Every claim here carries its status, and every number its provenance.

No audit entry from any workspace reaches a public page. The only audit data on a public surface is each workspace's Ed25519 public key, served for key discovery. The chain is keyed per workspace, isolation is enforced by per-transaction row-level security and workspace-scoped Cedar, and operator access is itself gated and audited. So a workspace verifies its own chain against its own published key without trusting Rensei. The platform runs one tenant today, Rensei's own, and the numbers above are measured on it. The same per-workspace keying is what is designed to let the verification model carry into the VPC and on-prem tiers on the roadmap.

The derivation is the public answer to how this is different. LLMs run as bounded operators inside workflow steps; the control loop is deterministic code. When the control loop is instead a model that can rewrite the steps it is about to run, the record of what ran is a claim, not a proof: tamper-evident audit requires a loop that cannot edit its own history. A deterministic graph forecloses that failure structurally. The structure that executed is the structure that was reviewed, and the chain that recorded it sits outside the reach of the thing it records.

The same property holds for workflow runs: graph, state transitions, and policy evaluations are deterministic and replayable. The strand generator is MIT licensed and will publish with the verifier in the donmai.dev docs appendix.