Trust center
A packet your reviewer can check.
A buyer's security reviewer asks what the agents did, who approved it and what happened after. The trust packet will answer in one signed export per org and period, and each item in it can be checked on AI Source of Truth.
The trust packet
What it will hold.
| Section | From | What it holds | State |
|---|---|---|---|
| Approvals, signed | PromptCompute | Every action a person approved or denied, with the approver's name and the signature. | Planned |
| Incidents, causes, recoveries and lessons, signed | RepoOps | Each production incident, the change and agent session behind it, the recovery measured against its criteria, and the lesson that came of it. | Planned |
| Promises made and kept, signed | CommitOps | What the team promised each customer and whether it was kept. | Planned |
| A verify page for a whole packet | AI Source of Truth | One page where a buyer's reviewer checks every signature in the packet, without trusting us. | Planned |
The record today
What the packet is built from.
| Part | What it does | State |
|---|---|---|
| PromptCompute | For a team that connects, the exact action goes to a person before it runs: rollbacks, fixes and memory writes; outbound sends; customer notices from CommitOps. Each approval is signed. | Built, switching on |
| Tasks and claims | Every goal gets a task id and an append-only list of events. Every claim has one of seven statuses; a correction is a new statement, never an edit. | Built in RepoOps |
| AI Source of Truth | Provenance, accuracy figures and corrections published where anyone can check them later. | Built, off by default |
| The family statement | One signed shape for a claim that leaves one product for another: who issued it, what it came from and which org it belongs to. A changed copy or another org's statement is refused. Each product signs once its key is set. | Built in all six, switching on |
Compliance
Mapped to the rules you answer to.
| Rule | What the record would show | State |
|---|---|---|
| SOC 2 change management | The change management criteria (CC8.1): who approved each change, what it changed, and whether it worked. | Planned |
| EU AI Act Articles 12, 19 and 50 | Article 12 (record keeping), Article 19 (keeping the logs a system makes) and Article 50 (telling people when content is made by AI). | Planned |
| A SOC 2 report from an auditor | We do not have a SOC 2 report yet. The mapping shows where the evidence would come from; it is not a certification. | Not started |
Each state reads /family.json, where every built line is checked against the code it cites.