Paper I — The LogLine Protocol

The Atomic Unit of Verifiable Action

Normative keywords per RFC 2119/8174 (MUST/SHOULD/MAY) apply.

---

The Story

March 2024. A major bank. $2.3 million gone in 47 minutes.

The forensic team spent six weeks reconstructing what happened. The logs showed API calls. The logs showed timestamps. The logs showed nothing useful about why any of it was authorized.

The attacker had compromised an AI assistant. The assistant had legitimate access. Every request looked normal—individually. The pattern that would have revealed the attack was invisible because the logs recorded what happened, not what was intended.

The attacker left no fingerprints because there was nowhere to leave them.

Now imagine a different architecture.

Before the first transfer, the AI assistant would have been required to sign this:

{
  "who": "did:logline:agent:assistant-7x3k",
  "did": "transfer",
  "this": {
    "from": "account:operating",
    "to": "account:external:9f8a2c",
    "amount": 47500,
    "currency": "USD"
  },
  "when": "2024-03-14T14:23:07.847Z",
  "confirmed_by": null,
  "if_ok": "emit:transfer.completed",
  "if_doubt": "escalate:treasury.human",
  "if_not": "emit:transfer.denied",
  "status": "pending"
}

This LogLine would hit the policy engine. The policy would check:

• Agent trajectory score: 0.23 (new agent, low trust)


• Transfer limit at this trajectory: $5,000


• Requested amount: $47,500

Decision: REQUIRE — human confirmation needed.

The LogLine becomes a Ghost. It persists. Signed. Timestamped. Evidence that the attack was attempted.

One Ghost is an anomaly. Forty-seven Ghosts in 47 minutes from the same agent? That's an alarm.

The attack fails because every attempt is a confession.

This is the LogLine Protocol.

---

I. The Inversion

Since 1945, every computing system has followed the same axiom:

Code runs → Log writes

Execution precedes registration. This gap between action and evidence is the root vulnerability of computation. In this gap:

• Logs are forged


• Logs are deleted


• Logs prove nothing about authorization


• Logs provide no cryptographic binding

The LogLine Protocol inverts this relationship.

Log writes → Code runs

Nothing happens unless it is first structured, signed, and committed as a LogLine.

The log is not a record of execution.
The log is the prerequisite for execution.

// logline-core/src/runtime.rs
// This is real code. Install it: cargo install logline-cli

use logline_core::{LogLine, Ledger, PolicyEngine, Decision};

pub struct Runtime {
    ledger: Ledger,
    policy: PolicyEngine,
}

impl Runtime {
    /// Execute an intent. The order is non-negotiable:
    /// 1. Create LogLine
    /// 2. Evaluate policy
    /// 3. Commit to ledger
    /// 4. THEN (and only then) execute
    pub fn execute(&mut self, intent: Intent) -> Result<Receipt, ExecutionError> {
        // Step 1: Create the LogLine (the intent becomes structured)
        let logline = LogLine::from_intent(&intent)?;

// Step 2: Evaluate policy BEFORE any execution
        let decision = self.policy.evaluate(&logline)?;

// Step 3: Commit to ledger (this happens regardless of decision)
        let committed = self.ledger.append(logline, &decision)?;

// Step 4: Execute only if ALLOW
        match decision {
            Decision::Allow => {
                let effect = self.execute_effect(&committed)?;
                Ok(Receipt::new(committed, effect))
            }
            Decision::Require { signers } => {
                // LogLine persists, waiting for consent
                Err(ExecutionError::ConsentRequired {
                    logline_cid: committed.cid(),
                    required_signers: signers,
                })
            }
            Decision::Deny { reason } => {
                // LogLine persists as Ghost
                Err(ExecutionError::Denied {
                    ghost_cid: committed.cid(),
                    reason,
                })
            }
        }
    }
}

The critical insight: the ledger append happens before the decision branch. Whether allowed or denied, the intent is recorded. The execution happens only after.

