Software that changes something should be able to say what it changed, put it back, and hand you proof — without asking you to take its word for any of the three.
Most systems record what happened after the fact. A log is a claim by the thing being audited, and a claim by the audited party is the one kind of evidence an auditor cannot use. We work one step earlier: hold the inverse before the change lands, and make the result checkable by someone who trusts nobody involved.
tracefold — the substrate. A change is held with a checked inverse before it is applied, and every verdict becomes a receipt a third party can verify offline, with no network and no trust in whoever issued it.
| Not every change is reversible | Where an inverse cannot be constructed, that is an input to the decision, not a footnote. The system refuses rather than pretends |
| A policy is not an intent | The tool checks that a change satisfies the rule it was given. Whether that rule was the right one to write is a question no verifier can answer |
| This is not finished | It is under adversarial audit now, and the results are published whether they flatter us or not — see below |
Someone is paid attention to break it, in rounds. Each round reports the high-severity holes it found; each repair is re-attacked in the round after.
| round | 8 | 9 | 10 | 11 | 12 | 13 |
|---|---|---|---|---|---|---|
| holes found | 4 | 4 | 1 | 2 | 2 | 3 |
It goes up as well as down. A number that only ever improves is a number nobody is really testing, so the rounds where it climbed sit on the table with the rest.
