Documentation Feature catalog
Activity and evidence
Inspect recorded actions, decisions, checks, and outcomes, with clear distinctions between verified facts, reported claims, and missing observations.
Product guide · implementation in progress
On this page
Current status: partial receipts and isolated signing validation. An Ed25519
Wall-envelope signer/verifier has local invariant and replay tests and refuses
to claim protected. Key provisioning, Wall integration, durable sequence
custody, the complete ledger, and cross-boundary signing remain incomplete.
Evidence classes
| Class | Meaning |
|---|---|
| Mediated | Cella performed or authorized a defined protected operation |
| Observed | A boundary fact was captured, without claiming internal intent |
| Provider-reported | The agent or external provider supplied the signal |
| User-asserted | A human supplied a task, decision, exception reason, or approval |
| Unavailable | The signal was not captured or cannot be verified |
Integrity, coverage, and enforcement
Records cover admitted input, effective authority, observed commands/processes, denials, approvals, checks, state changes, interventions, cost, Effects, outputs, and external consequences. Event ID, Run, Cell, sequence, actor, source, coverage, policy digest, request/result digests, and prior hash preserve attribution.
The collector stays outside the Cell; distinct signing roles authenticate their own claims. Wall, Gateway, Relay, the secret boundary, and policy enforce their contracts. Evidence explains what each boundary enforced, observed, or caused; it does not replace enforcement, reveal hidden model reasoning, or prove that an allowed action was a wise decision. Missing signals and covert-channel limits stay explicit.
Inspection experience
Intended history inspection reconstructs causal events. File explanation links a change to Runs and checks without inventing reasoning. Restore creates a child Run; it does not assert exact deterministic replay.
Example: an inspector can see which generation requested a denied resource, which policy applied, and which boundary refused it.
See evidence events, signing roles, and components.
Source: docs/concepts/features.md · Current feature milestones