The kernelGovernance outside the governed system, out of process, so the governed system cannot disable, edit or outrun its own control layer.
The two seal modesPrivate, with self-asserted time and no egress of any kind. Witnessed, where a digest alone is timestamped by an independent authority.
The open verifier and the versioned formatVerification with public mathematics, free and permanent. The format version inside the signed bytes, so older records verify permanently and newer records are never rejected by older verifiers.
Post-quantum hybrid signingClassical and lattice signatures together, so records issued today survive the transition.
Air-gapped operationFiled as architecture rather than offered as a configuration. No egress, no account, no network dependency.
The chained ledgerRecords linked to one another, so a deletion is visible as a gap rather than an absence.
PresenceBiometric or passkey binding of a named individual to a seal, at the moment of sealing, on their own device.
The ChaperoneObserved capture inside a third-party editor, where material is fingerprinted before it crosses any boundary.
Drift measured per personA behavioural pattern belonging to one operator, visible as theirs rather than averaged into the system.