HashIQ Proof Chain

Proof substrate

HashIQ records what happened, why it was allowed, and how to verify it later.

A dashboard can be edited. A screenshot can lie. HashIQ creates a signed chain segment that an auditor can replay without trusting the marketing page.

Request integrity — canonical bytes.

The request and response are canonicalized and hashed so the receipt can prove what entered and what came back without exposing sensitive content by default.

Placement proof — why this worker won.

The entry binds to the policy hash, registry snapshot, eligible set, worker attributes, lease ID, and price basis used by the placement engine.

External anchor — history cannot quietly move.

Chain heads are published to witnesses so TaskQ cannot silently rewrite yesterday’s proof without detection.

Chain entry

Every closed request becomes a structured proof object.

The chain entry does not need to store raw prompts, secrets, PHI, or privileged matter names. It stores commitments, fingerprints, HMAC references, signatures, and replay material.

hashiq.entry.v3 — signed

{
  "chain_version": 3,
  "seq": 184467,
  "prev_hash": "sha256:...",
  "entry_hash": "sha256:...",
  "signature": "ed25519:...",
  "event_type": "request.closed",
  "canonical_request_hash": "sha256:...",
  "canonical_response_hash": "sha256:...",
  "policy_hash": "sha256:...",
  "placement_proof_hash": "sha256:...",
  "credential_fpr": "sha256:...",
  "worker_ref": "worker_blind:...",
  "settlement_ref": "journal:..."
}

External anchoring

A hash chain alone is not enough.

If only TaskQ has the chain head, TaskQ could rewrite history and present a new head. HashIQ publishes range roots to witnesses so silent rewrites become detectable.

Anchor	Purpose	Why it matters
customer witness	Customer-signed receipt	The buyer holds an independent proof point.
transparency endpoint	Published range heads	Auditors can verify that chain ranges did not move.
third-party timestamp	Time witness	Proves the range existed before a later dispute.
multi-witness	Regulated mode	More than one party can detect tampering.

Exportable moat

You can leave with your evidence. You cannot buy yesterday’s evidence tomorrow.

HashIQ is an honest moat. Customers can export their signed chain segment, but a competitor cannot retroactively witness execution history they were not present to sign.

Export includes — chain entries.

Request receipts, failure receipts, placement proofs, credential access events, registry snapshot proofs, anchor objects, and settlement references.

Verifier includes — replay tools.

A verifier bundle proves signatures, hashes, anchors, policy application, worker eligibility, and settlement parity.

Moat survives — non-backfillable.

A new provider can store exported history, but cannot continue the same witnessed chain before the migration date.

Sensitive data posture

Proof without leaking the thing being protected.

Never store: provider keys, OAuth tokens, raw PHI, privileged matter names, or recoverable identifiers.
Store instead: hashes, HMAC references, fingerprints, blinded worker references, signatures, and anchor proofs.
The chain stores the consistency proof. The customer keeps the identifying pepper.

safe references — customer pepper

bad  = sha256(patient_name_or_matter_id)
good = HMAC(customer_private_pepper,
              normalized_reference)

chain stores  → consistency proof
customer keeps → identifying pepper

The receipt is not a log. It is evidence.