Approach
Built for the people whose job is to break it.
The users of an evidence system are adversaries: an adjuster minimizing a claim, an investigator assigning cause, opposing counsel attacking the record. Every design choice below exists because one of them will test it.
The claim discipline
The record states what the machine reported — never what happened. Reality is established by investigation; this record accelerates that investigation and survives it. Post-accident narratives are notoriously reshaped by hindsight, which is precisely why every perception value in our log carries its source, confidence, and sensor health, and why the system refuses to editorialize beyond them. A record of claims-with-provenance is the only honest input an investigation can get from a machine.
The trust model
- Self-attestation is the failure mode we exist to fix. A log signed only by keys on the robot proves that a key on that robot signed it — on platforms with documented default credentials, that is available to anyone on the network. So the registry countersigns every commitment, and Merkle roots are anchored to independent RFC 3161 timestamp authorities. Backdating becomes detectable even by an attacker who owns the robot's keys.
- The registry cannot cheat undetected either. An authority that could quietly rewrite history and promises not to is running a policy. Our commitments are append-only — no operation in the registry alters or deletes a committed root — and every root is anchored to external authorities we do not control, so a rewrite is provable by any verifier. Relying parties who want more than our word for the log's consistency can appoint independent witnesses whose countersignatures make a split view detectable — the role monitors play for Certificate Transparency, applied to us.
- Verification is trust-minimized. The verifier runs from a cold install: no account, no network, no contact with us. What a relying party must trust — the verifier build, the registry's public key, the timestamp authorities' roots — is small, explicit, and identical for every party. The pack does not supply the keys it is judged by; withholding is arithmetic on a signed span, not a number the producer chose.
Read-only, enforced
The collector subscribes only. A CI guard fails the build if any command-path publisher or raw-media path exists anywhere in the tree — because "publishes no command interfaces" is a certification-style claim, and we evidence it like one. Published resource budgets bound what a co-resident process could otherwise do to a control loop; the claim is about interfaces, and we never stretch it past them. And we hold the collector to the standard we document in others: its own attack surface, update path, and security posture are part of the technical briefing.
Built to outlive us
Verification requires no server of ours: the verifier runs from a cold start, the timestamps live with independent authorities, and a conformant verifier retains every schema version forever. If Red Egg Robotics ceased to exist tomorrow, every anchored record would remain verifiable. What does require us — witnessing new records, custody of stored data — is covered by continuity commitments made in writing, fleet by fleet: escrow and hosting jurisdiction are contract terms, not assumptions.
Privacy by structure, not policy
No raw video, audio, or point clouds, under any configuration flag. Media is referenced by content hash into the operator's own retention. Worker identity never enters an analytic pool. Vehicle event-recorder regulation established the pattern: mandate rich event capture, structurally exclude the personal.
What this system cannot do
- It cannot stop a rooted robot from going silent. It makes the silence a signed, visible gap — evidence in its own right.
- It cannot make a false sensor reading true. It makes the reading's provenance permanent, so the falsehood can be established later.
- It cannot substitute for investigation. It is built to survive one.
Our threat model is built from vendor manuals and published CVEs, and it records our concessions to our own claims before a reviewer finds them. It is available with the technical briefing.