All four platforms available
Talk to usSee a governed action

Specimens

What a proof record looks like.

These four illustrative proof records show what elan1 records for an AI agent's write: one allowed, one held for a named approver, one refused at a pre-gate, and one small firm's journal entry as its chartered accountant reads it. Every specimen uses the fictional Kolam Components and is not customer data.

Two records in the same 16 fields — one allowed, one refused. Read each in plain English, field by field, or as links in a chain.

Illustrative specimenIllustrative specimen. Not customer data.

ASpecimen A · allowed write

An approver commits a month-end journal entry.

A named person, not the asker, approved the write. The single writer committed it. Govern sealed 16 fields and counted one governed action.

Illustrative specimenIllustrative specimen. Not customer data.

An approver committed journal entry je_specimen_5531 under month-end close rules, version 7, at 10:42 on 14 July 2027.

The record is number 1042 in this tenant's chain. It points to record 1041 by digest, and record 1043 points to it. The payload and the vocabulary are hashed, not stored. One governed action was counted.

Checked and recorded by elan1 Govern.

View the full record, with field notes and mapped clauses

BSpecimen B · refusal

The same 16 fields, for a no.

Same 16 fields, for a write intent refused at rung 3. The caller received a typed code; the record joins the chain; the meter shows 0.4 of a governed action.

Illustrative specimenIllustrative specimen. Not customer data.

An agent proposed posting purchase invoice pinv_specimen_0418. The GST gate (G4) found a rate mismatch at rung 3. The write was refused, the record was still written, and the meter shows 0.4 of a governed action (₹0.64 at L1 beyond the allowance).

Nothing changed in the system of record. F13 record_version stays at 0 because no version was written. The refusal is still evidence: it shows which rule said no, under which declaration version, and when.

Checked and recorded by elan1 Govern.

refusal: G4_GST_RATE_MISMATCH (illustrative)

Refusal codes on this site are illustrative. Real codes come from the frozen register in KernelPort v1; we never invent one.

View the full refusal record

01Check it yourself

Change one field and watch the chain break.

At L1, you check a record by recomputing its SHA-256 digest and comparing it with prev_digest on the next record. Try it on an illustrative chain, in your browser: nothing is sent anywhere.

Press “Recompute records 1041–1042” to hash both records with SHA-256 in this browser.

Illustrative specimen. Not customer data.seq 1041 · L1 · Guarded

Rendering · shown beside the record, never a seventeenth field

Outcome
Refused Refused at rung 3 · PRE-GATES
Approver
None. The write stopped before approval.
Refusal code
GATE.PRECONDITION_FAILED (illustrative)
Meter
0.4 governed action
4 of 16 fields: F01–F03, F14
tnt_specimen_01
1041
sha256:058169bb8da3e9f6b1b8511193b43b0636ffe1ecc6e4c46ce8a8a905964023f8
wr_specimen_7c1
purchase_invoice.post
decl_ap_purchase
4
2027.06.1
agt_specimen_ap01
agent
A1
00000000-0000-0000-0000-000000000000
0
sha256:5f105d2d818bc7fe36a7c1b7e367196610df5ee6e8d4c5296c9d8cc4b28428d8
sha256:1d967c9d1c583efd0a3135e57aa1035ebdd5ab4766f0572f10304feae7516d53
2027-07-14T10:39:12+05:30
Digest of seq 1041Not yet recomputed in this browser

Checked and recorded by elan1 Govern · tamper-evident (L1)

Record 1042 points back to record 1041 by digest (F03 prev_digest).

Illustrative specimen. Not customer data.seq 1042 · L1 · Guarded

Rendering · shown beside the record, never a seventeenth field

Outcome
Committed Committed at rung 7 · ACT
Approver
usr_specimen_approver, a named person who is not the asker
Refusal code
None
Meter
1 governed action
4 of 16 fields: F01–F03, F14
tnt_specimen_01
1042
sha256:8e37839e9548dfa9a4a8948b723c1517afb532a7eaceb617a7db6eff0ffdeac0
wr_specimen_7c2
journal_entry.post
decl_month_end_close
7
2027.06.1
usr_specimen_approver
human
A2
je_specimen_5531
2
sha256:e1eb0d8f0a7399695abf290e8fd2b6abc738ffd2fbdb8297f9ae44eb1a32ab6a
sha256:fd8e4d0b12b24bf22a591e735f211d8d7bb2bdf480058fdf89bb9d44666b2633
2027-07-14T10:42:07+05:30
Digest of seq 1042Not yet recomputed in this browser

Checked and recorded by elan1 Govern · tamper-evident (L1)

Next record · seq 1043 · F03 prev_digestsha256:f2423aa3d4559b7fd54b390a724f2a989744c10db034caa4a0e047cb5aca2c18

Verify offline (simulated)

L2 · Available Simulated here. The real check runs in the free offline verifier.

