The lifecycle
How an AI decision becomes evidence — five steps
From the moment your model returns a decision to the moment an auditor's verifier card lights up VERIFIED. Five steps, each cryptographically bound to the previous one, each verifiable independently by a third party.
Step 1 · Capture
The SDK drops into your AI workflow
The CarveTrace SDK is a thin call your AI workflow makes at the inference site — typically 5 to 15 lines of code in Java or Python, no model change. The SDK signs the inference event with your producer signing key, which lives on your infrastructure : HSM, KMS, Vault, your choice. Aryamind never sees the key.
The SDK records what the EU AI Act Article 12 requires : the input reference (a SHA-256 fingerprint, not the raw subject data), the model version hash, the AI's decision and confidence, an HLC timestamp, the operator session identity, plus the InferTrust-parity fingerprints (input blob hash, governing policy hash) when relevant. None of these fields require you to log raw PII at the protocol layer.
Step 2 · Bind
The human-oversight event binds to the inference at write-time
Whenever a human reviewer approves, overrides, escalates, or
otherwise intervenes on an AI decision, the SDK records the
HumanOversightEvent with the inference event's
cryptographic hash as a typed field — the
inference_event_hash. The binding is verified by hash
equality, not by a foreign-key join in some downstream database.
This is the single-signed-atom property : Article 12 record and Article 14 oversight as one cryptographically-bound pair. The auditor's verifier checks the binding by byte comparison ; no vendor-database is in the loop. Monitaur logs decisions ; TrueScreen certifies data. Neither binds inference ↔ oversight at write-time as a single atom. CarveTrace does.
Step 3 · Anchor
The chain is timestamped by an independent authority
Every event you sign rides on a per-producer append-only chain — each event references the prior event's hash, so altering an old record breaks every record that came after. At a customer-chosen cadence (typically hourly during pilots, configurable in production), the chain head is anchored by an eIDAS-qualified RFC 3161 Time-Stamping Authority of your choice. The TSA token is independent of CarveTrace and of you.
For high-stakes anchoring you can layer in OpenTimestamps + Bitcoin : the chain head is hashed into a public Bitcoin block. Independence from any single authority is the goal.
Step 4 · Bundle
Evidence rolls up into a self-contained bundle
Quarterly (or on demand), CarveTrace exports an evidence bundle — a single zip file containing every sampled event, the chain anchors, the human-readable report (PDF + Markdown), the schema definitions, the verifier sources, the verification recipe, and your producer's public key. The bundle is signed end-to-end ; the manifest carries SHA-256s of every file.
You hand the bundle to your auditor. The bundle is everything they need ; no API calls back to CarveTrace, no API key for a vendor console, no dependency on whether Aryamind is still in business.
Step 5 · Verify
Anyone with the bundle can verify, in their browser
Your auditor opens verify.carvetrace.com — or self-hosts the open-source verifier — and drops the bundle. The verifier runs entirely in their browser : no upload, no account. The verdict appears in seconds. If a single byte was changed anywhere in the bundle, the verdict is FAILED. If everything checks out, VERIFIED.
The verifier itself is auditable : it is Apache 2.0 (Rust + WASM) and the SHA-256 of every asset shipping at verify.carvetrace.com is published on /verifier-integrity with the recipe for the auditor to rebuild from source and confirm parity. Your auditor's auditor can verify too.
The shape of the proof your auditor reads
The rendered report inside the bundle is per-decision, not bulk- aggregated. Each decision gets a dossier : the AI verdict, the human reviewer's verbatim rationale, the cryptographic binding side-by-side, the timestamps from the independent TSA, the InferTrust-parity fingerprints, and a re-derivation recipe. Exception cases — overrides, escalations — get a visual badge so the auditor's eye lands on them first.
The /demo page walks one of these dossiers end-to-end against a real AI Act recruitment-scenario bundle. The same shape your auditor will see for your production workflow.