Reference · Record v0.1 (draft)

JExec Record

A decision that leaves no record cannot be inspected, compared, or later distinguished from no decision at all. The Record is the memory of the boundary.

Every JExec decision — ALLOW included — produces one Record: a small, structured document declaring what was intended, by whom, under what authority, at what scope, on what evidence, at what risk, and what was decided. Records are written before the mutation and stored append-only, so the decision exists independently of whether the execution later succeeds, fails, or is disputed.

Example

{
  "jexec_version": "0.1",
  "intent": "deploy payment-service build 4127 to production",
  "actor": { "type": "ci_job", "id": "github-actions/deploy.yml@refs/tags/v2.4.1" },
  "authority": {
    "source": "manual_approval",
    "reference": "CHG-2214",
    "verified": true,
    "verifier": "release-manager",
    "covers_scope": true
  },
  "scope": {
    "environment": "production",
    "system": "payment-service",
    "bounded": true
  },
  "risk": {
    "class": "state_mutation",
    "irreversible": false,
    "reversal_path": "rolling deploy, previous artifact retained"
  },
  "evidence": [
    { "type": "tests_passed", "reference": "run-88213", "bound_to": "sha256:9f2c…" },
    { "type": "artifact_signed", "reference": "sigstore-entry-114…" }
  ],
  "findings": [],
  "missing_evidence": [],
  "decision": "allow",
  "timestamp": "2026-07-12T10:41:00Z"
}

Fields

Field	Required	Content	Failure class if defective
`jexec_version`	yes	Version of the protocol the verdict was computed under.	—
`intent`	yes	The specific intended change: operation, object, target. One disputable sentence.	EAF-1
`actor`	yes	Type (`human`, `ai_agent`, `ci_job`, `service`, `script`) and an authenticated identity.	EAF-2
`authority`	yes	Source, reference, verification status, verifier, and whether coverage contains the declared scope.	EAF-3, EAF-4
`scope`	yes	Environment, system, object set or expected count; whether the blast radius is bounded.	EAF-5
`evidence`	yes	Items with type, reference, and what content (hash, version, diff range) they are bound to.	EAF-6, EAF-7
`risk`	yes	Class, irreversibility flag, and the declared reversal or review path.	EAF-8, EAF-9
`findings`	yes	The EAF classes detected, each with its consequence. Empty array means clean.	—
`missing_evidence`	yes	What the decision lacked: the EAF-6 findings as a list. Empty array means nothing was missing.	—
`decision`	yes	`allow` · `warn` · `escalate` · `deny`, computed by the protocol rules.	EAF-10 if not stored
`timestamp`	yes	When the decision was made — which is before the mutation, by definition.	EAF-10 if not stored

Storage rules

Before, not after. The record is written when the decision is made, not reconstructed from logs.
Append-only. Records are never edited; a changed execution is a new decision and a new record.
Independent. Stored outside the write path of the system being mutated, so the record survives the mutation it describes.
Denials are kept. A retained DENY is the cheapest audit finding an organization will ever produce.

Alignment

The Record is designed to sit alongside existing attestation and event formats — in-toto-style attestations for provenance, CloudEvents-style envelopes for transport — rather than replace them. This is a design direction, not a claim of formal compatibility; see the claims policy.

Schema

A JSON Schema for the Record is published at /api/record.schema.json. JExec Check emits records conforming to it.

The record format is versioned under the governance policy; jexec_version keeps old records interpretable forever.