Receipts should survive their issuer.
A separately operated log preserves a verified ActionReceipt and returns proof that it was retained.
An ActionReceipt outlives the agent: the process may be gone, but the action, authority, evidence, bounds, and recourse remain.
If the issuer is the only party retaining that receipt, the record can still be deleted or withheld. A witness verifies the exact receipt, commits it to a separately operated append-only log, and returns proof of inclusion.
What the witness must establish
| Function | What it establishes |
|---|---|
| Verify | The receipt’s hashes and structure recompute |
| Retain | The exact receipt exists outside the issuer’s runtime |
| Prove | The witness returns the leaf, log size, and root |
| Expose | Authentic same-size conflicting roots become equivocation evidence |
The current Bulla tree implements only the final objective predicate as an experimental check. Transport, retention policy, operator discovery, pooling, and a public WitnessBundle format wait for operational evidence.
Bulla Witnessing · private beta
Durable third-party records for consequential agent actions.
Verified on intake, committed to an append-only log, and returned with proof. The beta begins as one manually operated service—not a network, pool, or economic guarantee.
From service to protocol
01
Service
Run one manual receipt witness against real actions.
02
Market
Learn retention, privacy, latency, and price from a design partner.
03
Pool
Prove interoperability with a second independent operator.
04
Protocol
Freeze the format only after the pool has exercised it.
Collateral is not part of the beta. It requires an objective fault predicate, a real settlement rail, and independent operators before an economic mechanism can be specified honestly.