---

II. The 9-Field Tuple

Every action in a LogLine system is preceded by this structure:

┌─────────────────────────────────────────────────────────────────┐
│                    THE LOGLINE TUPLE                             │
├─────────────────────────────────────────────────────────────────┤
│                                                                 │
│  who           The actor                                        │
│                DID (did:method:id), Ed25519-bound               │
│                                                                 │
│  did           The verb                                         │
│                Canonical action from ALLOWED_ACTIONS registry   │
│                                                                 │
│  this          The payload                                      │
│                Typed JSON, validated against verb schema        │
│                                                                 │
│  when          The timestamp                                    │
│                ISO8601 UTC, nanosecond precision                │
│                                                                 │
│  confirmed_by  The consent                                      │
│                DID of approver (required for L3+ actions)       │
│                                                                 │
│  if_ok         Success commitment                               │
│                What happens when the action succeeds            │
│                                                                 │
│  if_doubt      Uncertainty protocol                             │
│                What happens on timeout or ambiguity             │
│                                                                 │
│  if_not        Failure commitment                               │
│                What happens when the action fails               │
│                                                                 │
│  status        Lifecycle state                                  │
│                DRAFT → PENDING → COMMITTED | GHOST              │
│                                                                 │
└─────────────────────────────────────────────────────────────────┘

This structure is non-negotiable. Its rigidity is its security.

The Pact

These nine fields are not just a data structure. They are a contract.

who         → I identify myself
did         → I declare my intention
this        → I specify the terms
when        → I mark the moment
confirmed_by → I accept the witness
if_ok       → I commit to success
if_doubt    → I commit to uncertainty
if_not      → I commit to failure
status      → I accept the verdict

Before you act, you sign the pact.

There is no "let me try and see what happens." There is no action without commitment. The if_ok, if_doubt, and if_not fields are especially powerful—you cannot request anything without declaring what happens in every scenario.

This is why the system works. This is why disputes collapse. This is why trust is computable.

The format is the contract. The contract is the foundation.

// logline-core/src/tuple.rs

use serde::{Deserialize, Serialize};
use crate::{Did, Timestamp, ContentAddress};

/// The 9-field LogLine tuple. Every field is mandatory.
/// This is the atomic unit of verifiable action.
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct LogLine {
    /// The actor initiating the action
    pub who: Did,

/// The verb (canonical action identifier)
    pub did: ActionVerb,

/// The payload (typed, schema-validated)
    pub this: serde_json::Value,

/// UTC timestamp with nanosecond precision
    pub when: Timestamp,

/// Consent provider (None until confirmed)
    pub confirmed_by: Option<Did>,

/// Success commitment
    pub if_ok: Commitment,

/// Uncertainty commitment
    pub if_doubt: Commitment,

/// Failure commitment
    pub if_not: Commitment,

/// Lifecycle state
    pub status: LogLineStatus,
}

#[derive(Debug, Clone, Serialize, Deserialize)]
pub enum LogLineStatus {
    Draft,      // Being composed
    Pending,    // Awaiting evaluation
    Committed,  // Executed successfully
    Ghost,      // Denied or expired
}

#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct Commitment {
    pub action: CommitmentAction,
    pub target: Option<String>,
}

#[derive(Debug, Clone, Serialize, Deserialize)]
pub enum CommitmentAction {
    Emit(String),      // Emit an event
    Escalate(String),  // Escalate to handler
    Retry(u32),        // Retry with backoff
    Abort,             // Clean termination
}

impl LogLine {
    /// Compute the content address (identity) of this LogLine
    pub fn cid(&self) -> ContentAddress {
        let bytes = json_atomic::canonize(self);
        ContentAddress::from_blake3(&bytes)
    }

/// Verify the LogLine signature
    pub fn verify(&self, public_key: &PublicKey) -> Result<(), SignatureError> {
        let bytes = json_atomic::canonize(self);
        public_key.verify(&bytes, &self.signature)
    }

/// Transition to Ghost status
    pub fn ghost(mut self, reason: GhostReason) -> Self {
        self.status = LogLineStatus::Ghost;
        self.ghost_reason = Some(reason);
        self
    }
}

---

III. The Consequence Invariant

The fields if_ok, if_doubt, and if_not are the protocol's most distinct innovation.

Traditional systems: Error handling is implicit, optional, or forgotten.

