ai-native-proof-ledgerlisted

# ai-native-proof-ledger Build verifiable history, not blockchain branding. The app database stays the source of operational truth; the proof layer is an **append-only projection**; every anchoring/witnessing provider is **replaceable**. Core evidence: `references/landscape-2026.md` (dated 2026-09-08; re-run its §10 queries before production use). ## 0. Quick start ```text Design: "Make our projects/work-items/agent-action history tamper-evident and customer-verifiable." → run §1 gate, pick ladder level (§3), implement per §5, ship verifier. Implement: "We chose L2/L3 — build it." → implementation-patterns.md end to end. Audit: "Review our tamper-evidence claims / proof layer." → review-checklist.md; verdict per property. Verify: "Check this proof bundle." → patterns §8 verifier flow. ``` State before starting: who must be able to verify (internal audit, customer, external auditor, court), against what trust roots, retention horizon, and which claims will be made publicly (rubric in review-checklist.md §1). ## 1. Threat-model gate (run first; refuse to skip) Answer in writing, per feature: 1. **Adversary**: careless code? rogue insider/admin? compromised signer? operator itself lying (split-view)? external party forging history? 2. **Who verifies, without trusting the operator?** If the answer is "nobody can", you are building a logging format — say so and consider stopping (kill criteria below). 3. **Which properti