The Ledger: Why Every Output Should Be Audit Logged

When a regulator asks a bank where a decision came from, the bank must produce an answer. If the decision came from a model that cannot reconstruct its own reasoning, the bank has a liability it cannot describe. We decided the record was not optional.

Proofs, not promises

Every composition carries a cryptographic record: the input, the compiled graph, the 32 verification checks, and the output. The record verifies offline against a published key. BlueBook does not need to be alive for you to believe the history.

const proof = await bb.ledger.prove("cmp_8f2c9a1e");
 
const result = await proof.verify({
  verifierKey: process.env.BLUEBOOK_VERIFIER,
  replay: true,
});
 
// → { valid: true, checks: 32, tampered: false }
//    verified with zero network calls

The three rules of our audit design

• The auditor never needs us. Proofs verify offline, forever.
• Everything is replayable. Any month, any request, without touching production keys.
• Attribution is technical, not cultural. If something left the building, the ledger says who and why.

Trust is a file, not a feeling.

We publish the verifier as open source. A security mechanism nobody can inspect is a security mechanism that does not exist.