Every consequential decision here lands in a signed, tamper-evident record, and we publish it. Gate decisions prove a human set the authority envelope and held the abort. Misses prove the checks caught what they were built to catch.
The misses are the point. Every team has near-misses. Most bury them, and the chain of command never hears it. We sign ours and put them on the internet. A system you can trust is not one that never makes a mistake. It is one that catches its mistakes, records them, and shows you the record.
This proves a human signed a decision at a given time, and that a miss was logged and caught. It does not prove any decision was correct. That is the honest claim, and the only one worth making.
Real entries, anonymized. Every row carries a real hash; gates are served Ed25519-signed, misses hash-chained.
- /a human set the authority envelope / signed a gate decision at time T
- /a miss was logged, and who caught it (external instrument / operator / self)
- /the hash chain is intact and the Ed25519 signatures verify
- /that any decision was correct
- /anything about the mission, location, target, or people involved
Do not trust it. Check it.
Gate entries are Ed25519-signed by the register attestation key (public half below); the original governance-run's own per-entry signatures import as the run's ledger is wired in. Miss entries are hash-chained only, labeled as such. Verify with the public key.
The public keys are published at /verify alongside the provenance surface. Recompute the SHA-256 chain and verify each Ed25519 signature against this key; a single altered field breaks the chain.