Concepts

Trust Ledger & proofs

An append-only, Ed25519-signed, hash-chained ledger with Merkle inclusion proofs — re-verified on every load, and offline-verifiable by anyone.

The Trust Ledger is TrustFix's proof layer: a per-tenant, append-only, hash-chained, Ed25519-signed record of the things TrustFix proved. Receipts are written when the engine verifies a fix, opens a remediation PR, issues or revokes an agent passport, signs an attestation, or records a gate decision. The screen never shows an entry the ledger didn't sign.

How the integrity guarantee works

Each entry's hash is computed over its canonical content — the org, sequence number, entry type, a hash of the payload, the previous entry's hash, and the timestamp — so every entry is chained to the one before it and signed with an Ed25519 key. Signed Merkle tree-heads cover all entries.

• Chain verification recomputes every hash, link, and signature. Any mutated, reordered, or forged row breaks it. The browse view re-verifies the chain on every load and shows a live CHAIN VERIFIED · N ENTRIES badge — or names the exact sequence and reason if it fails. A tampered entry renders as does not verify, not a green check.
• Inclusion proofs verify a single entry's Merkle path to a signed root plus the head signature, so an auditor can re-verify one action offline.

Verify it yourself

You don't have to take our word for it. The browse view at Trust Ledger (/trust-ledger) reads GET /api/ledger; Verify proof fetches and checks a Merkle inclusion proof for a single entry via GET /api/ledger/[id]/proof, which verifies the proof server-side before it hands it back — a proof this endpoint returns is one that verifies.

Some receipts are also minted as public artifacts with their own verification pages — an agent passport at /agent-passport/[id] and a Trust Receipt (a signed posture snapshot) at /trust-receipt/[id]. Either can be checked by an auditor or cyber-insurer with zero access to your tenant.

Replay the past, provably

The Authority Time-Machine on the ledger replays your authority state as of any past ledger point, proven against the signed Merkle root committed at that tree size — the proof badge is green only when the recomputed prefix root matches the signed historical root. The Time Travel screen replays posture history over the same data.