The proof record has sixteen fields. We wrote "no seventeenth field, ever" into the design before we had finished arguing about the sixteen, because the hardest part of a record format is not choosing what goes in. It is refusing everything that wants to be added later.
Seven questions, sixteen answers
| Question | Fields |
|---|---|
| Which chain, and where in it? | F01 tenant_id · F02 seq · F03 prev_digest |
| Which write? | F04 write_id · F05 write_type |
| Under which rules? | F06 declaration_id · F07 declaration_version · F08 policy_version |
| Who acted, and how freely? | F09 actor_id · F10 actor_kind · F11 autonomy_level |
| What changed? | F12 record_id · F13 record_version |
| What was said, in what words? | F14 payload_hash · F15 lexicon_hash |
| When? | F16 recorded_at, with the time-zone offset |
A hash of the payload, not the payload
The most argued-over field is F14. The record holds a hash of the payload, not the payload itself. That keeps personal data out of evidence: a ledger line with a customer's name in it lives in your system of record, where your retention and erasure rules apply, and the evidence chain holds only a fingerprint of it.
It also raises a question we have not hidden. How does erasure under India's DPDP Act work alongside an append-only chain? The library note on DPDP sets out elan1's role under the Act, how erasure works as a governed write, and the question that remains.
Why the vocabulary is hashed too
F15 lexicon_hash is the field people ask about most. A write is expressed in a vocabulary — what "posted", "approved" or "customer" mean in this tenant. If those meanings drift, an old record could be read in a new sense. Hashing the vocabulary pins the meaning that applied when the record was sealed.
Why the count is fixed
- Every digest depends on the shape. Add a field and every verifier must learn a new preimage. Seal v6 is frozen so that the method never moves under anyone's feet.
- Verifiers stay small. From L2, a free offline verifier checks records on your own machine. A fixed shape keeps it small enough to read.
- New needs go elsewhere. Anything new belongs in the declaration, which is versioned, or in the payload, which is hashed — never in the record.
Refusals use the same sixteen fields. A refused write and an allowed write look alike on purpose: the difference is the verdict and the meter, not the format. You can see both side by side on the specimens page.
Corrections
- 10 Oct 2026Status updated at launch: elan1 Govern, Work, Decide and Run are available, with L1 Guarded and L2 Attested. Technical content unchanged.