◂ Help Center

Append-Only Logs

Tamper-evident history with hash chains and signed checkpoints. No blockchain, no token, no miners—just a record nobody can quietly rewrite.

Builder Core Concepts updated Jun 27, 2026

Every Orbit keeps a transparency log: an ordered, append-only record of its decisions, role handoffs, and spending. The point is accountability you don’t have to take on faith—if someone gets ambitious and edits history, the edit is detectable by anyone holding a later copy.

Hash chains, not blockchains

You don’t need a token, a mining rig, or a speculative casino bolted to your org’s memory. You need a hash chain. Each log entry includes the hash of the entry before it:

entry[n].prev_hash = H(entry[n-1])
entry[n].hash      = H(entry[n].body || entry[n].prev_hash)

Change any past entry and its hash changes, which breaks the prev_hash of every entry after it. The tampering doesn’t hide—it cascades. The whole chain is a row of dominoes; you can’t move one without toppling the rest.

Signed checkpoints

Periodically, the current role-holders sign a checkpoint—the hash of the latest entry plus a timestamp. Members keep checkpoints. Later, anyone can compare their checkpoint against the live log: if the relay (or anyone) tried to serve a forked or rewritten history, the hashes won’t match the signatures, and the fork is exposed.

This gives you tamper-evidence without trust:

  • You don’t trust the server—it’s deaf and could be hostile.
  • You don’t trust any single member—roles rotate and can be recalled.
  • You trust the math: a rewrite that isn’t signed by a quorum, at the right point in the chain, is visibly invalid.

What goes in the log

  • Decisions reached (the question, the count, the outcome).
  • Role handoffs every thirty days.
  • Money: every two-signature transaction, with amounts.

What does not go in the log: real names, contents of private messages, or anything that would turn the record into a surveillance file. Accountability is about power, not people—log the decision, not the identity.

Status

The reference implementation and wire format live in the Protocol Spec (in progress). Until then, this page is the conceptual contract: append-only, hash-chained, checkpoint-signed.