LedgerGuard is the part of Calyx that writes the record. At the moment a person releases something — not before, not reconstructed afterward — it binds the output, its sources, the model that produced it, the human who signed it, and the time, into a single tamper-evident record. Anyone holding a copy can verify it with standard tools and no cooperation from us.
When a decision gets questioned — by a regulator, a carrier, a client, or opposing counsel — most firms answer by assembling the story afterward. Emails, calendar entries, a memory of who was in the room, a file that was probably the version that went out.
That's building the record from whatever happened to survive. The parts that mattered usually didn't, and the parts that survived were never made to answer the question being asked.
The distinction is not academic. A privilege log entry once described AI-generated analysis in enough detail that prosecutors read it, identified the material, and moved to compel — the instrument built to shield it worked as an index instead. An absent record has the same property in reverse: it doesn't read as neutral, it reads as whatever the other side argues it means.
The seal is not a logo on a PDF and not a signature block. It's a cryptographic digest computed over everything that mattered at the moment of release. Change any of it and the digest no longer matches.
| Output | SHA-256 of the exact bytes released |
| Sources | Digest of each document retrieved, and which ones were used |
| Model | Name, version, and weights hash |
| Reviewer | Named person of record who released it |
| Timing | Released at, and how long it was held under review |
| Scope | What was screened, and what was expressly not |
| Seal | d42a20ff9b172a1ff72f7b94871808ac8890d3337a998228af070609e1275de4 |
Anything that arrives from outside is hashed before anything is done to it. The record establishes what the firm was actually handed, separately from what it produced.
A finding that cites four documents carries the digest of all four. Whether the right documents were in front of the reviewer stops being a matter of recollection.
Name, version, weights hash. A record from March can be reconciled against exactly what was running in March — which matters, because models get updated and behavior moves with them.
Not just that a person reviewed it, but how long they had it. A consequential release disposed of in eleven seconds is a different fact than one held for twenty minutes.
The value of a record is not that we say it's authentic. It's that someone with no relationship to us can establish it independently, using tools that already exist on their machine.
A match establishes the file is byte-identical to what was sealed. A mismatch establishes that it isn't — without revealing what changed, which is the correct behavior: the record proves integrity, it doesn't leak content.
No key, no software, no account, and no cooperation from Calyx is required. SHA-256 is a published standard implemented in every operating system. That's deliberate — a verification method that depends on the vendor still existing isn't verification, it's a promise.
Content integrity is fixed; time is asserted. A hash proves what a document contained, not when it existed. Where a qualified time source is required, the record is anchored to an RFC 3161 timestamp authority — and where it isn't, the record says so on its face rather than implying more than it has.
A write-once record sounds rigorous and fails in practice. Work gets revised. A finding turns out to be wrong. A document is superseded. If the only options are leaving an error in place or destroying the record, people quietly stop keeping it.
So LedgerGuard amends rather than overwrites. The original hash is preserved. The amendment is hashed separately. The two are chained. What a firm can show later is not just the current state but the sequence — what was said in March, what changed in June, and who signed each one.
Sealed at release. Never modified, never deleted, and still independently verifiable.
Hashed on its own terms, linked to the record it amends, with its own reviewer and time.
The version in force. The chain behind it stays intact and readable.
Deletion is recorded too. Where a record is purged under a retention policy, a hash-chained tombstone remains — showing that something existed, when it was created, and when it was removed. A gap in a chain reads badly. A documented removal doesn't.
LedgerGuard isn't a product a firm buys separately. It's the layer every other part of Calyx writes to, which is why the same verification method works across all of them.
Every consequential release from the governed AI system seals here. The record stays on the firm's own hardware, and the node keeps a local count — it does not phone home, because a count that reports outward is surveillance of the firm's work volume.
Instrument and counterparty screens issue a provenance record alongside the finding, including the digest of the document exactly as it arrived.
Work released by an operator inside a client firm carries the same record as work released by the firm's own people. The chain doesn't distinguish, and neither should it.
Every firm can produce output now. The question that decides whether it holds up is narrower — who released it, on what basis, and can you show that to someone who wasn't there.
Start the conversation