Transparency log
An audit log you can check, not just read.
Most audit trails ask you to trust the dashboard. Ours is a sealed Merkle log with hourly signed tree heads and a public key. Membership is a proof you can verify offline, and tampering with any past event breaks the signature on every head since.
RFC 6962 Merkle · hourly Ed25519 heads · offline verifier
{
"treeSize": 184203,
"merkleRoot": "b7f1…9c0a",
"timestamp": "2026-06-13T18:00Z",
"signature": "ed25519:4f2a…"
}Sealed, not editable
Membership is a proof, not a promise.
Each event is a leaf hashed into a tree. The root is signed every hour. To prove an event is in the log, you check a short path of hashes up to a signed root, so the log cannot quietly drop or rewrite anything without the math giving it away.
change one event and every hash above it changes, so the signed root no longer matches.
The building blocks
Three primitives, one tamper-evident record.
Nothing here is exotic. It is the same transparency-log design that secures the public certificate ecosystem, applied to your agents' actions.
A hash-chained log
Events are leaves in an append-only Merkle tree, so each one is bound to every event before it.
Signed tree heads
The root is signed hourly under an Ed25519 key, with a public endpoint so anyone can pin it.
Receipts with proofs
A governed action can be issued as a receipt that carries its own membership proof and signed head.
Do not trust us
Verify it yourself, including against us.
An open-source verifier re-implements every check with zero dependencies, in TypeScript, Python, and a CLI. Verification needs nothing of ours running, so the proof does not depend on our goodwill.
# verify a receipt against a key you pinned npx @axiorank/audit-verify receipt.json --jwks jwks.json
Pin once, trust never again
Split-view protection
A second pair of eyes the operator cannot fool.
A dishonest log could try to show different histories to different people. Independent witnesses co-sign the heads they see, so a forked view cannot stay hidden. Run your own witness for the strongest guarantee.
Keep exploring
Continue across the control plane.
Stop trusting the dashboard. Start verifying the math.
Pin our key once, then prove any action happened and that the log was never rewritten, with nothing of ours running.