Problem
Ledger records a hash-chained event trail, but storage-layer integrity and authority-layer attestation are not structurally separated. They are different guarantees enforced by different mechanisms, and mixing them weakens the audit story.
Observed (external): nono (nono.sh) seals security-relevant events into a SHA-256 Merkle root at the dataplane layer, and signs receipts at the hosting/authority layer. Storage integrity and authority attestation are distinct, composable claims.
Interpretation: Perseus Ledger should expose the same split: the chain proves the store didn't silently change; the signed receipt proves who authorized what under which evidence. A receipt's signature should be verifiable independently of the storage root, and vice versa.
Proposed change
Document (and where cheap, encode) the two-layer model in the Ledger spec:
- dataplane: Merkle/root-hash over the append-only event store;
- authority layer: receipts signed by the control plane, binding actor, boundary, evidence, action, result;
- both layers verifiable independently; neither implies the other.
Acceptance criteria
- Spec section defines the two layers and their independence.
- Verifier can check storage-root integrity without replaying signatures and vice versa.
- Failure cases: tampered store with valid receipts, and valid store with revoked/absent signature, are distinguishable outcomes.
- Docs lint passes.
Grounding
Problem
Ledger records a hash-chained event trail, but storage-layer integrity and authority-layer attestation are not structurally separated. They are different guarantees enforced by different mechanisms, and mixing them weakens the audit story.
Observed (external): nono (nono.sh) seals security-relevant events into a SHA-256 Merkle root at the dataplane layer, and signs receipts at the hosting/authority layer. Storage integrity and authority attestation are distinct, composable claims.
Interpretation: Perseus Ledger should expose the same split: the chain proves the store didn't silently change; the signed receipt proves who authorized what under which evidence. A receipt's signature should be verifiable independently of the storage root, and vice versa.
Proposed change
Document (and where cheap, encode) the two-layer model in the Ledger spec:
Acceptance criteria
Grounding