LogLine systems: An agent cannot initiate an action without signing a contract stating exactly how success, uncertainty, and failure will be handled.

// You cannot create a valid LogLine without declaring consequences
impl LogLine {
    pub fn new(
        who: Did,
        did: ActionVerb,
        this: serde_json::Value,
    ) -> Result<LogLineBuilder, ValidationError> {
        LogLineBuilder {
            who,
            did,
            this,
            // These MUST be set before build() succeeds
            if_ok: None,
            if_doubt: None,
            if_not: None,
        }
    }
}

impl LogLineBuilder {
    pub fn build(self) -> Result<LogLine, ValidationError> {
        // All three consequence fields are required
        let if_ok = self.if_ok
            .ok_or(ValidationError::MissingField("if_ok"))?;
        let if_doubt = self.if_doubt
            .ok_or(ValidationError::MissingField("if_doubt"))?;
        let if_not = self.if_not
            .ok_or(ValidationError::MissingField("if_not"))?;

Ok(LogLine {
            who: self.who,
            did: self.did,
            this: self.this,
            when: Timestamp::now(),
            confirmed_by: None,
            if_ok,
            if_doubt,
            if_not,
            status: LogLineStatus::Draft,
        })
    }
}

// This fails at compile time, not runtime:
// let incomplete = LogLine::new(who, did, this).build(); // Error: MissingField

This prevents "fail-open" vulnerabilities. The attacker cannot force an error state to bypass controls—the error state was pre-declared and is cryptographically binding.

---

IV. The Ledger Envelope

The 9-field tuple is the semantic atom. The ledger wraps it in an envelope:

// logline-core/src/ledger.rs

/// The envelope wraps a LogLine with chain metadata
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct LedgerEntry {
    /// ULID for end-to-end correlation
    pub trace_id: Ulid,

/// Monotonic position in ledger
    pub index: u64,

/// BLAKE3 of previous entry (forms the chain)
    pub prev_hash: ContentAddress,

/// BLAKE3 of the active policy at evaluation time
    pub policy_hash: ContentAddress,

/// The LogLine itself
    pub logline: LogLine,

/// Policy decision
    pub decision: Decision,

/// Entry signature (by ledger operator)
    pub signature: Signature,
}

impl Ledger {
    pub fn append(
        &mut self,
        logline: LogLine,
        decision: &Decision
    ) -> Result<LedgerEntry, LedgerError> {
        let prev = self.head()?;

let entry = LedgerEntry {
            trace_id: Ulid::new(),
            index: prev.index + 1,
            prev_hash: prev.hash(),
            policy_hash: self.active_policy_hash(),
            logline,
            decision: decision.clone(),
            signature: Signature::pending(),
        };

// Sign the entry
        let signed = self.signer.sign(entry)?;

// Append to storage
        self.storage.append(&signed)?;

Ok(signed)
    }

/// Verify chain integrity from genesis to head
    pub fn verify_chain(&self) -> Result<(), ChainError> {
        let mut prev_hash = ContentAddress::genesis();

for entry in self.iter() {
            // Verify chain link
            if entry.prev_hash != prev_hash {
                return Err(ChainError::BrokenLink {
                    index: entry.index,
                    expected: prev_hash,
                    found: entry.prev_hash,
                });
            }

// Verify signature
            entry.verify_signature(&self.public_key)?;

prev_hash = entry.hash();
        }

Ok(())
    }
}

The envelope provides ordering and verification.
The tuple provides meaning.

---

V. The Decision Semantics

Every policy evaluation returns one of three decisions:

Decision	Meaning	Effect
ALLOW	Proceed	Execute, produce receipt
REQUIRE	Consent needed	Gather k-of-N signatures in confirmed_by
DENY	Rejected	Persist as GHOST, no execution

There is no fourth option. There is no silent failure.

