Wave 3 — evidence spine
Every action, under whose authority, with which model
This is the record an auditor reads. Each action writes one record that links by hash to the record before it on the same work unit, so a record cannot be altered afterwards without breaking the chain. Corrections are new records that supersede; nothing is edited in place. Every record carries the authority relied on, the policy version in force and the model and prompt version that produced it.
Health
What the spine has recorded
Every recorded act by materiality, actor and outcome, including the ones that stopped and asked.
Records in spine
8,080
append-only
Agent actions
6,928
Human actions
1,152
Refused by authority
43
stopped before it happened
Corrections
67
supersede, never edit
Under legal hold
2,834
deletion suspended
24 of 24 sampled chains verified
Verification recomputes each record hash from its stored fields and checks that it links to the record before it. 83 records were recomputed on this page load. This is a live sample, not a stored flag: a full estate verification runs over 8,080 records and belongs in a scheduled job rather than a page render. Any single chain can be verified in full from its auditor pack.
Most recent records
newest first, across the whole estate
Approval of Commission pre-check — August cycle was attempted by the same person who raised it (Jordan Ellis) and refused under SOD-01, raise and approve.
ROP-7714 · #1 · Jordan Ellis (human) · Decision inbox · auth SOD-01
Approved and released: RFx comparison pack — logistics tender. Decided under grant PR1-AUTH-H1, delegated from Procurement & Source-to-Pay leadership, cap $250,000.
PRC-9041 · #1 · Avery Chen (human) · Decision inbox · auth PR1-AUTH-H1
Approval of Incrementality read — Q3 demand program was attempted by the same person who raised it (Avery Chen) and refused under SOD-01, raise and approve.
MKT-2214 · #2 · Avery Chen (human) · Decision inbox · auth SOD-01
Approval of Incrementality read — Q3 demand program was attempted by the same person who raised it (Avery Chen) and refused under SOD-01, raise and approve.
MKT-2214 · #1 · Avery Chen (human) · Decision inbox · auth SOD-01
Escalated to the accountable human: Renewal risk pack — Northwind Logistics. Decided under grant SL1-AUTH-H1, delegated from Sales leadership, cap $250,000.
SLS-4821 · #1 · Avery Chen (human) · Decision inbox · auth SL1-AUTH-H1
Correction posted against record 2
GB2A-1044 · #6 · Tower Lead, Source-to-Pay (human) · Acknowledge · auth GB2-AUTH-H1
Cleared build content
MK8A-1033 · #3 · Follow-up Sequencing Agent (agent) · Capture leads · auth MK8-AUTH-A1
Cleared run
MK8A-1033 · #4 · Event Return Agent (agent) · Capture leads · auth MK8-AUTH-A1
Holding at capture leads
MK8A-1033 · #5 · Event Return Agent (agent) · Capture leads · auth MK8-AUTH-A1
Cleared test
MK10B-1008 · #3 · Consent & Preference Agent (agent) · Deploy · auth MK10-AUTH-A1
Cleared change board approve
MK10B-1008 · #4 · Director, Marketing Operations (human) · Deploy · auth MK10-AUTH-H1
Holding at deploy
MK10B-1008 · #5 · Workflow Automation Agent (agent) · Deploy · auth MK10-AUTH-A1
Holding at draft standard
LG2C-1020 · #3 · Risk Framing Agent (agent) · Draft standard · auth LG2-AUTH-A1
Cleared issue
LG4A-1028 · #2 · Policy Attestation Agent (agent) · Chase · auth LG4-AUTH-A1
Where the records come from
records by function
Version stamps in force
what produced the records
A record that does not name its model, prompt and policy version cannot be root-caused when it turns out to be wrong. Every record in the spine carries all three.
Version registry
models, prompts, policies and tool sets, with what changed
| Kind | Identifier | Version | Status | Owner | Records |
|---|---|---|---|---|---|
| model | reasoner-core | 5.4 | current | Platform model council | 800 |
| model | reasoner-core | 5.3 | superseded | Platform model council | 0 |
| model | extract-lite | 2.9 | current | Platform model council | 5,560 |
| model | classify-fast | 1.7 | current | Platform model council | 0 |
| model | observe-signal | 3.1 | current | Sensing guild | 550 |
| model | reasoner-core | 5.2 | deprecating | Platform model council | 0 |
| policy | materiality-bands | v9 | current | Group controller | 2,376 |
| policy | materiality-bands | v8 | superseded | Group controller | 0 |
| policy | segregation-of-duties | v4 | current | Internal audit | 2,353 |
| policy | people-decisions | v3 | current | Chief people officer | 607 |
| policy | supplier-onboarding | v6 | current | Chief procurement officer | 578 |
| policy | customer-commitments | v5 | current | Chief revenue officer | 2,137 |
| prompt | orchestrator-brief | p14 | current | Chief of Staff office | 551 |
| prompt | orchestrator-brief | p13 | superseded | Chief of Staff office | 0 |
| prompt | gate-approval | p8 | current | Governance office | 170 |
| prompt | task-execution | p21 | current | Shared service engineering | 5,560 |
| prompt | challenger-review | p6 | current | Strategy office | 79 |
| prompt | observe-scan | p11 | current | Sensing guild | 550 |
| toolset | ledger-write | t7 | current | Finance systems | 2,425 |
| toolset | read-only-lookup | t12 | current | Platform engineering | 4,485 |
| toolset | notify-and-route | t5 | current | Platform engineering | 551 |
| toolset | document-fetch | t9 | current | Shared service engineering | 5,560 |
Authority register
who may decide what
Records schedule
retention and legal hold
What this is and is not
This is a real append-only structure. Records are written forward, each linked by a hash to the one before it on the same unit, and the verification above recomputes those hashes rather than reading a stored flag. What it is not, yet, is tamper-evident against someone with database access who rewrites an entire chain from the genesis record: that requires an external anchor — a witness log or a periodic notarized digest held outside this system — which is a wave 4 concern and is deliberately not claimed here. The estate the records describe is modeled, so the actions are illustrative; the mechanism that records them is not.
Actions
What is waiting on a person
The spine is append-only, so nothing here is cleared by editing it. Each queue below is a record that asked a person for a decision and has not had one.
Release or reject held work
An agent stopped and wrote why. The item does not move until somebody answers.
Review a corrected record
A later entry supersedes an earlier one. The original is never deleted, only marked.
Read a refusal and decide whether to override
An agent declined to act inside its authority. Overriding one is itself a recorded act.
Sample a critical act taken fully autonomously
Critical materiality, agent actor, no human in the loop at the time.
Operations
What this desk is allowed to start
A surface that only reports is not operable. This is the work this page can set in motion, and the bound it runs into.
Trigger and bound
This desk can start a chain verification, which recomputes every hash from the genesis record forward and reports the first sequence where the recomputation disagrees. It can also place a record under legal hold. It cannot amend, redact or delete an entry — a correction is written as a new record that names the sequence it supersedes.
Live observability
What the record shows right now
Outcome mix across the whole spine. In-progress is work that is still moving; held and refused are work that has stopped and is waiting on a human.
Current distribution
8,080 records
Is policy and strategy coming to fruition
Whether the written intent is holding here
8,080 records, 2,834 of them under legal hold, and the chain recomputes from genesis on every read.
Nothing on the record settles this
The written intent is that every act an agent takes leaves a record nobody can quietly change. The chain does recompute from the genesis record on each read, and a broken link would surface as a failed verification rather than as silence. What it does not do is prove the record is true: the hashes are computed by this platform, stored by this platform and checked by this platform, and none of them are anchored anywhere outside it. Treat this as a strong internal audit trail, not as external proof.