The hash is the final commitment, not the audit trail itself.
An IPFS CID proves that a particular byte sequence has not changed. It does not prove that the evidence is complete, that the sources were authoritative, that the normalization was correct, that the inference was admissible, or that the proposed action follows from the evidence.
To bridge ChainTrace into executable governance, the export should bind four separate objects.
1. Source binding
The case envelope should identify:
- chain IDs and exact block boundaries;
- finality state;
- source providers and retrieval versions;
- original transaction, trace, log and bridge-message hashes;
- schema and normalization versions;
- missing coverage and provider disagreement;
- the complete input manifest.
This establishes what was actually observed.
2. Inference binding
Every proposed route, mixer exit, peel continuation or control relationship should exist as a typed claim object with:
- a stable claim ID;
- the observed facts supporting it;
- the inference steps connecting those facts;
- explicit alternatives that remain compatible;
- counter-evidence and contradictions;
- confidence loss across inferred transitions;
- reason codes;
- the analytical-policy version.
The narrative should then be generated deterministically from those typed claim objects. It should never become an independent free-form interpretation layer.
3. Decision binding
The evidence package must be bound to the exact action it is intended to support.
For an ordinary governance action, that may be:
- proposal ID;
- action-contract address;
- calldata hash;
- policy version;
- admissibility threshold.
For a Security Council emergency action, the correct binding may instead be:
- incident ID;
- emergency-action payload;
- authorization and quorum record;
- execution transaction;
- expiry or review deadline;
- rollback or recovery path.
Not every emergency action is naturally represented by a normal governance proposal, so the commitment must attach to the actual decision artifact rather than assume one universal path.
4. Review and supersession binding
Immutability must not prevent correction.
New evidence should create a new case version linked to the previous manifest hash. It should never overwrite the original package.
The review layer should preserve:
- who challenged which claim;
- what contrary evidence was introduced;
- which conclusion changed;
- which conclusion remained unchanged;
- whether the operational action was confirmed, amended, expired or reversed.
For sensitive incidents, a Merkle-rooted evidence envelope would also permit selective disclosure: the DAO or Security Council can publish the case commitment while revealing only the evidence objects required to review a particular claim.
The complete transition would therefore be:
raw source objects → normalized ledger facts → typed mechanism transitions → candidate claims → policy mapping → authorized action
Every arrow should be schema-bound, versioned and hash-addressed.
That is the point at which an IPFS commitment becomes useful: not as a substitute for the evidence architecture, but as the public root of a case whose facts, inferences, alternatives, policy mapping and decision authority remain separately inspectable.
The same construction applies to impact oracles. A metric output should not flow directly into allocation merely because its SQL or dashboard is public. The metric state, source state, inference state and governance action must remain distinct and cryptographically bound.
If ChainTrace maps its export layer this way, it stops being a visualization that governance is asked to trust. It becomes a versioned evidence system from which governance can act without surrendering review, appeal or reproducibility.
