LedgerGuard · The Evidence Layer

Every system produces work.Almost none produce proof.

LedgerGuard is the part of Calyx that writes the record. At the moment a person releases something — not before, not reconstructed afterward — it binds the output, its sources, the model that produced it, the human who signed it, and the time, into a single tamper-evident record. Anyone holding a copy can verify it with standard tools and no cooperation from us.

The problem it solves

Reconstruction is not the same as a record.

When a decision gets questioned — by a regulator, a carrier, a client, or opposing counsel — most firms answer by assembling the story afterward. Emails, calendar entries, a memory of who was in the room, a file that was probably the version that went out.

That's building the record from whatever happened to survive. The parts that mattered usually didn't, and the parts that survived were never made to answer the question being asked.

Capture it at the moment of release, or you're writing history instead of keeping it.

The distinction is not academic. A privilege log entry once described AI-generated analysis in enough detail that prosecutors read it, identified the material, and moved to compel — the instrument built to shield it worked as an index instead. An absent record has the same property in reverse: it doesn't read as neutral, it reads as whatever the other side argues it means.

What it binds

Five things, under one hash.

The seal is not a logo on a PDF and not a signature block. It's a cryptographic digest computed over everything that mattered at the moment of release. Change any of it and the digest no longer matches.

Provenance RecordLG-2026-08-23-4F2A
OutputSHA-256 of the exact bytes released
SourcesDigest of each document retrieved, and which ones were used
ModelName, version, and weights hash
ReviewerNamed person of record who released it
TimingReleased at, and how long it was held under review
ScopeWhat was screened, and what was expressly not
Seald42a20ff9b172a1ff72f7b94871808ac8890d3337a998228af070609e1275de4

Hashed as received

Anything that arrives from outside is hashed before anything is done to it. The record establishes what the firm was actually handed, separately from what it produced.

Sources travel with the output

A finding that cites four documents carries the digest of all four. Whether the right documents were in front of the reviewer stops being a matter of recollection.

Model identity is part of the record

Name, version, weights hash. A record from March can be reconciled against exactly what was running in March — which matters, because models get updated and behavior moves with them.

Hold time is captured

Not just that a person reviewed it, but how long they had it. A consequential release disposed of in eleven seconds is a different fact than one held for twenty minutes.

Verification

Repeatable by a stranger, years from now.

The value of a record is not that we say it's authentic. It's that someone with no relationship to us can establish it independently, using tools that already exist on their machine.

$ shasum -a 256 finding-4F2A.pdf
d42a20ff9b172a1ff72f7b94871808ac8890d3337a998228af070609e1275de4  finding-4F2A.pdf

# compare against the digest on the provenance record
✓ match — the file is byte-identical to the one sealed

A match establishes the file is byte-identical to what was sealed. A mismatch establishes that it isn't — without revealing what changed, which is the correct behavior: the record proves integrity, it doesn't leak content.

No key, no software, no account, and no cooperation from Calyx is required. SHA-256 is a published standard implemented in every operating system. That's deliberate — a verification method that depends on the vendor still existing isn't verification, it's a promise.

Content integrity is fixed; time is asserted. A hash proves what a document contained, not when it existed. Where a qualified time source is required, the record is anchored to an RFC 3161 timestamp authority — and where it isn't, the record says so on its face rather than implying more than it has.

Amendment

Records that can't be corrected get abandoned.

A write-once record sounds rigorous and fails in practice. Work gets revised. A finding turns out to be wrong. A document is superseded. If the only options are leaving an error in place or destroying the record, people quietly stop keeping it.

So LedgerGuard amends rather than overwrites. The original hash is preserved. The amendment is hashed separately. The two are chained. What a firm can show later is not just the current state but the sequence — what was said in March, what changed in June, and who signed each one.

v1 · MAR

Original

Sealed at release. Never modified, never deleted, and still independently verifiable.

v2 · JUN

Amendment

Hashed on its own terms, linked to the record it amends, with its own reviewer and time.

v3 · HEAD

Current

The version in force. The chain behind it stays intact and readable.

Deletion is recorded too. Where a record is purged under a retention policy, a hash-chained tombstone remains — showing that something existed, when it was created, and when it was removed. A gap in a chain reads badly. A documented removal doesn't.

Where it runs

Underneath everything else.

LedgerGuard isn't a product a firm buys separately. It's the layer every other part of Calyx writes to, which is why the same verification method works across all of them.

01

On the node

Every consequential release from the governed AI system seals here. The record stays on the firm's own hardware, and the node keeps a local count — it does not phone home, because a count that reports outward is surveillance of the firm's work volume.

02

On screening findings

Instrument and counterparty screens issue a provenance record alongside the finding, including the digest of the document exactly as it arrived.

03

On operator work

Work released by an operator inside a client firm carries the same record as work released by the firm's own people. The chain doesn't distinguish, and neither should it.

What it isn't

Stated plainly, so nothing is assumed.

Not a blockchain. There is no chain of custody across parties to maintain, no token, and no distributed ledger. A digest and a signature answer the question directly.
Not proof that the content is correct. It proves what was released, who released it, and what they had. Whether the judgment was right is a separate question, and a human's to answer.
Not a notarisation or a legal attestation. Where a qualified time source or an evidentiary standard is required, that is named explicitly rather than implied.
Not a monitoring system. It records releases. It does not watch users, score them, or report activity to anyone outside the firm.
Not retroactive. A record can only be made at the moment of release. Nothing here reconstructs a decision that wasn't sealed when it happened.
Not ours to hold. The records live with the firm. They don't sit in a vendor log, and they don't disappear if we do.

The work is the easy part.

Every firm can produce output now. The question that decides whether it holds up is narrower — who released it, on what basis, and can you show that to someone who wasn't there.

Start the conversation