The same in Live, Training and Replay. One recording engine, no unlogged actions — which is why a proposal built from this record can be approved without taking anyone's word for it.
Per value
Every value carries its own history.
Writer
Who or what produced it: an operator in XR, an instrument, an external system, ARIA.
Time
When it arrived, in the order it arrived.
Rule
The contract rule evaluated against it. A refused write is recorded with the rule that refused it, not dropped.
Link
A write that answers an alarm carries the alarm it answers, so response and cause stay attached.
Per session
The bundle.
Journal
Append-only. Every value, action and intervention in the order it happened.
Manifest
A SHA-256 hash per file, signable for tamper-evident custody. Later modification is detectable.
Replay
Plays back inside the twin with the original sequence and timing — not a video of it.
Portable
A directory on disk. It reads without our servers and without a licence.
Agents
An agent in the loop is recorded like anyone else.
Internal
ARIA proposes actions through tool calls. An operator authorizes them before anything is written.
External
AI clients reach the twin over MCP. Each call is authenticated, validated against the contract, and journalled.
No exception
There is no path that writes without appearing in the session journal.