What was true.
What you knew.
Most systems cannot answer that, because they overwrite. The chart is corrected, the policy is revised, the eligibility record is backfilled — and the state that actually governed the decision is gone.
That is the hard part, and it is the reason this is a platform rather than a feature.
When it was true in the world
The member’s coverage was effective from March 1. The stress echo was performed on June 18. The policy version took effect on April 2. These are facts about reality, and they do not move when your database learns about them.
When you found out
The eligibility feed delivered that coverage record on March 9. The echo result posted on June 21. The retroactive termination arrived in August, backdated to May. This is the axis that decides whether a reviewer could possibly have known.
Keep only the first axis and you can reconstruct history, but you will judge a past reviewer using facts that arrived after they signed. Keep only the second and you have an audit log, not a reconstruction. HealthNext keeps both, over the whole operations graph, so asOf(validAt, knownAt) returns the exact state a determination was made against — and every write is append-only with transaction-time correction and provenance, so a correction is recorded rather than substituted.
- The reviewer is judged on what they had
- Replay the case as it stood at signature time. A result that posted three days later remains distinct from the evidence available to the original reviewer.
- Retroactive eligibility becomes a managed correction
- A termination backdated ninety days does not silently rewrite ninety days of determinations. It lands as a correction with its own arrival time, and every affected case can be listed rather than discovered.
- Policy versions bind to the date of service
- The criteria that governed the decision are the criteria that were in force then, not the ones on the site today. The record preserves that exact version for reconstruction and review.
- Appeals become structured replays
- Reconstruct the original determination, show what changed and when, and keep the review centered on the clinical and policy evidence rather than competing records.
Don’t take the claim. Break the record.
Every governed decision produces one of these. Verify it, then tamper with a field and verify again — the check runs here, in your browser, offline.
- Decision
- MN criteria met · held for clinician sign-off
- Human gate
- held · no auto-approval
- PHI egress
- 0 bytes · model reasoned in-boundary
- Policy
- HNX-UM-MSK-014
- Boundary
- in-tenant
- Member
- DEMO-MBR-0000 (synthetic)
Press verify — the check runs in your browser.
press Verify — the check runs here, offline
Verify this receipt yourself →UNVERIFIED
What a sealed decision binds, and what would break it.
Permission is not a policy document. It is a chain where every link is pinned at the moment it mattered and has a failure mode you can state out loud.
3 of 4 links travel outside the tenant, and only as proof — never as the record itself
- 01
The input set
lives: recordbody.serviceWhat it locks inEvery document, code and value the decision read, digested at the moment it was read.
What breaks itAn input added, swapped or edited afterwards. The digest no longer matches what was read.
- 02
The policy version
lives: record + receiptbody.policyWhat it locks inThe criteria as they stood on the date of service — not as they stand today.
What breaks itCriteria edited after the fact while the record quietly follows the current version. Independent reconstruction can no longer establish which policy governed the decision.
- 03
The human signature
lives: record + receiptbody.reviewer_gate · body.decisionWhat it locks inThat the decision was held for a person, who signed it, in which role, and when.
What breaks itA consequential act completing without a signature. There is no code path that reaches a determination unsigned.
- 04
The seal
lives: receiptbody.issued_atWhat it locks inAn Ed25519 signature over the canonical bytes of the statement, with the public key travelling alongside it.
What breaks itAny byte of the signed statement drifting. The verifier does not report that something is wrong — it names the field.
The table above states each link’s failure mode. Cause one: break any link and every link downstream refuses, because each seals to the hash of the last. The exhibit restores itself. A real record would not.
- 01the input setverifiesprev —hash 0x3fa2c11d
- 02the policy versionverifiesprev 0x3fa2c11dhash 0x84e0b7a9
- 03the human actverifiesprev 0x84e0b7a9hash 0xc25d40f6
- 04the sealverifiesprev 0xc25d40f6hash 0x91c4a7d2
Reconstruction makes it true. The signature makes it provable.
Reconstruction is what makes a determination true. The Ed25519 seal is what makes it provable — it binds the reconstruction so nobody, including us, can revise it afterwards. Both halves are load-bearing, and the order matters: a signature over a mutable record proves only that you signed something.