PILLAR · GOVERN & PROVE
Evidence a regulator can check without trusting you
Every decision signed at capture, chained, anchored off host, and exportable as a package your auditor verifies themselves.
HMAC-SHA256
Signed at capture
Daily roots
Anchored off host
8 frameworks
Pre-mapped controls
Exit 0 / 1
Verifier runs in CI
Signing chain
A tamper-evident chain, not just a log
Signed at capture
Every LLM call, agent step, MCP tool call, and policy change is HMAC-SHA256 signed as it is recorded, before it travels anywhere.
signed in-process · keys never transmitted
A chain, not a pile
Each signature includes the previous event's signature, so altering one breaks the chain and deleting one gaps the sequence.
session_id · seq_no · prev_sig
Server countersignature
Ingest re-signs every accepted event with a server-held key and rejects replays, so a compromised client cannot fabricate records.
client HMAC + server_sig · dual-layer
Inside a record
What a single AI decision leaves behind
Delete or alter any event and the signatures stop matching. Tampering is detectable without trusting obsvr.
Anchoring
Proof that outlives the host
Immutable storage
Events land in immutable WORM storage, unmodifiable and undeletable even by an admin, with retention configured to your framework's requirement.
WORM · S3 Object Lock today · configurable retention
Daily roots, anchored twice
Each day's events are hashed into a Merkle tree whose root is committed to S3 Object Lock and a dedicated GitHub repo.
one 64-char root per day · content never leaves
Ed25519-signed roots
Anyone can verify a daily root with the published public key alone, with no obsvr credential and no obsvr backend in the loop.
public key published alongside the roots
Point-in-time provenance
The resolved model snapshot and policy version are hash-sealed into the daily root, so what was live last quarter stays provable.
provable from the anchor date forward
Independent verification
Nobody has to take our word for it
obsvr-verify-bundle
The standalone verifier recomputes the Merkle root offline and checks the Ed25519 signature with the public key alone.
exit 0 = intact · exit 1 = tampered · --json for CI
The verifier ships in the pack
The script, daily roots, and anchoring status travel inside the evidence package, so your auditor confirms the chain without calling you.
02_integrity_and_merkle/
Prove what was live. Months later.
$ obsvr-provenance --at 2026-01-14
model gpt-4o-2024-08-06 · resolved snapshot, hash-sealed
policy c9a1f3e · hash-sealed in the daily root
✓ sealed by anchored root · roots/…/2026-01-14.jsonCompliance
The chain is the compliance story
Security posture