A Signature Is Not a Reconstruction

A signed verdict establishes that it was issued and unaltered. It does not let an independent party re-derive it. Replay integrity is the property that a verdict can be reconstructed after the fact, by someone who was not there.

A verdict is rendered once. It can be questioned for years.

The first two parts of this argument were about rendering it well. Whether an action can reach the world without a verdict, and whether the evidence the verdict rests on is admissible. Both are properties of the moment the decision is made. This part is about every moment after. Whether the decision, once made, survives being checked by someone who was not in the room, does not trust you, and cannot see inside your system.

That is a different property, and most systems that call themselves auditable do not have it.

The two sides already covered

Two earlier pieces I will not re-run.

"Watching Is Not Stopping" established the output side. Nothing acts without a verdict, and the boundary that enforces it cannot be bypassed.

"The Trust Boundary Has Two Sides" established the input side. No verdict rests on evidence whose origin cannot be established.

Both hold at decision time. They govern how the decision is made. They are silent about what happens when the decision is read back.

Issued is not reconstructed

Here is the move most audit stories miss.

A signed record establishes that a verdict was issued, and that it has not been altered since. That is worth something. It is also less than it looks. "I decided this, and I have not changed my answer" is a claim with a seal on it. It says who spoke and that the words are intact. It does not say the words follow from anything.

Reconstruction is a different thing. Hand an independent party the inputs the decision used, the policy and the exact version of it that applied, the authority that stood behind it, and the action that was proposed. They recompute the verdict, with no access to your system, and they reach the same answer. That is reconstruction. It does not ask you to be believed. It lets the verdict be re-derived by someone who has every reason to doubt it.

A signature attests who issued the verdict. It does not let anyone else arrive at it.

A signed log is a stack of sealed claims. A reconstructable record is a decision anyone can run again.

What reconstruction requires

For an outside party to recompute a verdict, four things have to be bound to it and fixed in time.

The inputs the decision actually used, recorded and bound at the moment of decision, not reassembled afterward from memory. The policy that governed, and the version of it in force then, because policy moves and last year's decision was not made under this year's rules. The authority chain that gave the verdict standing. And the proposed action the verdict was a ruling on.

Pin all four and the verdict is reproducible. Let any one of them drift and it is not. A replay against the current policy is not a replay. It is a fresh decision wearing an old date. What makes reconstruction possible is that the decision was bound to its exact circumstances when it happened, and that those circumstances were recorded rather than trusted to recollection.

The failure that waits

Each part of this argument fails in its own register.

An output failure is loud. An action reaches the world with no verdict, and the gap is visible the moment you look.

An input failure is quiet at the time. A clean verdict comes out, resting on evidence that should not have been admitted, and nothing on the surface shows it.

A replay failure is quiet until it is challenged. The records exist. They are signed. The system passes every inspection that consists of checking that records exist and are signed. Then someone asks the only question that matters in a dispute. Show me this verdict follows from what you had. And the answer comes back: trust the signature. The signature answers: did you say it. It cannot answer: does it hold up. That question arrives late, from an adversary, in the proceeding where the cost of having no answer is highest.

What replay does not promise

The honest limit, because the dishonest version is easy.

Reconstruction is not soundness. A verdict can reconstruct perfectly and still be wrong, if the inputs it faithfully used were fabricated to begin with. Reconstruction shows the verdict follows from the inputs that were bound to it. It does not show those inputs deserved to be there. That is the other question, the admissibility one, and "The Trust Boundary Has Two Sides" is where it lives.

So these do not collapse into each other. A verdict that cannot be reconstructed fails one way. A verdict that reconstructs flawlessly over manufactured evidence fails another. Neither property rescues the other. You need both, because they answer different questions, and passing one tells you nothing about whether you pass the other.

The verdict taken on faith

A decision made once, in a room you control, on evidence you supplied, signed by your own system, is not yet accountable. It is asserted. Accountability is the property that someone outside the room, later, without your help, can take the same facts and reach the same verdict.

That is the third question a boundary must answer for, after whether it can stop an action and what it admits as evidence. The three connect. Showing how is a later piece.

The verdict you cannot reconstruct is the verdict you are asking to be taken on faith. In a regime that does not run on faith, that is not far from having no verdict at all.