Open any "AI agent governance" page and you'll find the phrase tamper-proof audit log . Treat it as a tell. No append-only file on a machine someone administers is tamper-proof, and a vendor who says otherwise is either not thinking hard about it or hoping you won't.

So let's do the un-sexy thing and be precise. In an earlier post I showed an agent acting as a human and leaving a receipt. This post is about how much you can actually trust that receipt — what it genuinely proves, the three places it honestly can't, and — the part most "trust" posts skip — which of those are shipped and which I'm still building. All runnable from the Apache core; verify it yourself.

What it actually is, and what that genuinely proves

The ledger is an append-only, hash-chained file: each event carries the SHA-256 of the exact bytes of the event before it, so the records form a chain.…