A single AI decision is one receipt. Real work is many steps: a plan, a dozen tool calls, an approval, the execution, maybe a rollback. An evidence bundle wraps every receipt for that workflow into one artifact with a single top-level hash, so you can hand an auditor or a customer one thing that proves the whole sequence happened, in order, unaltered.
A per-decision receipt is tamper-evident on its own: you can prove that this one input produced this one output under this one policy. But almost nothing that matters is a single step. An agent run plans, calls tools, waits on an approval, executes, and sometimes rolls back. To prove "the whole thing happened as claimed" you have to prove a set of receipts: authentic, in order, and complete, with nothing quietly added or dropped.
Plan, tool calls, approvals, execution, rollback. Each one is already its own tamper-evident record in the hash chain.
The approval came before the execution. The rollback came after the failure. Order is part of the claim, not a detail.
A convenient step quietly removed, or an extra one slipped in, changes the story. Completeness has to be provable too.
An auditor does not want forty screenshots and a spreadsheet. They want a single artifact they can verify themselves.
AskLedger already keeps per-tenant hash chains and batches receipts into Merkle trees (RFC 9162-style). An evidence bundle uses those same primitives: it collects the receipts for one workflow, computes a Merkle root over them (one top-level hash), and ships the inclusion proof for each receipt. Anyone can recompute the root from the receipts and proofs and confirm it matches, using the open verifier, with no account.
A bundle answers three questions at once, and a verifier can check each without trusting us:
The signature and hash on every receipt still hold, so no individual step was altered after the fact.
The inclusion proof recomputes to the same Merkle root, so this receipt is part of this workflow.
The set of proofs reconciles to the root, so no step was slipped in or quietly removed from the sequence.
The path from raw steps to a checkable artifact is short, and every stage is deterministic. Nothing here depends on trusting AskLedger's word: the same math runs in the open verifier.
Each step of the workflow writes a signed receipt into the tenant hash chain.
The receipts for one workflow are collected as the leaves of a Merkle tree.
Hashing up the tree yields one top-level hash and an inclusion proof per receipt.
Root, receipts and proofs travel together as a single portable artifact.
The open verifier recomputes the root and confirms order and completeness, no account.
Bundles are for the times when a single receipt is not the unit anyone cares about: it is the whole run, the whole case, the whole incident. When someone asks "show me exactly what happened," you hand over one file instead of assembling a story.
A full multi-step run, from plan to tool calls to execution, bundled as one record you can replay against. Ties to agent accountability.
Every decision, approval and override on a case, sealed under one root, so the file itself proves it was not edited later.
What the system did during an outage or a bad actor event, captured in order, so the post-mortem rests on facts, not recollection.
A scoped bundle for a control test or a customer review: one hash to check, and every receipt behind it independently verifiable.
We want to be plain about this. The foundations are real and shipping today: per-tenant hash chains and Merkle-tree batching live in the open SDK, and the verifier already recomputes roots without an account. Evidence bundles assemble those primitives into one workflow-level artifact, and we are building that assembly (the grouping rules, the bundle format, the hand-off UX) alongside design partners so it fits how audits and reviews actually run. If that is your problem, we want you in the room while we shape it.