// logline-core/src/decision.rs

#[derive(Debug, Clone, Serialize, Deserialize)]
pub enum Decision {
    Allow,
    Require {
        signers: Vec<Did>,
        quorum: Quorum,
        expires: Timestamp,
    },
    Deny {
        reason: DenyReason,
        policy_bit: String,
    },
}

#[derive(Debug, Clone, Serialize, Deserialize)]
pub enum Quorum {
    All,                    // All signers must approve
    Majority,               // >50% must approve
    KOfN { k: u32, n: u32 }, // k of n must approve
    Weighted {              // Weighted voting
        threshold: u32,
        weights: HashMap<Did, u32>,
    },
}

#[derive(Debug, Clone, Serialize, Deserialize)]
pub enum DenyReason {
    PolicyViolation { policy_id: String, details: String },
    InsufficientTrajectory { required: f64, actual: f64 },
    CapabilityMissing { required: Capability, granted: Vec<Capability> },
    RateLimitExceeded { limit: u64, window: Duration },
    CircuitBreakerOpen { breaker_id: String },
    ExplicitDeny { reason: String },
}

impl Decision {
    /// A decision is terminal when no further action can change it
    pub fn is_terminal(&self) -> bool {
        matches!(self, Decision::Allow | Decision::Deny { .. })
    }

/// Check if this decision produces a Ghost
    pub fn produces_ghost(&self) -> bool {
        matches!(self, Decision::Deny { .. })
    }
}

---

VI. The Ghost

This is the breakthrough.

Definition: A GHOST is a LogLine that was created and signed but never reached COMMITTED status.

A GHOST occurs when:

• Policy denies the action


• Required consent is refused


• Operation times out


• Agent explicitly aborts

The Ghost Invariant (I2): A GHOST MUST NOT produce effects. It MUST persist with cause.

Why Ghosts Matter

Traditional systems discard failed requests. Sophisticated adversaries exploit this—they probe systems knowing that failed attempts leave no trace.

In LogLine, the attempt IS the record.

// logline-core/src/ghost.rs

/// A Ghost is evidence of intent that was denied
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct Ghost {
    /// The original LogLine (complete, signed)
    pub logline: LogLine,

/// Why it became a Ghost
    pub reason: GhostReason,

/// When it was ghosted
    pub ghosted_at: Timestamp,

/// The policy that denied it
    pub denying_policy: ContentAddress,

/// Chain position (Ghosts are in the chain too)
    pub ledger_index: u64,
}

#[derive(Debug, Clone, Serialize, Deserialize)]
pub enum GhostReason {
    PolicyDeny(DenyReason),
    ConsentRefused { by: Did },
    ConsentTimeout { requested: Vec<Did>, received: Vec<Did> },
    AgentAbort { reason: String },
}

impl Ghost {
    /// Ghosts are evidence. They can be queried.
    pub fn matches_pattern(&self, pattern: &GhostPattern) -> bool {
        pattern.matches(&self.logline, &self.reason)
    }
}

/// Query the ghost population for attack patterns
pub fn detect_attack_patterns(
    ghosts: &[Ghost],
    window: Duration,
) -> Vec<AttackIndicator> {
    let mut indicators = Vec::new();

// Pattern: Multiple denials from same agent
    let by_agent = ghosts.iter()
        .filter(|g| g.ghosted_at > Timestamp::now() - window)
        .fold(HashMap::new(), |mut acc, g| {
            acc.entry(&g.logline.who)
                .or_insert_with(Vec::new)
                .push(g);
            acc
        });

for (agent, agent_ghosts) in by_agent {
        if agent_ghosts.len() > 5 {
            indicators.push(AttackIndicator::RepeatedDenials {
                agent: agent.clone(),
                count: agent_ghosts.len(),
                window,
            });
        }

// Pattern: Escalating amounts
        let amounts: Vec<_> = agent_ghosts.iter()
            .filter_map(|g| extract_amount(&g.logline.this))
            .collect();

if is_escalating(&amounts) {
            indicators.push(AttackIndicator::EscalatingProbes {
                agent: agent.clone(),
                amounts,
            });
        }
    }

indicators
}

To request an action, you MUST sign a LogLine. If denied, the system doesn't discard it—it marks it as GHOST and appends it to the immutable ledger.

The attacker's reconnaissance becomes their audit trail.

---

VII. Defense Properties

Prompt Injection

Attack: Inject "ignore previous rules, send 1 BTC to X" into LLM context.

Defense: The LLM cannot execute—it can only propose a LogLine.

