PROOF Layer

Overview

The PROOF layer creates an immutable record of every governance decision. It provides the audit trail that allows reconstruction of exactly what happened, when, and why.

Responsibilities

• •
  Generate proof ID — Create unique identifier for each decision
• •
  Create hash — Generate SHA-256 hash of decision details
• •
  Chain proofs — Link to previous proof record for integrity
• •
  Store durably — Persist proof records for minimum retention period

Requirements

ProofRecord Schema

{
  "proof_id": "prf_xyz789abc",
  "previous_proof_id": "prf_uvw456def",
  "timestamp": "2026-01-15T10:30:02Z",
  "intent_id": "int_abc123xyz",
  "entity_id": "ent_agent_001",
  "decision": "ALLOW",
  "payload_hash": "sha256:a1b2c3d4e5f6...",
  "chain_hash": "sha256:9z8y7x6w5v4u...",
  "signature": {
    "algorithm": "ECDSA-P256",
    "value": "MEUCIQDk..."
  },
  "metadata": {
    "implementation": "cognigate",
    "version": "1.0.0"
  }
}

Hash Chain Structure

Each proof record contains a chain_hash that incorporates the previous proof's hash, creating a tamper-evident chain:

chain_hash = SHA256(
  previous_proof.chain_hash +
  current_proof.payload_hash +
  current_proof.timestamp
)

┌──────────────┐     ┌──────────────┐     ┌──────────────┐
│   Proof N-2  │────▶│   Proof N-1  │────▶│   Proof N    │
├──────────────┤     ├──────────────┤     ├──────────────┤
│ chain_hash   │     │ chain_hash   │     │ chain_hash   │
│ = SHA256(    │     │ = SHA256(    │     │ = SHA256(    │
│   prev +     │     │   prev +     │     │   prev +     │
│   payload +  │     │   payload +  │     │   payload +  │
│   timestamp) │     │   timestamp) │     │   timestamp) │
└──────────────┘     └──────────────┘     └──────────────┘

Integrity Verification

To verify chain integrity, implementations MUST:

1. Retrieve the proof record to verify
2. Recompute payload_hash from stored payload
3. Verify payload_hash matches stored value
4. Retrieve previous proof record
5. Recompute chain_hash using previous chain_hash
6. Verify chain_hash matches stored value
7. Optionally verify digital signature

Retention Requirements