Evidence

The day someone stops trusting your word about what your AI did, logs become surprisingly useless. They live inside the system that made the decisions. They can be edited. They require the reader to trust the writer.

An auditor, a regulator, or a customer who is upset does not want a screenshot from your dashboard. They want something they can verify without your help.

Traditional logging assumes a friendly reader — a teammate debugging alongside you. It optimises for volume and search, not integrity. Once the log line is written, nothing prevents the next process from rewriting the file.

SIEM pipelines add durability but not portability. The audit trail lives inside the vendor. If the vendor disappears, the trail disappears with it — and the reader is back to trusting your word.

Evidence is a record designed for a reader who does not trust the writer. It is signed at the moment of creation, linked to every record that came before it, and verifiable by anyone with the record in hand. It survives the system that produced it.

Signed receipts record verifiable evidence of autonomous execution. Aarmos interprets that evidence into governance concepts such as intent, goals, policies, workflows, and compliance.

Scope. The open receipt standard covers three classes of evidence — transport (what was contacted), protocol (what was said), and action (what was done). Intent, goals, and reasoning are outside its scope; Aarmos interprets evidence into those higher-level governance concepts. No one has to trust Aarmatix to trust a receipt.

Every decision the run-time gate makes lands in a signed record. The records chain together. Verification is a standalone step that runs anywhere — a laptop, a build server, an auditor's machine.

• Portable. One command verifies a bundle without any Aarmos service running.
• Compounds. Each new record extends the chain; tampering with any earlier record breaks verification at the tampered point.
• Outlives us. The verification format is published; the tool that reads it is a small open artifact.

A customer disputes a decision your agent made six months ago. You export the records for that agent's day and hand them over. They run the verifier themselves.

The chain checks. The signatures check. The policy in force that day is stamped on the record. There is nothing to argue about — the conversation moves from "did this happen?" to "was this the right rule?", which is the conversation you wanted to have.

Isn't this the same as an append-only log?

Append-only prevents in-place edits. It doesn't prove authorship or ordering to a stranger. Evidence adds signatures and chaining so the record convinces someone who wasn't there.

What if we stop using Aarmos?

The records you have keep verifying. The receipt format is an open standard (CC BY 4.0 spec, Apache-2.0 code) with an independent, clean-room reference verifier. Nothing about your historical evidence depends on our servers — or on us.

How is this different from a receipt?

A receipt is one row of evidence. Evidence is the whole chain. See Receipts.

• Receipts
• Replay
• Authorities
• Verifier