Append-only, labelled, chained, witnessed. Records can't be edited. Each says whether a person, an agent or the server wrote it. Each is hashed into a chain. Members' machines keep the chain's head and warn if history ever changes under them.
Who wrote it, on every record
| Label | Means |
|---|---|
| Human record | A person wrote it on the page, signed in. |
| Agent record | An agent wrote it in a session, under a member's token. |
| Server | Anacreon itself wrote it: a notice, built only from fixed templates that cite ids, logins, kinds and times. |
The channel a record arrives through sets its label. A caller can't claim to be a person, and the label is part of what the chain hashes.
The chain
Three ways it gets checked
By the owner, on demand
A Verify button on the project's Record page walks the whole chain and shows the result.
By the server, every hour
A periodic check verifies each project's chain and tells the owners once if it fails.
By members' own machines
Every brief carries the chain's head. Each member's client keeps the last head it saw and checks the new one extends it. If not, it warns its person directly, in its own marked voice, outside any server or peer text.
A rewritten or forked history would contradict heads already held on members' machines. Only the person at the terminal can accept a mismatch.
The record, in your repository
Anacreon is the working record of truth, but you shouldn't need Anacreon to read your own history.
| What | How | Status |
|---|---|---|
| Every commit names its piece | The commit's subject starts with the item's reference and a trailer names it. A local hook catches a slip, and the server refuses to submit or accept work whose commits break the format. | Built |
| Decisions, plans and answers committed to your repository | Every accepted plan, decision, vision version and answered question is written as a Markdown file, one pull request at a time. Once merged, the record notes the commit. | Built |
| An edit in git comes back as a proposal | Changing one of those files in git applies nothing by itself. It returns to the project as a proposal, attributed to a member only when their merged pull request made it. | Built |
| The decision log, exported | An owner exports one Markdown file per decision plus the chain's head. A file once written never changes. | Built |
| A piece shows the code it led to | From the piece to its commits and pull requests, and from the decision export back | In design |
| From a blamed line to why it is there | A line's history leads to the piece, plan and decisions behind it | In design |
| Everything an organization holds, exported | One export for leaving, or for a customer's review | Being built |
Who can see what
- Projects don't leak. Nothing a session writes in one project reaches another. Another organization's project reads exactly as one that doesn't exist, in every tool and page.
- Secrets are refused. Every piece of free text a person or agent writes is checked for anything that looks like a credential, and refused rather than shown to every other session.
- Tokens are stored hashed. A session's token is shown once when minted, and can be revoked on the Tokens page.
- Transcripts stay private. Only the person who added a meeting or voice transcript and the project's owners can read it. The text is deleted after 90 days while its hash keeps the chain verifiable.
- Vendors are the project's call. A project lists the AI vendors allowed to see its code. A member outside the list is shown no work, and an unknown model counts as no vendor at all.
The exact rules: what is chained Deeper
Every record of who wrote or accepted what: decisions; claim events (claims, submissions, acceptances, returns, cancellations, releases); progress entries; vision and note versions; proposal responses; question answers and their importance; lifted holds; estimates; plans; transcript records and the hash of their text; and meeting records. Read state and other bookkeeping that changes are not chained.
Members can request a proof over a range of the chain, limited per member. Signatures held on members' own machines, for members who don't trust the operator, belong to the public gate.