Integrity

Tamper-evident by construction.

Instead of trusting that logs were not changed, the structure of the record makes any change detectable, and the most likely attacks fail outright.

Pinned policy

The active policy is pinned by SHA-256. Every activation is itself recorded in a hash-chained activation log.

Chained ledger

Each decision references the hash of the previous entry. Changing, inserting or reordering an entry breaks the chain.

Signed anchors

The ledger head is signed with an ECDSA P-256 key kept outside the repository, and the anchor is committed to version control.

What gets caught

Attacks and answers.

If someone...	Result	Detected by
Edits the policy without review	all decisions denied	Policy pin
Edits one ledger entry	detected	Hash chain
Deletes the newest entries	detected	Signed anchor (truncation)
Rewrites the whole ledger with a valid new chain	detected	Signed anchor (rewrite)
Forges an anchor with another key	rejected	Public key and key ID
Replays a decision years later	identical result	Deterministic evaluator

# pin the reviewed policy and record the activation pwsh scripts/cg_pin_policy_v1.ps1 -Require POLICY_PINNED 781c28e4... (activation #1) # sign the current ledger head pwsh scripts/cg_ledger_anchor_v1.ps1 ANCHORED count=100 head=20dc786b... # verify everything, any time pwsh scripts/cg_ledger_anchor_v1.ps1 -Verify ANCHOR_VERIFY_OK anchors=1

Tested, not assumed

Stress-tested on every change.

1,000 randomized requests evaluated twice must give identical decisions and hashes.
Hostile inputs (path traversal, injection, lookalike hosts, oversized paths) must never crash the gate.
Hundreds of concurrent writers must leave one valid, complete chain.
Truncation and rewrites after load must be caught by the anchors.

Ready when you are

Read the research.

The paper describes the architecture, data model and sealing approach behind GI/PPI.

Paper and patent