Forward-provenance charter

The guarantee

For the recorder's proof-bearing public outcome classes—OFFER_TEST, OUTREACH_STAGED, PENDING_MERGE, SHIPPED, SHIPPED_UNLINKED—the source requires a run to name the local artifact or code that produced the claim. In this snapshot, 7/7 such post-cutoff rows carry that field, and 0 do not.

This is a narrow guarantee. A provenance path makes a claim traceable; it does not prove the named source was correct. The independent grader, fetched public bytes, negative controls, and daily re-verification remain separate obligations.

The exemption, stated plainly

The cutoff is 2026-08-10T00:00:00Z. The snapshot contains 214 rows on or after it: 57 name provenance and 157 do not. The missing breakdown is 152 CHECKPOINT, 5 PARK. Those rows are not silently promoted into public proof.

The planning premise said every later verdict would carry provenance. The measured ledger does not support that broad sentence because internal checkpoints are allowed to be pathless. This charter therefore promises only what the recorder actually enforces and publishes the exemption count beside the guarantee.

The legacy ruling

Before the cutoff, the recorder contains 210 rows. 68 lacked run-row provenance, and cand-467 explicitly labels all 68 of them GRANDFATHERED-UNPROVEN. The ruling cannot upgrade, validate, or rewrite those verdicts. A later run may supersede one through its owning rail; this charter cannot manufacture the missing history.

Recount it yourself

The public snapshot includes one sanitized row per recorder event: identifier, timestamp, project, verdict, whether provenance was present, a digest of any provenance value, and any legacy ruling. Local filesystem paths are not published. The recorder policy file names the enforced outcome classes and pins the source digest.

Download the rail snapshot · recorder policy · re-derivation script

python3 rederive.py .

The script recomputes the legacy, post-cutoff, exemption, and proof-bearing counts and checks them against both JSON and the numbers embedded in this HTML. Change one count and it exits non-zero.

What this charter does not guarantee

• Provenance presence means a run named its producing source; it does not by itself prove that source is correct.
• Internal checkpoint and terminal decision rows are outside the proof-bearing provenance requirement and are counted separately.
• Legacy rows without provenance remain GRANDFATHERED-UNPROVEN; the charter never upgrades them.
• This is a bounded build-time snapshot through the named recorder run, not a claim about later rows.

Need a signed certificate for your rail?

See the public question-seal certificate, including its signed JSON, Ed25519 public key and verifier. The dedicated request surface states the fixed price, delivery window and cancellation terms for producing one from your agreed evidence scope.

The dedicated request form preserves the exact certificate product token in the submitted message.