What tamper-evident means at L1

At L1 Guarded, we make one claim about the integrity of the record: it is tamper-evident to you. Every word in that phrase is doing work, and this note explains each of them.

The mechanism

Every governed write, allowed or refused, produces a 16-field proof record. Seal v6 computes a SHA-256 digest over a length-prefixed preimage of those fields. The next record in the tenant's chain stores that digest in F03 prev_digest. F02 seq goes up by exactly one each time.

1. Recompute the digest of record n from its 16 fields.
2. Compare it with F03 prev_digest on record n + 1.
3. Check that F02 seq on record n + 1 is one more than on record n.
4. Walk the chain. A changed record breaks the next link; a missing record leaves a gap in seq and a mismatch in prev_digest.

Length-prefixing matters more than it seems. Without it, two different records could serialise to the same bytes — the boundary between one field and the next could shift without changing the string. With a length in front of each field, there is only one way to read the preimage.

Why "to you"

A hash chain shows that something changed to anyone who holds an earlier digest. It does not, on its own, stop a party with full control of the store from rewriting a stretch of history and recomputing every digest after it. If you have kept digests — in your own systems, in a report, in an export — you would see the break. That is the honest scope of L1: evident to you, the holder of the records.

Evidence rows cannot be updated or deleted, and the kernel is the single writer. Those are design facts that make tampering harder. They are not a promise a third party can check without us, so they are not what we claim.

What changes from L2

From L2 Attested, each record is also signed with Ed25519, Merkle roots are anchored to two RFC 3161 timestamp authorities within 15 minutes, and a free offline verifier checks an eight-member evidence bundle on your own machine. Only at L2 do we use the words "signed" and "checkable offline", because only then can someone outside elan1 check the record without trusting us.

The words we leave out

We do not use stronger words at L1. Words that promise a record can never be changed, or that it will stand up in court on its own, describe what a third party can establish — and at L1 a third party cannot establish it without us. At L2 that changes, and the claims register says so.