SKY-LED-003Replayable LedgersRev. 2026.10
Every run, replayable to the byte.
When an auditor, a regulator or your own on-call engineer asks what an agent did and why, the answer should be a file you can re-execute, not a story you reconstruct from scattered logs.
What a receipt holds.
Each transition of a Skyla machine produces one receipt. It contains the full prompt sent to the model, the model identifier and parameters, the raw completion, the parsed proposal, the gate verdict with every check result, the tool payload and response, and the resulting state diff.
It also records an environment digest: the container image, the policy version and the tool schema versions in force at that moment. Two runs with the same inputs and the same environment digest must end in the same state. That is the property everything else rests on.
Append-only, linked and signed.
Every receipt carries the digest of the receipt before it, then is signed by the verifier's key. Change one byte anywhere in history and every later digest stops matching. Deleting a record leaves a gap the chain makes obvious.
Once a day, the head digest is written to write-once storage in an account you control. Skyla, as a company, cannot rewrite your history even if we wanted to, and you can prove that to a third party without trusting us.
Re-run the past with nothing left to chance.
Replay feeds the recorded completions, tool responses and clock ticks back into the same machine. The runtime re-derives each transition and compares its result with the stored diff. Agreement is silent; divergence raises an alarm that names the receipt and the field.
Counterfactual replay is where this pays off day to day. Load last quarter's ledgers, apply a proposed policy, and see exactly which past actions it would have denied or escalated. Policy changes stop being guesses.
$ skyla replay ledger://ops-treasury/2026-09 --policy treasury-v15
receipts 41,208 machines 3 env digests 2
identical 41,208 transitions re-derived, 0 divergences
counterfactual under treasury-v15:
would deny 17 (vendor_matches_invoice)
would escalate 63 (bank_change_cooling)
report ./replay-2026-09-v15.htmlEvidence your auditor can sample on their own.
For SOC 2 examinations, ledgers give direct evidence for the logical access, system operations and change management criteria. Capability tokens show who could act. Gate verdicts show that controls ran. Policy versions in the environment digest tie each action to an approved change.
Auditors can be given a read-only replay seat. Rather than accepting screenshots, they pick their own sample and re-execute it.
Finance and clinical teams have stricter questions.
Broker-dealers need records that cannot be altered and can be produced on request. Clinical systems need audit controls over every access to patient information. The ledger is designed to support both, with retention set per workflow and anchors stored on media that satisfy write-once rules.
Sensitive fields are encrypted with keys you hold. To honour a deletion duty, you destroy the key for that subject. The data becomes unreadable while the chain of digests stays intact, so history remains provable without remaining readable.
Running ledgers without drowning in them.
Ledgers live in your object storage, in an open, documented format. Hot receipts stay queryable for 90 days by default; older ones move to cheaper tiers but remain replayable. A search index lets you find every run that touched a given account, patient or host in seconds.
If you ever leave Skyla, the ledgers and the replay specification stay with you. Your audit trail should not depend on a vendor relationship.