that outlives the system that wrote it

Examiner windows are long. A model-risk review can reach back eighteen months, sometimes more, and ask about a decision made by a version of the system that has since been replaced. The team that built it may have moved on; the logging format may have been upgraded twice; the field names may no longer mean what they meant when the log was written. A log that survives that window is a log that was designed to — where "designed to" means the meaning of each field is a contract with the future, not a convention of the moment. Most logs are not designed this way. Most logs are a text file written by a version of the system that no longer exists, read by a team that no longer works here, describing fields that no longer mean anything.

We are pre-revenue and building the POC. This post is about the durability-of-meaning property the manifest (BR-842) is designed for, and why it is the property that decides whether an eighteen-month-old decision is defensible.

A field name is a contract with the future

The manifest is not a log in the conventional sense; it is a hash-chained, append-only record where each field is a typed value. A field named model_version is not a free-text note; it is a hash-pinned identifier. A field named input_nodeversions is not a list of strings; it is a set of L1 through L4 references, hash-linked into the chain. A field named agent_trace is not a comment; it is a CRDT-merged record of which of the 23 A2A agents participated, in what order. The type is the contract: the field means the same thing in eighteen months because the type does not change. The meaning is carried by the schema, not by the team that happened to write the log.

The hash chain is the durability mechanism

The hash chain (BR-842) is what makes the record tamper-evident across time. Each output links to the NodeVersions and model versions that produced it; tampering is detectable by construction, not by audit. But the chain also does something else: it pins the schema. A manifest written eighteen months ago carries the types it was written with, and a reader today parses it against those types, not against the current conventions. The chain is not just a tamper-evidence mechanism; it is a meaning-preservation mechanism. The decision is reconstructable not because someone remembers it, but because the bytes and their types are still there.

The chain is not just a tamper-evidence mechanism; it is a meaning-preservation mechanism. The decision is reconstructable because the bytes and their types are still there.

• Examiner windows are long — a review can reach back eighteen months to a system that has been replaced.
• A field name is a contract with the future: typed values, not free-text notes, so meaning survives the upgrade.
• The hash chain pins the schema, so a reader today parses against the types the entry was written with.
• Durability of meaning is a design property, not a happy accident of the logging format.

What survives and what does not

What survives is the typed, hash-linked record. What does not survive is the narrative — the Slack thread, the email, the slide deck, the verbal explanation someone gave at the time. Those are gone, or they are unrecoverable, or they are recoverable but meaningless without the context the team carried in their heads. The manifest is the record that does not need the team to be present. An examiner reads it eighteen months later and the fields answer: which model, which inputs, which agents, what output, which override, and a replay anchor. The team is gone; the record is not.

The team is gone; the record is not. A log that needs the team to be present is not a log that survives an examiner window.

— durability-of-meaning note

The honest scope

The manifest attests provenance and reproducibility — never truth. A durable record of a wrong decision is still a durable record of a wrong decision; durability is not correctness. Calibration is a separate, gated loop (Gate 1b). What the durable record gives you is the ability to answer the examiner eighteen months later, not the ability to answer "was the decision right." The first is a property of the substrate; the second is a property of the calibration loop, and we keep them separate because that is where the honesty is.