For the Chief Compliance Officer
Four regulators asked about the same week, and four teams reconstructed four different stories from the same records.
None of them was lying. They queried different systems, at different times, with different definitions of what counted, and the artefacts they produced disagree in ways that are hard to explain afterwards — which is exactly the moment the question stops being about the decisions and starts being about your controls.
One thread per decision, and every artefact compiled from it
intake.receivedrecorded
channel, timestamp and a provenance hash for every artefact that arrived with it
convening.tier.assignedsealed
the routing score, the room, the chair and the autonomy tier — the routing is itself an event
room.openedrecorded
seats, their assigned evidence slices, and the named human who will rule
evidence.attachedrecorded
each artefact bound to the seat that used it, with the hash it was read at
seat.dissenteddissent kept
the adversarial seat’s objection, kept in full rather than averaged into a score
gate.verdictsealed
the computed agreement predicate, its inputs, and both model versions, sealed
chair.ruledsealed
the named human’s ruling, the reasons, and whether it overrode the room
record.sealedsealedsha256:9c30ea1f…b544 (illustrative)
the thread closes and becomes replayable by anyone you grant a scoped read-seat
LOG-OR-REFUSE
If the event cannot be written, the effect does not happen. No record, no decision — which is the version of this promise that survives an outage, because the alternative quietly degrades into “we log when we can”.
Compiled from the same stream
EU AI Act Article-12 interaction logshipped(shipped)
automatic recording over the system’s lifetime, with oversight and risk fields
NAIC model-bulletin packdesigned, not built(designed, not built)
the emitter is designed and not built
OSFI E-23 packdesigned, not built(designed, not built)
the emitter is designed and not built
Colorado quantitative-testing packdesigned, not built(designed, not built)
the emitter is designed and not built
Three of the four are drawn and not running. What exists today is the stream they all read from, and the honest claim is that the hard part — one tamper-evident record with everything in it — is the part that is built.
[O] Illustrative composition, built from the components the product ships. No customer data appears anywhere on this site; the digest above is a placeholder. The interaction logger and the never-dropped audit emitter are observed at NX/services/nexus-workflows/src/services/governance.ts and NX/services/nexus-workflows/src/services/audit-emitter.ts.
The mechanism, in three lines
One governed event stream compiles into every regulator’s artefact, instead of four teams reconstructing four different stories from the same week.
First
The record is the decision
Nothing writes a log about work that already happened. The event is the thing that makes the effect legitimate, so an unwritable event is a refused effect rather than a missing line.
Then
The emitter does not drop
When the downstream store is unavailable the emitter retries behind a circuit breaker instead of failing silently. A gap in an audit trail is indistinguishable from concealment, and it is treated that way.
Finally
Regulators read a projection, not a copy
Each jurisdiction pack is compiled from the one stream rather than maintained beside it, so two packs cannot disagree about the same week. That is the design; three of the four compilers are not written yet.
shipped(shipped)We are not conformity-assessed, and we do not imply otherwise. Mapping a record to an obligation is a different claim from having been assessed against it.
The pack count is a design target, [P: to be calibrated] — one emitter of the four exists today, and the page will say four only when four run.
NX/services/nexus-workflows/src/services/audit-emitter.ts. The scoping predicate lives in the shared query layer every repository inherits, at ROS/src/middleware/organizationContext.ts and NX/services/nexus-auth/internal/authz/openfga_client.go; a surface that cannot resolve all three axes refuses rather than reading across the tenant boundary. None of these figures is a customer measurement — we have no customers yet.The honest limit
WHAT THIS DOES NOT DO YET
- The jurisdiction-pack emitters.