  1. 01

    Signature

    Check the Ed25519 signature on record 1042 against the residency domain's public key, obtained out of band.

  2. 02

    Anchoring

    Check the Merkle root that contains record 1042 against timestamps from two RFC 3161 authorities, anchored within 15 minutes.

  3. 03

    Evidence bundle

    Open the eight-member evidence bundle and run the free offline verifier, elan1-verify, on your own machine with no network.

At L1 records are hash-chained, not signed, and the check needs elan1. The three steps above describe the L2 design. Nothing on this page was signed or anchored.

How the browser recomputes: the preimage is the 19-octet domain string elan1.proof.seal.v6, then each of the 16 fields as a 4-octet big-endian length followed by its bytes. SHA-256 runs through WebCrypto on this device; nothing is sent. Where this is weak: the specimen encodes every field as UTF-8 text, while Seal v6 encodes identifiers and digests as fixed binary octets. It shows the method, not a production verifier.

02More specimens

Four records, four outcomes.

An allowed write, a refusal, a small firm's journal entry read by its CA, and a write held for a named approver.

Illustrative specimenCommitted
write_id wr_specimen_7c2

An allowed write: a month-end journal entry

A named approver commits a month-end journal entry.

View the full record
Illustrative specimenRefused
write_id wr_specimen_7c3

A refused write: a purchase invoice stopped at rung 3

A GST pre-gate refuses an agent's purchase invoice.

View the full record
Illustrative specimenCommitted
write_id wr_specimen_7Q2M

A small firm's journal entry, read by its CA

An agent posts a GL entry for Kolam Components*, within its autonomy.

View the full record
Illustrative specimenHeld
write_id wr_specimen_7c4

A write held for a named approver

A write above the autonomy ceiling waits at rung 6 for a person.

View the full record

03Field by field

Sixteen fields. Never a seventeenth.

Specimens A and B side by side. The format is the same on purpose: the difference is the verdict and the meter, not the shape.

Specimen A and Specimen B, F01 to F16 · Illustrative specimen. Not customer data.
FieldNameSpecimen A · committedSpecimen B · refusedWhat it tells you
F01tenant_idtnt_specimen_01tnt_specimen_01The tenant this record belongs to. Chains never cross tenants.
F02seq10421043The record's position in this tenant's chain. It only ever goes up by one.
F03prev_digestsha256:9f3c…e41asha256:4be1…90c7The digest of the record before this one. It is what links the chain.
F04write_idwr_specimen_7c2wr_specimen_7c3The identifier of the write intent. Every invoice line must carry one.
F05write_typejournal_entry.postpurchase_invoice.postThe kind of write, from the declaration's list of allowed write types.
F06declaration_iddecl_month_end_closedecl_gst_purchaseThe declaration — the process's rules in seven blocks — that was checked.
F07declaration_version74Which version of that declaration was in force at the time.
F08policy_version2027.06.12027.06.1The version of the policy rules evaluate() ran. No model, only rules.
F09actor_idusr_specimen_approveragt_specimen_ap01Who acted: the named approver, or the agent that proposed the write.
F10actor_kindhumanagentWhether the actor was a human or an agent.
F11autonomy_levelA2A1The autonomy level A0–A5 the write ran at; above the ceiling a person decides.
F12record_idje_specimen_5531pinv_specimen_0418The record in your system of record that changed, or would have.
F13record_version20The version of that record after the write.
F14payload_hashsha256:51b0…7d9asha256:c03a…11feA hash of the payload, not the payload itself, so personal data stays out of evidence.
F15lexicon_hashsha256:e2c4…0b16sha256:e2c4…0b16A hash of the vocabulary the write was expressed in, so meanings cannot drift.
F16recorded_at2027-07-14T10:42:07+05:302027-07-14T10:44:51+05:30When the record was sealed, with the time-zone offset.

At L1 Guarded · available

Tamper-evident to you

Recompute SHA-256 over the length-prefixed fields and walk the chain. A changed or missing record breaks it. Not signed.

From L2 Attested · available

Signed and checkable offline

Ed25519 signatures, Merkle roots anchored to two RFC 3161 authorities within 15 minutes, an eight-member bundle and a free offline verifier.

How verification works

// SEE IT

See the record being made.

The walkthrough follows one write from intent to this record, rung by rung, with a refusal branch.

See a governed actionRead the proof record