The public ledger

Receipts record what an object was. The ledger records what happened to it: every write, delete and read, and refusals of your requests, in order, checkable against Sui. A request that can’t be tied to an account isn’t recorded on anyone’s ledger.

Example: an auditor asks when a licensed dataset arrived, who read it, and whether anyone read it after the license was revoked. You hand over the entries and their proofs. The auditor checks them against Sui without asking you or us.

What gets recorded

Your data	writes, reads, deletes, and every change to where an object’s copies are
Refusals	your requests that were turned away, counted by kind with the first one asked, including your grantees’ attempts after their access ended
Control	revocations, revoked grants, ended agent spaces, warranties and their changes, ended signing keys
Our software	the releases your deployment runs, in order, from when each starts serving

A request that can’t be tied to an account isn’t recorded on anyone’s ledger.

Each entry is the deployment’s own record of what it saw witnessed. A release entry is our statement of what we run, not proof of what code is running our statement.

Entries reveal nothing about each other, or about other tenants.

What goes public

Only a fingerprint. Entries stay with your deployment, and each tenant reads only its own; release entries are open to anyone. What goes on Sui is a fingerprint, never content. That record only grows: Sui accepts a new record only if it extends the last one, so nothing already recorded can be changed, dropped or reordered, and the records leave no gap in time. verifiable

Check it without us

Ask for an object’s entries with your usual credential. Each comes with a proof that ties it to the record on Sui. pf-verify, provided at onboarding, checks the proof, and checks that today’s record extends the one you checked before. Sui holds the newest record; an older one is checked by following the records from it to the newest, which your deployment serves and you can keep. If no record reaches Sui after an entry’s time once one was due, pf-verify reports it as withheld. verifiable

The ledger proves that an entry you hold was recorded. It doesn’t prove you were shown every entry about a file.

Formats and test vectors come with onboarding.

Keep your receipts

Entries that settle a question stay for good: revocations, warranties and the writes they name, and each file’s latest write and placement. Routine entries, such as reads and refusals, are kept for 35 days, then pruned. A saved proof still checks against Sui after its entry is pruned, so save entries and proofs on receipt, and keep the records (/v1/ledger/roots) if you want to check without the deployment.