Skip to main content
T·M TOMFORMER live research instrument Patent pending

Audit trail / public receipts

Inspect the receipts without seeing the private machinery.

Receipts are opaque, stable handles for visitor verification. They let you compare what supported an answer, which arm produced it, which hop contributed evidence, and whether a correction moved only the expected audit records. They are not source addresses, prompt traces, graph traversal logs, token paths, weights, or scorer internals.

  1. Task 1 / Inspect support visitor-verifiable

    What supported this answer?

    Where was Shafrira Goldwasser’s doctoral advisor born?

    Answer: Caracas rcp_7e3ff791f1bfdfe9467c
    advisor read
    Shafrira Goldwasser → doctoral advisor → Manuel Blum rcp_5a53189c3b20ed074d91
    birthplace read
    Manuel Blum → place of birth → Caracas rcp_eca6cd9a9bea2918711b
  2. Task 2 / Compare arms

    Same question, different audit surfaces.

    The arms can be compared by public decision receipt and evidence state without exposing hidden model or retrieval internals.

    TOMX

    structured source read
    rcp_83c6fbd7658956467f7d

    TX

    answer receipt only
    rcp_01d2c1f6f0d11a0fc42e

    RAG

    retrieved context receipt
    rcp_c391793e2e2cef6d7b31
  3. Task 3 / Follow multi-hop evidence

    Each hop gets its own public handle.

    Multi-hop demos should show the bridge entities and the receipt for each constituent read, not just a final answer.

    1. 1 Shafrira Goldwasser → doctoral advisor → Manuel Blum
      rcp_5a53189c3b20ed074d91
    2. 2 Manuel Blum → place of birth → Caracas
      rcp_eca6cd9a9bea2918711b
    3. 3 Marvin Minsky → place of birth → New York City
      rcp_4aebb4a720770ae87770
    Open the live relation-hop proof →
  4. Task 4 / Check change scope

    Edits and source changes alter only expected receipts.

    A scoped correction should change the edited-source write receipt and dependent decision receipt; unrelated answers and fixed probes should remain stable.

    Before correction

    baseline
    answer
    Caracas
    decision receipt
    rcp_7e3ff791f1bfdfe9467c
    source/write receipt
    rcp_17ee24f8064ad819d2eb

    After scoped correction

    changed
    answer
    Reykjavik
    decision receipt
    rcp_ac971a81ae7024173f15
    source/write receipt
    rcp_e18e0e4078b9d54ce2e6

    Unrelated answer

    unchanged
    answer
    unchanged
    decision receipt
    rcp_68f1a040f0dfd5ba6257
    source/write receipt
    rcp_011e502fb2c629611193

    Fixed retention probe

    unchanged
    answer
    unchanged
    decision receipt
    rcp_3aa353db6c3e48d5a3b0
    source/write receipt
    rcp_e5464fd4d379b98f3184

What a public receipt does and does not prove

Useful for

Equality checks, before/after comparisons, arm comparisons, hop-by-hop evidence, and session-scoped edit audits.

Not a leak

It does not disclose graph addresses, exact storage rows, prompts, token spans, retrieval ranking code, traversal strategy, weights, or private mechanism details.

Where to verify

Reason exposes hop receipts, Verify exposes decision posture, and Correct exposes edit/revert receipt changes.

AUDIT · RECEIPTS

Shows: stable opaque public receipts for support inspection, arm comparison, multi-hop evidence, and scoped edit/source-change audits. Does not show: private graph addresses, prompts, token paths, traversal details, model internals, or proof of general answer quality.