Governed by construction, not by policy

1 · Every change is an event

Nothing is edited in place. A command produces an event carrying the actor, the time, the hash before, the hash after, and a chain hash over its predecessor. A correction is a new event; the original stays visible. Insert, delete or alter anything and every chain hash after it changes.

2 · The catalogue is closed

806 event types, and no others. An event type with nothing able to emit it reads as capability while being unreachable — the project control standard once reported a missing daily site diary on every project because no command could write one. That is an invariant now: every event is either emitted, or named with the reason it is not.

3 · Authorisation is layered and fails closed

Role permissions, then OAuth2 scopes, then attribute rules on the record itself — lifecycle phase, data sensitivity, tenancy. A phase gate is evaluated from the ledger rather than asserted, so a command locked in Operations says which phase it needs. The browser holds no rule the API does not publish: the permission matrix and the phase gates are fetched, never duplicated.

4 · Replay proves it

Rebuild every entity from the log, verify each event independently, and emit a state root. Where your access policy withholds a record, the redaction is reported and the root still covers the complete record — so you can verify the chain is intact without being shown what you may not see.

5 · What leaves the platform is redacted by audience

An export is the one artefact that escapes every access control in the system, so redaction is the last enforcement point there is. A regulator's copy carries no forecast margin, and it says the commercial detail was withheld rather than showing an empty section — a silent redaction is indistinguishable from a project with no commercial data.

6 · What arrives as a file becomes a record, or says why it cannot

A file is looked at before anything reads it: its real type from its bytes, an executable or an archive carrying one refused, a decompression bomb refused on what it declares. A PDF's own text is read page by page through its fonts, and the tables in a bill or a specification are recovered as rows from where the text sits on the page — left-, right- and centre-aligned columns alike, a wrapped description joined, a blank cell kept blank. A bill's rows go onto a measurement schedule as items sourced to the document and page; a specification's clauses go into the register straight from the file. An IFC model is read for its structure and a geometry fingerprint per element, in a plain file or an .ifczip. A scan or a photograph has no text to read, and the platform says so and routes it to a model that can see, whose transcription a person confirms before it is indexed. Prose set in two columns is not called a table, and a table with the wrong columns is refused rather than guessed at.

7 · The record is durable, and off the box

Every event is flushed to an append-only journal on the volume before it is acknowledged. Where a Postgres is configured the same events are shipped to it in commit order, one transaction each, through the database's own chain trigger — so the record there cannot silently fork — and a new host comes up from the database rather than from a backup of a file. A second process can follow that database as a warm standby: it holds the whole record, answers every read, refuses every write by name, and is promoted by a restart. The lag between the ledger and the database is on the operator's screen, never hidden.

Three things sit behind that, each answering a different way of losing a record. A snapshot is written beside the journal, so a boot restores the state and replays only the tail rather than the whole history — the difference between a restart that takes seconds and one that takes longer every month the platform runs. Where an object store is configured, the journal and the media are copied off the machine on a timer, each set carrying a manifest naming every file's size and hash, so a restore can be checked rather than hoped over. And the restore drill is a script rather than a paragraph, because a backup nobody has restored from is a belief.

8 · Somebody finds out before you do

The process sends a heartbeat outward to a monitor on a timer, and it is a dead man's switch rather than a ping: it is withheld when the record cannot be extended, so a platform that is running but cannot write is reported as down — which is the honest answer, and the one an ordinary uptime check gets wrong. The readiness probe answers with its reasons rather than a bare failure. Alerts reach a named person on a rota with a defined handover rather than a shared inbox, because an alert that reaches everybody reaches nobody.

None of that is an availability commitment, and Platform status still publishes no uptime percentage. A figure nobody measures is a decoration, and this is the page that would have to be true.