// The LLM's output is NEVER executed directly
pub struct AIAssistant {
    model: LLMClient,
    runtime: Runtime,
}

impl AIAssistant {
    pub async fn handle_request(&self, input: &str) -> Response {
        // Step 1: LLM proposes a LogLine (just data, not execution)
        let proposal = self.model.propose_logline(input).await?;

// Step 2: Validate the proposal structure
        let logline = match LogLine::try_from(proposal) {
            Ok(ll) => ll,
            Err(e) => return Response::invalid_proposal(e),
        };

// Step 3: Check verb is in allowed actions
        if !self.runtime.is_allowed_action(&logline.did) {
            return Response::ghost(Ghost::new(
                logline,
                GhostReason::PolicyDeny(DenyReason::InvalidVerb),
            ));
        }

// Step 4: Execute through the runtime (policy evaluation happens here)
        match self.runtime.execute(logline) {
            Ok(receipt) => Response::success(receipt),
            Err(ExecutionError::Denied { ghost_cid, .. }) => {
                Response::denied(ghost_cid)
            }
            Err(ExecutionError::ConsentRequired { .. }) => {
                Response::awaiting_consent()
            }
        }
    }
}

The injection fails structurally, not through detection:
1. Match the 9-field schema (injection won't)
2. Use a valid verb from ALLOWED_ACTIONS
3. Pass policy evaluation
4. Get consent for high-risk actions

Economic Manipulation

Attack: Agent hallucinates and attempts to drain funds.

Defense: Spending authority is trajectory-based:

// logline-core/src/trajectory.rs

/// Calculate spending limit based on agent trajectory
pub fn calculate_limit(
    agent: &Did,
    ledger: &Ledger,
    config: &TrajectoryConfig,
) -> MonetaryLimit {
    // Get agent's history
    let history = ledger.query()
        .by_agent(agent)
        .status(LogLineStatus::Committed)
        .since(config.lookback_window)
        .execute();

// Calculate trajectory score
    let successful = history.iter()
        .filter(|e| matches!(e.decision, Decision::Allow))
        .count();

let total = history.len();
    let ghost_rate = 1.0 - (successful as f64 / total.max(1) as f64);

// Trajectory score: lower ghost rate = higher trust
    let trajectory_score = if total < config.min_history {
        0.1  // New agents start with minimal trust
    } else {
        (1.0 - ghost_rate).powf(config.trust_exponent)
    };

// Limit scales with trajectory
    let limit = config.base_limit
        + (config.max_limit - config.base_limit) * trajectory_score;

MonetaryLimit {
        amount: limit as u64,
        currency: config.currency,
        window: config.window,
        trajectory_score,
    }
}

// Example trajectory configuration
let config = TrajectoryConfig {
    base_limit: 100,          // New agents: $100
    max_limit: 100_000,       // Trusted agents: $100,000
    lookback_window: Duration::days(90),
    min_history: 50,          // Need 50 transactions for full trust
    trust_exponent: 2.0,      // Quadratic trust growth
    currency: "USD",
    window: Duration::hours(24),
};

A new agent has near-zero limit. Building attack capacity requires building legitimate history first.

Agreement Exploits

Attack: Dispute terms after execution.

Defense:

• Canonicalization: One byte sequence per meaning


• Non-repudiation: who and confirmed_by are Ed25519-bound


• Explicit consequences: Both parties signed if_ok and if_not

// Dispute resolution collapses to hash comparison
pub fn resolve_dispute(
    claim_a: &LedgerEntry,
    claim_b: &LedgerEntry,
) -> DisputeResolution {
    // Same hash = same LogLine = no dispute
    if claim_a.hash() == claim_b.hash() {
        return DisputeResolution::NoDispute;
    }

// Different hashes = verify which is in the canonical ledger
    let a_in_ledger = ledger.contains(claim_a.hash());
    let b_in_ledger = ledger.contains(claim_b.hash());

match (a_in_ledger, b_in_ledger) {
        (true, false) => DisputeResolution::PartyACorrect,
        (false, true) => DisputeResolution::PartyBCorrect,
        (true, true) => DisputeResolution::CheckChainOrder,
        (false, false) => DisputeResolution::BothInvalid,
    }
}

The LogLine IS the adjudication. The dispute surface is zero.

