The log and revocation

Every fresh disclosure commits a signed receipt before it is returned. The receipt records the provider, the grant, the client, the purpose, the time, the surface, the request, the entries, versions and levels used, and a hash of the exact response. It never carries the values. A conditional read that changes nothing is recorded as an event pointing at the earlier read, without a new disclosure.

Other events share the same log: grants created, revoked and expired, standing rules applied, delegations redeemed, proposals decided, temporary overlays enabled, disabled and selected, purge instructions issued and acknowledged, operator actions and imports. Their details hold decision codes and opaque IDs only, never entry values, words a person said or tokens.

The log is append-only and hash-chained for each record partition, and a read's receipt is written in the same transaction as the read: no read succeeds without being logged. A chain shows tampering relative to a trusted checkpoint; a host that controls every key and checkpoint is not thereby unable to rewrite history, which is why the person should be able to export signed checkpoints. Receipts stay verifiable after a signing key is retired, from the provider's published keys and the person's export alone.

The log covers what happens through the provider. It cannot record what a recipient later does with a value it was given.

Revocation and purge

Revocation takes effect on the next attempted action: no further read succeeds under a revoked grant, including retries and conditional reads. Ending a grant does not remotely erase a copy a recipient already holds.

For every ended grant that allowed the recipient to keep a copy, the provider issues a signed purge instruction, delivered to the recipient's registered address with retries for up to 30 days, and the recipient can also collect outstanding instructions itself. The recipient answers with an acknowledgement saying purged, not_held or legal_hold, signed where it holds a registered key. An acknowledgement is the recipient's own statement, not proof of erasure, and nothing retracts a value already used in a recipient's conversation. A missing acknowledgement past its deadline stays visible to the person.

Read the receipt and log rules and revocation and purge.

Written against edition 1.0-draft-1: A9 Read receipts and the log