How a decision becomes evidence.

Requests that fail the input guards, cannot be decoded, or are rejected by the artifact checks (signature, time, key status) are counted but are not written to the audit chain or the transparency log. Rejections from the request-binding check onward are recorded. This is why the "blocked" variants above end differently.

A record proves that the gateway recorded a decision. It does not prove the decision was right, and the operator vouches for the evidence unless an independent witness or anchor is used.

The seven stages are a way of grouping the steps the gateway documents (input guards, artifact decoding, artifact validation, request binding, nonce registration, burst detection, policy, provider execution, audit write, transparency leaf). The gateway itself does not use the word "stage" for them.

Policies run in the order the tenant configured, and the first denial wins. A refusal is returned as a decision (HTTP 200 by default); the operator can switch to class-based HTTP statuses. An optional content check can sit between policy and provider; it is off in the sandbox and is not drawn here.

envelopeHash = SHA-256("QODIQA::ARTIFACT::V1" || canonical({expiry, payload, publicKeyId, timestamp})), and the signature is Ed25519 over that 32-byte digest.

requestHash = SHA-256("QODIQA::REQUEST::V1" || canonical({body, method, path})). In the first protocol version it binds method, path and body, not headers or the query string; a later version can bind more but is off by default for issuance. Each hash starts with its own label, so a hash made for one purpose cannot be mistaken for another.

entry.hash = SHA-256("QODIQA::AUDIT::V1" || sortedJSON(coreFields)); the first entry points at GENESIS. The Merkle log follows RFC 6962 with SHA-256, a 0x00 prefix for leaves and 0x01 for inner nodes. A receipt is {v, requestId, decision, issuedAt, entryHash, leafHash, keyId, signature}.

The audit hash is unkeyed, so on its own it detects accidental or partial edits. Rewriting the whole chain is caught by a signed checkpoint, a signed leaf or an independent anchor, not by the chain alone. The Merkle explorer uses illustrative entry hashes, not real gateway data.

Separate domains limit what one stolen key can do. They do not remove the operator from the trust path: unless an independent witness or an external anchor is used, the operator who runs the gateway vouches for all three. Verification is circular if the keys and the evidence come from the same instance.

The public verifier repository includes recorded sessions you can check without a gateway. Exit code 0 means valid, 1 means invalid.

node bin/verify.bundle.external.js \
  --keys examples/front-half/keys.json \
  --transparency-keys examples/front-half/transparency-keys.json \
  examples/front-half/bundle-with-proof.json
# exit 0 = VALID

Verifier README