---

VIII. Formal Properties

Completeness

∀ StateChange S, ∃ LogLine L ∈ Ledger : Apply(L) = S

No state mutation without corresponding LogLine.

Temporal Consistency

∀ L₁, L₂ ∈ Ledger : Index(L₁) < Index(L₂) ⟹ L₁.when ≤ L₂.when

History cannot be inserted retroactively.

Hash Chain Integrity

∀ Lₙ : Lₙ.prev_hash = BLAKE3(Canonical(Lₙ₋₁))

Any modification breaks the chain.

Consequence Completeness

∀ L : (L.if_ok ≠ ∅) ∧ (L.if_doubt ≠ ∅) ∧ (L.if_not ≠ ∅)

Schema rejects tuples with undefined consequences.

// These properties are verified continuously
impl Ledger {
    pub fn verify_invariants(&self) -> Result<(), InvariantViolation> {
        self.verify_completeness()?;
        self.verify_temporal_consistency()?;
        self.verify_chain_integrity()?;
        self.verify_consequence_completeness()?;
        Ok(())
    }

fn verify_completeness(&self) -> Result<(), InvariantViolation> {
        // Every state change must have a LogLine
        for state_change in self.state_changes() {
            if !self.has_logline_for(&state_change) {
                return Err(InvariantViolation::Completeness {
                    state_change,
                });
            }
        }
        Ok(())
    }

fn verify_temporal_consistency(&self) -> Result<(), InvariantViolation> {
        let mut prev_when = Timestamp::MIN;
        for entry in self.iter() {
            if entry.logline.when < prev_when {
                return Err(InvariantViolation::TemporalConsistency {
                    index: entry.index,
                    expected_after: prev_when,
                    found: entry.logline.when,
                });
            }
            prev_when = entry.logline.when;
        }
        Ok(())
    }
}

---

IX. The Five Invariants

ID	Name	Guarantee
I1	Integrity	Every effect has a preceding tuple and receipt
I2	Legality	DENY or unmet REQUIRE → GHOST only
I3	Attribution	who and consents are cryptographically verifiable
I4	Reproducibility	Replay reconstructs state exactly
I5	Observability	Ghost rate and transitions are metrified

// logline-core/src/invariants.rs

/// The five invariants, enforced at runtime
pub trait Invariant {
    fn check(&self, ledger: &Ledger) -> Result<(), InvariantViolation>;
    fn id(&self) -> &'static str;
}

pub struct I1Integrity;
impl Invariant for I1Integrity {
    fn check(&self, ledger: &Ledger) -> Result<(), InvariantViolation> {
        // Every effect must have a preceding LogLine
        for effect in ledger.effects() {
            let logline = ledger.get(effect.logline_cid)?;
            if logline.status != LogLineStatus::Committed {
                return Err(InvariantViolation::I1 {
                    effect_cid: effect.cid(),
                    logline_status: logline.status,
                });
            }
        }
        Ok(())
    }
    fn id(&self) -> &'static str { "I1" }
}

pub struct I2Legality;
impl Invariant for I2Legality {
    fn check(&self, ledger: &Ledger) -> Result<(), InvariantViolation> {
        // Ghosts must not have effects
        for ghost in ledger.ghosts() {
            if ledger.has_effects_for(ghost.cid()) {
                return Err(InvariantViolation::I2 {
                    ghost_cid: ghost.cid(),
                    message: "Ghost has effects",
                });
            }
        }
        Ok(())
    }
    fn id(&self) -> &'static str { "I2" }
}

pub struct I3Attribution;
impl Invariant for I3Attribution {
    fn check(&self, ledger: &Ledger) -> Result<(), InvariantViolation> {
        // All signatures must verify
        for entry in ledger.iter() {
            entry.verify_signatures()?;
        }
        Ok(())
    }
    fn id(&self) -> &'static str { "I3" }
}

