ledger.blameModule 10Trace every touch to one resource in order, and replay any event to rebuild the receipt that shows it actually happened.
ledger.blame walks this workspace's ledger for one resource and returns its touches most-recent-first, matched by exact resource or subject, never a loose text search. ledger.replay rebuilds an event's receipt and grades it honestly if the recomputed root disagrees with what was stored.
Put admission in front of your MCP servers, repositories, SaaS tools and cloud accounts. Every agent gets a lease or a reason – and you keep the lever to stop any of them.
© 2026 Intramedial. All rights reserved. Intramedial is a product by Trustvice. Secured and supercharged by Avonao Labs.
Report abuse
Plane module
resourceblame matches against.eventsblame, in reverse time order.lastTouchunknown rather than guessed./docs/ledger-blameAPI referenceRoutes, bodies and status codes./docs/ledger-blameOpen the consoleSee the module at work in the dashboard, on a seeded fleet or your own./dashboard-preview/opsStart freeCreate a workspace and admit your first intent./auth/signup
receiptreplay: the rebuilt ReceiptV0, with rootHex, the Merkle proof and any witnesses.standingwitnessed, issuer-signed, self-attested, unchecked or forged.rootHexThirty-two leaves fill a sealed batch, written to object storage with its own root; up to 256 leaves stay unsealed in the live store if object storage is not bound.
blame matches structurallyAn event counts as touching a resource only if its own resource or subject field equals the one given, not because the resource's name appears anywhere in the payload text.
The returned events are in reverse time order for that one resource, with lastTouch naming the latest and any fields it never recorded listed in unknown.
replay rebuilds, and checks itselfReplaying an event re-derives its Merkle proof. If the rebuilt root does not match the stored one, the receipt's witness claims are stripped rather than shipped as if verified.
Runs in a shared demo workspace with a demo key: anyone can see what it holds, so send nothing private. ledger.blame docs
Press Run to send the request on the left to the shared demo workspace.
Runs in a shared demo workspace with a demo key: anyone can see what it holds, so send nothing private.
A request in the shape the API accepts, and an example response in the shape the module returns.
POST /api/v1/acp/ledger/blame Authorization: Bearer av_workspace_•••• Content-Type: application/json { "resource": "repo:payments/main" } → 200 { projection, resource, events, lastTouch, unknown, why } (not a bare { events })
{
"projection": "blame",
"resource": "repo:payments/main",
"events": [
{
"id": "evt_90c1",
"kind": "coordination.admission",
"actor": "did:web:acme.example:agent:release",
"at": "2026-10-31T22:04:11.000Z"
}
],
"lastTouch": {
"actor": "did:web:acme.example:agent:release",
"at": "2026-10-31T22:04:11.000Z"
},
"unknown": [],
"why": "resource or subject equals the given resource"
}Before taking an action on a contested resource, an operator blames it to see every agent that changed it, in order, and who touched it last.
replay reconstructs the receipt for one event, so a dispute about whether something actually occurred can be settled from the ledger itself.
A rebuilt receipt whose root does not match the stored one comes back with its witness claims stripped, so a mismatch cannot be mistaken for a verified proof.
standing tells an auditor whether a receipt is independently witnessed or only self-attested by the plane, without them having to verify it by hand.
resource or subject fields only.blame and replay only ever read this workspace's own ledger.witnessed on its own; that grade needs an outside witness to actually confirm it.A module is a strong claim about a narrow thing. Rely on it for exactly what it is.
blame's matches are structural equality on resource or subject, not a substring search that could false-match an unrelated event.lastTouch can legitimately report missing actor, lease or ruling fields in unknown.issuer-signed has been independently witnessed. The plane does not mint witnessed receipts on its own say-so.replay checks anything beyond the one event it was given; it does not scan the resource's whole history.This ledger's batching and ledger-bundles.snapshot's audit-chain sealing use separate Merkle implementations over different data; do not describe them as the same mechanism.
If object storage is not bound, leaves simply stay unsealed in the Durable Object rather than blocking reads or writes.
Witness ids such as an OTS digest are recorded as strings the kernel does not itself verify over the network; without a production fetch configured, witnessing is a no-op.
blame and replay are both read actions and change nothing.standing grades only the receipt it is handed; it does not look the event up itself.Authenticate with a workspace API key as a Bearer token. The base URL is https://api.intramedial.com.
/api/v1/acp/ledger/blameList one resource's touches, most recent first./api/v1/acp/ledger/replayRebuild an event's receipt and grade its standing.coordination.ledger.blameBlame a resource as an MCP action.coordination.ledger.replayReplay an event as an MCP action.ledger-bundles.snapshot49Signed evidence bundlesSeal your workspace's audit chain into a signed bundle an auditor can check offline, against a key published for anyone to read.civics.records48Public records searchAsk the record what happened to one resource, or read the workspace's events plainly, redacted to what your permission actually allows.remediation.blast50Blast map and remediationSee what a declared checkpoint's data touched before you undo anything, then restore against it only once a person confirms it by typed phrase.portmind.memory51Agent memory snapshotsInspect what an agent remembers and take a signed, Merkle-rooted snapshot of its memory, with a versioned, workspace-scoped store.rehoming.plan52Region rehomingPlan where this workspace's coordination records should live, see exactly what would move, then carry it to another region on your own say.exit.objectives53Exit and exportRead the recovery time and recovery point this platform publishes for each kind of data, next to what has actually been measured against them.compliance.pack54