Sealed when it is made, signed by a name, checkable years later.
Three objects along the chain carry a seal: the session, the release and the count line. Each carries a fingerprint of its own contents, so a copy can be checked against the original without the original being handed over. What that gets a licensee is a chain a second party can walk without trusting us.
Three objects, each signed at a different moment by a different hand.
Each of the three is signed where it is made. None is collected first and signed afterwards, in bulk, by whoever happens to be holding it.
-
01
The session A session is sealed when it is made. It carries, inside itself, who made it and what they permitted — not in a register kept beside it, where the two can come apart. A record whose permission was not live at the moment it was made does not pass admission, and admission is where that is caught rather than somewhere downstream.
-
02
The release A release is signed by a named person or it does not go. That signature is a person putting their own name to what crosses to a machine. It is refusable on inspection by the party receiving it, and a release nobody will sign is a release that does not exist. A machine never receives a session; it receives this.
-
03
The count line A count line is signed at the machine, by the person who clears the machine to run, at the moment they clear it. The hour that is invoiced and the hour that is paid are that row. Clearance and count are one act, which is why there is nothing to reconcile afterwards.
Three moments, three hands, three names. None of the three is signed by a system on somebody's behalf, and none is signed later by somebody who was not there. That is the whole discipline, and it is the part that cannot be retrofitted: a signature that can be applied in bulk, afterwards, by a party with an interest in the result is not a signature. It is a filing convention.
The order matters as much as the signatures. Each object is made at the point where something crosses a boundary — into the corpus, out to a machine, into an hour that is owed for. A crossing with no name on it is where every account of this kind fails, and it fails quietly.
A copy can be checked without the original being handed over.
Each object carries a fingerprint of its own contents — a short value that follows from everything inside the object, and that no longer matches if anything inside it changes.
This is what makes a check possible between parties who share nothing else. A licensee holding a release can ask whether the thing in their hands is the thing that was signed for. A licensee holding an invoice can ask whether the rows behind it are the rows that were signed at their own machines by their own people. Neither question requires us to send them anything further, and neither requires them to send us what they hold.
What a second party can check, stated exactly:
That the copy is the object
The fingerprint the object carries either matches the contents in front of them or it does not. There is no partial answer and no judgment call in it.
That it has not changed since
What they hold is the object as it was sealed, or it is not. An alteration made afterwards shows as an alteration rather than as a plausible variant.
That the name on it signed it
A release names the person who signed for it. A count line names the person who cleared the machine. The name is part of what the seal covers, so it travels with the object.
What is described here is what each object is for and what can be checked against it. How any of it is built is a matter for the interface specification, which is available under NDA and does not belong on a public page. A counterparty's counsel needs the first; a counterparty's engineers get the second under paper.
A verifier stands outside the chain and never receives the contents.
The fingerprint crosses. The contents do not. That is the whole arrangement, and the dashed rule below is where it is enforced.
Fig. 1 — The sealed objects and the check. The dashed rule is the line the contents do not cross; the fingerprint does.
A machine never receives a session, and neither does a verifier. What a second party receives is enough to check the object already in their hands, and nothing that would let them reconstruct a recording of a person at work. Every object in the chain is checkable this way, which means the chain is checkable end to end by somebody who starts at either end of it.
A record only its custodian can check shows nothing to anyone who doubts the custodian.
A custodian's assurance is worth whatever the custodian is worth to the reader, which in a dispute is nothing.
A custodian's own assurance is worth whatever the custodian is worth to the person reading it, which in a commercial argument is nothing. If the answer to how do I know this hour was real is because we say so, then the answer is unavailable to the party who needs it most: the party in a dispute with us.
So the check is built to run without us in it. A licensee's counsel can walk from the invoice to the rows behind it, from a row to the machine and the named person on their own crew who cleared it, and from a release to the person who signed for what crossed. At no point in that walk is our word one of the inputs.
We are in the chain as a holder of records, not as the referee of them. A check that has to end at our books is not a check.
A chain a second party can walk is a chain that can show us to be wrong, in writing, to a counterparty. That is the intended property. A mechanism that can only ever confirm the party operating it is not a check; it is a display.
Sealing does not make a badly-made record a good one.
A perfectly tamper-evident record of a wrongly-taken measurement is a trustworthy record of a wrong number.
A seal answers one question: has this object changed since it was made? It does not answer, and cannot be made to answer, whether the object was right when it was made. Those are two different problems, answered in two different ways, and running them together is the standard move of the field.
Our answer to the second problem has two parts, and neither of them is a seal.
Admission at the front
Every session is accepted or refused before it becomes part of anything, and a refusal names its reason. Nothing is admitted silently and nothing is admitted retrospectively. A record that should not have been made does not become a good record by being sealed — it is refused, and the reason it was refused is itself a record.
AdmissionA named person at each crossing
At every point where something crosses, a named person signs, at that moment, in that place. The signature is not evidence that the person was right. It is a name attached to a decision, which is what makes the decision answerable to somebody afterwards.
The releaseThat is as far as it goes, and we say where it stops. A seal is about custody. Admission and a signature are about judgment. Neither does the other's job.
What can be shown long after the hour.
A question about an hour is usually asked long after the hour. The objects are built so that the answer does not depend on anybody remembering.
- What ran
- The named way of working a machine was cleared to run, on that machine, on that day.
- Who cleared it
- The named person who cleared it, and the start and stop of the hours that followed.
- What crossed
- That the release a machine received is the release that was signed for, checkable against the copy the licensee holds.
- What was owed
- That the hours invoiced and the hours paid came off one signed row.
A withdrawal does not disturb any of this. When a person ends their consent, their way of working stops being choosable and the copies go, on the two dates they are told: the out-of-service date, the day it stops being choosable, and the true date, the day the last copy is gone, backups included. What already happened still happened. The rows that were signed stay signed, because the money owed on them is owed to them.
What happens when a person stopsNeed a chain your own counsel can walk?
Tell us what your counsel needs to be able to check, and how long after the hour.