The Trustworthy Record is an architecture for measuring something continuously and being able to prove, later, that the measurement was rigorous and unaltered. A probabilistic front turns messy input into quote-anchored signal. A deterministic shell replays state byte-identically from an immutable log, behind a mechanical wall that lets no raw number reach a human surface. And the whole record is anchored in a Merkle root and exportable as a self-sovereign credential that verifies offline, forever. Its reference implementation is Project H, a longitudinal behavioural inference engine with cryptographic audit properties.
The diagram above walks the architecture. Tap any stage to open it.
Ross Jones, Founder, The Hopium Lab. Last modified 4 August 2026.
What is The Trustworthy Record for?
Measuring something that matters, over a long time, in a way you can later prove was done honestly.
Most measurement systems ask you to trust them. The number on the dashboard is the number, and the workings are gone. That is fine for a step count and disqualifying for anything consequential, where the questions that arrive months later are "how was this derived," "has it been changed since," and "can I take it with me." The Trustworthy Record is built so those questions always have an answer.
Crucially, the engine is domain-agnostic: it does not know what it is measuring. The subject lives in a forkable pack, not the code, which is why the same machinery can back a forest school, an adult relearning a craft, a civic project, a team onboarding, or a recovery journal without a line of engine code changing.
Why measure hard but surface nothing?
Because the act of surfacing a number changes the thing you are measuring, and a system that can surface one will eventually be asked to.
The inversion at the centre of this architecture is that it measures rigorously underneath and shows almost none of it. Growth accumulates as internal weights, those weights drive a direction and a qualitative band, and then a mechanical wall strips every raw number from every response before it leaves the server. This is not a policy written in a document, it is enforced: a leaked number fails the build. The reason to make it structural rather than a rule is the same reason some guarantees have to be made impossible rather than forbidden. A rule survives until the next feature request. A wall the renderer has no affordance to bypass survives forever.
How does it avoid hallucinated measurement?
By decomposing the judgement and anchoring every piece of it to evidence.
No mega-prompt scores forty metrics, because that hallucinates and drifts. A cheap, recall-biased detector narrows each input to the few dimensions actually present. Then each dimension gets its own narrow judge that fires only on a direct quote, returns a confidence, and is dropped below a confidence floor rather than recorded weakly. An open vocabulary of emergent concepts is canonicalised by meaning, so it cannot sprawl into a thousand near-duplicates. It is the same evidence-first discipline that makes an LLM usable as a judge instead of a confident guesser.
Why is the whole thing replayable?
Because state is a computation over an append-only log, not a running total anyone can edit.
Growth is closed-form math applied to an immutable record: replay every entry in order and live state reproduces byte-identically. There is no update or delete on a signal, only inserts and a review marker. The relational graph of how dimensions connect is a projection, not a source of truth: drop it, rebuild it, get identical edges. This is event sourcing applied to an LLM system, and it is what makes the record reproducible: a correction triggers an instant, deterministic rebuild with no correction amnesia.
How is it proven unaltered?
With a Merkle root and a signature, not a promise.
Content hashes build into an RFC 6962 Merkle tree with domain-separated leaves, so the root is one 32-byte hash you can publish and an inclusion proof shows a single entry belongs without revealing it. Change a byte anywhere underneath and the proof breaks. This is tamper-evidence without a blockchain, and if you want the intuition for why a tree beats a chain here, the comparison is its own note. The issuer identity is a did:key, where the public key is the identifier, so a signed export verifies forever with no certificate authority, which is what it takes to actually prove a decision was not altered after the fact. Export, wipe and re-import reproduce the record and its root byte-identically, so the data is owned, not trapped.
What makes the engine domain-agnostic?
The engine knows no subject. The entire methodology lives in a versioned, forkable pack.
This is the part worth stealing even if you never build anything like the reference implementation. The measurement machinery does not know what a tenet is, or that it is measuring anything in particular. Change the pack and you change the philosophy, with no code change and no deploy. The one thing a pack can never do is break integrity: a conformant engine rejects any pack that tries to introduce a numeric or ranking surface. Fork the philosophy freely, you cannot fork away the guarantee. That is the difference between a principle and an architecture.
Where does The Trustworthy Record not apply?
It does not apply where you never need to prove anything later.
The cryptographic machinery is real overhead, and if nobody will ever audit, dispute, or carry the record elsewhere, it is overhead for nothing. It is also the wrong architecture where the thing being measured genuinely should be a visible number, a price, a leaderboard, a live score, because the whole design fights to keep numbers off the surface. And like everything with an evidence-anchored front, it needs evidence to anchor to: measuring something that leaves no quotable trace is not what this is for.
Use it where the measurement is consequential, long-lived, and might one day have to be defended or handed over. That is exactly the case where every other approach quietly asks you to trust it.
Ross Jones, Founder, The Hopium Lab. The Trustworthy Record is the generalised architecture of Project H, and shares its spine with The Grounded Report and The Compounding Stack.