Outcome · Compliance evidence
A supervisor asks about one decision. The answer has to be reconstructed from systems that were never asked to agree.
The log the model wrote, the ticket the handler wrote, the note the reviewer wrote and the export the data team produced are separate accounts of the same week. Assembling them is the work. Defending the assembly is the risk.
The one metric
No supervisory request has been answered from this record yet, so the slot is empty. It will be calibrated on the first real request in the first pilot, and this page will carry the figure and the date it was measured.
The one mechanism: one governed event stream, log or refuse
Every decision emits its record, or it does not take effect. That is the ordering that makes the rest of this page possible: the evidence is not written about the decision afterwards, it is the condition of the decision happening.
Each regulator’s artefact is compiled from that one stream, rather than four teams reconstructing four stories from the same week (UC092).
The policyholder’s status timeline is a projection of the same log, so the account the customer reads and the account the supervisor reads cannot drift apart (UC093).
[O]NX/services/nexus-workflows/src/services/governance.ts
[O]NX/services/nexus-workflows/src/services/audit-emitter.ts
One-Log, Many-Regulator Evidence Fabric
One governed event stream compiles into every regulator’s artefact, instead of four teams reconstructing four different stories from the same week.
shipped(shipped)The one honest bound
WHAT THIS DOES NOT DO YET
- The jurisdiction-pack emitters.
Read plainly: one governed stream exists and is in production. The compilers that render it into each regime’s own artefact are designed and not built, so today a pack is assembled from a complete record by a person, rather than emitted by a regime compiler. That is a real difference, and the days in the metric above will reflect it.
REFUSED
SCOPE_PREDICATE_MISSING
A surface that cannot say whose data it is reading refuses to read — no placeholder identifier, no silent organisation-wide query.
This is the failure that produces the worst possible compliance artefact: a complete, confident record of a query that crossed a tenant boundary. Refusing is louder, and it is the only version that stays defensible when someone reads the log a year later.
Start with the decisions you would be asked about first
You do not need the whole book on the record to answer a supervisor. You need the class of decision they ask about — adverse outcomes, referrals and overrides — carrying its own derivation from the day it happened. That is a first pilot, not a programme.