Audit
Audit is not the last step.
Three of the nine stages are audit, and they sit inside the pipeline rather than after it. A ledger can be locally correct in every cell and still fail as a whole — which is exactly the case the matrix layer exists to catch.
Three scopes
- Local
- Each transaction against its own declared source, operator domain, value and dependencies.
- Matrix
- Row, column, block and region constraints across the layout.
- Global
- The ledger as one object, under the document's declared audit policy.
The scopes are reported separately because they fail for different reasons and are fixed by different people.
Signed cancellation
One audit_policy field deserves its own paragraph: signed_global_cancellation_allowed. Errors with opposite signs can sum to zero. A global check alone would call that ledger clean.
In the Erdős–Straus bench, 32 signed-residual cases summed to exactly zero at the global level, and every local error was still located. Precision and recall: 1.0 and 1.0.
That is the whole argument for keeping local audit mandatory even when the global figure balances.
Taint and root cause
When something fails, the runtime walks the dependency graph backwards and reports which transactions could have caused it — the tainted set, the roots, and the paths between them.
- A reverse query weightreverse causation
- A locally correct computationa trusted one — it can still consume an untrusted declared channel
Repair
Repair analysis proposes the minimum set of changes consistent with the constraints. It is a proposal, and it is handed to a person.
- A repair proposalautomatically the unique real-world root cause
- A minimum-support repairan identification of the historical error
Corrections are appended
The corrections section is append-only. A correction does not edit the transaction it corrects; it is a new entry that references it. The original stays in the ledger and stays auditable, which is the point of calling it a ledger.
Hashes
Every run emits canonical JSON, a semantic hash, an execution hash, an event log and a manifest. Reruns under the same runtime and operator lock in deterministic mode reproduce the hashes.
A runtime upgrade may intentionally change a hash when a defect in semantics, canonicalization or audit output is fixed. Check compatibility with manifests, runtime versions, operator locks and migration snapshots — not with a hash alone.
- A hash chainblockchain consensus, a trusted timestamp, or independent notarization
The hashes make a run comparable to itself. Nothing about them makes a run comparable to a claim about the outside world.
Exit codes
The CLI is meant to be wired into something. Failures are distinguished by kind.
| Code | Meaning |
|---|---|
0 | command completed |
2 | usage, validation, migration, or explicit configuration error |
3 | audit or comparison failure, when the command requests failure propagation |
4 | unexpected internal error |
Code 3 exists so that a failing audit is not confused with a broken invocation. --fail-on-audit is what turns an audit result into a process exit status.