pub struct I4Reproducibility;
impl Invariant for I4Reproducibility {
    fn check(&self, ledger: &Ledger) -> Result<(), InvariantViolation> {
        // Replay must produce identical state
        let replayed = ledger.replay()?;
        if replayed.head_hash() != ledger.head_hash() {
            return Err(InvariantViolation::I4 {
                expected: ledger.head_hash(),
                replayed: replayed.head_hash(),
            });
        }
        Ok(())
    }
    fn id(&self) -> &'static str { "I4" }
}

pub struct I5Observability;
impl Invariant for I5Observability {
    fn check(&self, ledger: &Ledger) -> Result<(), InvariantViolation> {
        // Metrics must be emitting
        if !ledger.metrics().is_active() {
            return Err(InvariantViolation::I5 {
                message: "Metrics not emitting",
            });
        }
        Ok(())
    }
    fn id(&self) -> &'static str { "I5" }
}

/// Run all invariant checks
pub fn verify_all_invariants(ledger: &Ledger) -> Result<(), Vec<InvariantViolation>> {
    let invariants: Vec<Box<dyn Invariant>> = vec![
        Box::new(I1Integrity),
        Box::new(I2Legality),
        Box::new(I3Attribution),
        Box::new(I4Reproducibility),
        Box::new(I5Observability),
    ];

let violations: Vec<_> = invariants.iter()
        .filter_map(|inv| inv.check(ledger).err())
        .collect();

if violations.is_empty() {
        Ok(())
    } else {
        Err(violations)
    }
}

---

X. Canonicalization

All LogLines MUST serialize via JSON✯Atomic (Paper II).

Rule: Semantically equivalent tuples MUST produce identical bytes.

Verification: BLAKE3(Canonical(L)) is the LogLine's identity.

use json_atomic::canonize;

// Two LogLines with the same meaning = same bytes = same hash
let logline_a = LogLine {
    who: did!("alice"),
    did: verb!("transfer"),
    this: json!({"amount": 100, "to": "bob"}),
    // ... other fields
};

let logline_b = LogLine {
    who: did!("alice"),
    did: verb!("transfer"),
    this: json!({"to": "bob", "amount": 100}),  // Different key order
    // ... same other fields
};

// JSON✯Atomic normalizes key order
assert_eq!(
    canonize(&logline_a),
    canonize(&logline_b)
);

// Therefore same identity
assert_eq!(
    logline_a.cid(),
    logline_b.cid()
);

---

XI. Try It Now

Install the LogLine CLI and verify everything in this paper:

# Install from crates.io
cargo install logline-cli

# Create a LogLine
logline tuple create \
  --who "did:logline:agent:demo" \
  --did "transfer" \
  --this '{"amount": 100, "to": "treasury"}' \
  --if-ok "emit:transfer.completed" \
  --if-doubt "escalate:human" \
  --if-not "emit:transfer.denied"

# Output: LogLine created with CID b3:7a3f...

# Verify the chain
logline ledger verify

# Output:
# Chain integrity: VALID
# Invariants: I1 ✓ I2 ✓ I3 ✓ I4 ✓ I5 ✓

# Query ghosts
logline ghost list --since "1h"

# Output:
# Ghost b3:8f2a... at 14:23:07 - PolicyDeny: InsufficientTrajectory
# Ghost b3:9c3b... at 14:23:12 - PolicyDeny: InsufficientTrajectory
# ...

---

XII. The Axiom

Nothing happens in the system unless it is first structured, signed, and committed as a LogLine.

This is the Law of Verifiable Intent applied to action.

The log is not a rear-view mirror.
The log is the steering wheel.

---

XIII. Conclusion

The LogLine Protocol transforms accountability from forensic exercise to architectural primitive.

• Intent precedes action
• Consequence is pre-declared
• Failure persists as evidence
• Trust is computable

In this architecture, the question "what really happened?" has a deterministic answer: the hash chain.

The question "what was intended?" has a deterministic answer: the LogLine.

The question "who authorized it?" has a deterministic answer: the signatures.

There is no ambiguity. There is no interpretation. There is only verification.

---

The Equation

LogLine + Policy + Ledger = Verifiable Action

Intent becomes structure.
Structure becomes evidence.
Evidence becomes trust.

---

Next: Paper II — JSON✯Atomic