How signed decision records can remain inspectable over time: local verification, optional post-quantum signing, and explicit requirements for key custody and retained trust anchors. Hardware-conditioned provenance is separate research.
A governed-inference packet shows what an AI was allowed into context, what action was allowed forward, what stayed out, and why. For decisions challenged later, including a disputed agent action, an audited model output, or an AI decision under regulatory review, that packet has to stay credible long after the model, the vendor, or the cryptography protecting it has moved on. The same need applies to other long-retention regulated records, compliance packets and public-sector artifacts, where configured. Governed AI is the case this tier is built for.
A retained signature depends on the strength of its algorithm and the trust placed in its signer. Both can change during a long retention period. Reviewers also need the verification software and trust material when the issuing service is unavailable.
Optional post-quantum signatures address future forgery risks. Local verification lets a reviewer check retained evidence without contacting FieldHash. Signatures establish integrity and signer identity; they do not encrypt the underlying records or protect their confidentiality.
Current Ledger uses Ed25519 signing by default and supports an optional ML-DSA-65 profile. Hardware-conditioned provenance is published research, separate from the current Ledger package and pilot deployment.
Ledger seals bind a packet digest to a signer, and durable entries form a verifiable chain. Ed25519 is the default. The optional ML-DSA-65 signing profile requires its additional dependency and fails closed if unavailable. Reviewers can pin the expected algorithm and signer fingerprint, then verify retained seals and chains locally. Quantum hardware is not required.
Long-term verification also requires retained public keys, expected signer and algorithm commitments, and verification software. A customer-held anchor gives a reviewer an independently retained reference for the expected chain head.
These are the properties a security review can test directly, independent of any quantum claim.
Retained seals and chains can be checked locally with the public keys, expected trust commitments, and verification software. FieldHash services do not need to be reachable.
Verification can require an expected signature algorithm and signer fingerprint. A mathematically valid signature from an unexpected signer does not satisfy that check.
The current package loads local signing keys. Requirements for customer-managed Vault, KMS, or HSM custody need a separately qualified integration; they are not a default package guarantee.
A seal binds the packet digest without copying the raw records into the seal. The underlying workflow packet can contain content; its retention and redaction must be agreed for the deployment.
Retain the verifier and trust material with the evidence. When an algorithm changes, a verified renewal can bind the historical chain to a replacement suite; it cannot repair evidence compromised earlier.
The first workflows are ones where an AI decision, or the record behind it, must stay credible across time, jurisdictional boundaries, and disconnected verification.
Bind model outputs and agent actions to evidence of what governed them, so a decision questioned later can be reconstructed rather than re-argued.
Maintain offline-verifiable integrity for audit packets, regulated artifacts, and long-retention submissions.
Preserve tamper evidence for institutional records that must outlive the application stack, the vendor, and the cryptography protecting them today.
Keep public records verifiable by any party, on a disconnected machine, years after the record was created.
For European regulated teams, this layer earns its place as evidence, not as a compliance claim. Read against the obligations those teams are preparing for, the mapping is concrete:
FieldHash supplies evidence, not a compliance verdict. The mapping shows where the evidence meets the obligation; your counsel decides whether the obligation is met.
How that evidence is deployed in Europe, from regional hosting to transfer terms and customer-owned audit logs, is the deployment review's job, not this brief's. The operating boundary lives on the security and deployment page.
Published experiments examine whether measured hardware behavior can add a device-conditioned signal to artifact verification. This research is not included in the current Ledger package or pilot. Independent validation and a separately qualified integration are required before a customer deployment.
Hardware-conditioned provenanceThe governed-context studies examine authority decisions in synthetic workflows. Their methods and limitations are published separately; they do not validate long-term cryptographic security or hardware-conditioned provenance.