The record an auditor can read

An auditor asks a particular kind of question. Not whether the system is good, but whether the site can show what it did. Which model made this decision. Was the software running that day the software that was supposed to be running. What release was on the node that served the north end of the floor during the incident shift. These questions have answers only if someone wrote them down at the time, in a place that cannot be changed afterward.

Substrate writes them down. It keeps three records on the appliance, each answering a different kind of question, and together they let a site reconstruct what the platform did without asking anyone outside the building.

What Evaluation records

Evaluation traces every AI operation on the pool. For each call it records who asked, which model answered and with which adapter, whether a Local Bridge route was involved, how long the answer took, and whether it arrived inside the caller's latency budget or the caller fell back to what it carried locally.

This is the record of decisions. When a safety officer wants to know what the pool told a robot in the moment before it stopped, the trace is where the answer lives. When an operations lead wants to know whether a model swap changed the floor's behavior, the traces before and after the swap are the comparison. The record is granular enough to follow one call and complete enough to summarize a shift.

Retention is set by the site. Traces are the site's data, held under the site's policy, and the site decides how long to keep them and who may read them.

What Watchman records

Watchman is the integrity service. It continuously verifies that the node is running the signed, read-only software image it claims to be running and that the enclosure's tamper indicators are intact. When anything deviates, it writes an entry to an append-only record.

This record answers the question an auditor cares about before any other: was the platform whose behavior you are describing actually the platform that was installed. A clean Watchman record over a period says the signed image was intact and the enclosure untouched for that period. An entry in the record says something changed, and when. Either way, the answer is on the appliance and cannot be edited.

What the provenance record holds

Each Czar carries a provenance record covering its integration, its sealing, and every software load since. It documents what the node is and how it got to its current state. When a node joins a Grid it attests what it is running, and the provenance record is the longer history behind that attestation.

For an auditor, provenance answers which release served the floor on a given day, when it was loaded, and whether a rollback occurred. For a site running a Grid, it answers the same question for every node individually, so a question about one corner of the floor can be answered about the specific Czar that served it.

Why local and append-only matter

A log that lives in a vendor's cloud is the vendor's account of what happened. A log that can be edited is nobody's account. Substrate's records are the site's own, written on the appliance and held under the site's control, and the integrity and provenance records are append-only by construction. Entries are added and never changed.

This is what turns a record into evidence. The site can hand an auditor a trace and a Watchman history and say that this is what the platform wrote at the time, unaltered, and that no one outside the building had access to alter it. The claim holds because the platform has no route out and no one else can write to the record.

Answering the question

In practice, an audit question becomes a lookup. The auditor names a time, a robot, or a decision. The site pulls the Evaluation trace for the call, checks the Watchman record for the period, and reads the provenance record for the node that served it. The three together say what ran, on what, and when, and the site says so from its own records in its own building. That is the standard Substrate is built to meet, and the security overview at /security explains how the records fit with the rest of the integrity model.