Proof of outflow
The attestation log
Every verdict an operator gives, allowed or refused, becomes a leaf in one append-only Merkle log per deployment (RFC 6962 style hashing). A vault owner can download a proof bundle for any attestation: the policy, the decoded transaction, the context, the verdict, the signed record and an inclusion proof. Anyone can recompute it.
Completeness. For EVM vaults, the vault page compares every on-chain execution with the log and raises a red alert for any outflow without an attestation.
Tamper evidence. Log rows are hash-chained and cannot be changed or deleted in the database. Two operators sign a checkpoint of the root every hour, and each checkpoint is timestamped in Bitcoin through public OpenTimestamps calendars.
Limits. On testnet all three operators run on one server with one database, so the operator signatures are not independent yet. The OpenTimestamps anchor is what makes a later rewrite visible.