ledger-bundles.snapshotModule 49Seal your workspace's audit chain into a signed bundle an auditor can check offline, against a key published for anyone to read.
ledger-bundles.snapshot signs a range of the audit log with a per-jurisdiction key and returns the bundle. The matching public key sits at a well-known JWK endpoint, and the same code verifies it on the public route and offline, so a check never depends on asking Intramedial.
Put admission in front of your MCP servers, repositories, SaaS tools and cloud accounts. Every agent gets a lease or a reason – and you keep the lever to stop any of them.
© 2026 Intramedial. All rights reserved. Intramedial is a product by Trustvice. Secured and supercharged by Avonao Labs.
Report abuseThe public /ots/verify route re-executes the proof's op tree from the anchored digest and compares the derived Merkle root with the named block's header. A tampered op tree naming a real block is rejected. It proves the digest existed by that block, not what the digest stands for. The block's Merkle root comes from one public Bitcoin API; the header's proof-of-work and a minimum confirmation depth are not checked, and notVerified says so.
Plane module
bundleIdjurisdictionrangeStartmerkleRoot/docs/ledger-bundles-snapshotAPI referenceRoutes, bodies and status codes./docs/ledger-bundles-snapshotOpen the consoleSee the module at work in the dashboard, on a seeded fleet or your own./dashboard-preview/ledger-bundlesStart freeCreate a workspace and admit your first intent./auth/signup
recordCountsigningKeyIded25519SignatureotsProofnull until the daily anchor cron confirms a Bitcoin block for this bundle's super-root.POST /api/v1/ledger-bundles/snapshot with an optional scope, rangeStart and rangeEnd; omitting the range captures the whole audit history to date, not an incremental one.
Audit-log rows in range are hashed into a Merkle root and signed with the Ed25519 key for the request's jurisdiction; with no key provisioned for that region, the request answers 503 rather than signing with the wrong key.
GET /.well-known/ledger-bundles-keys.json serves the JWK set with no authentication, so a bundle's signature can be checked without contacting Intramedial again.
A daily cron batches pending bundles' roots into one super-root, submits it once to OpenTimestamps, and later records the Bitcoin block once the proof confirms.
This module's calls change real state or reach outside services, so the shared demo does not run them. Sign in to run it in your own workspace. ledger-bundles.snapshot docs
This module's calls change real state or reach outside services, so the shared demo does not run them. Sign in to run it in your own workspace.
A request in the shape the API accepts, and an example response in the shape the module returns.
POST /api/v1/ledger-bundles/snapshot Authorization: Bearer av_workspace_•••• Content-Type: application/json { } → 200 { bundle }
{
"bundle": {
"bundleId": "lb_20261101_wnam_01",
"workspaceId": "ws_acme",
"jurisdiction": "wnam",
"scope": "default",
"rangeEnd": "2026-11-01T00:00:00.000Z",
"recordCount": 4820,
"merkleRoot": "8f1c2a9e...",
"signingKeyId": "lb-wnam-2026-10",
"ed25519Signature": "base64-signature",
"otsProof": null
}
}An auditor downloads a bundle and the published key, and verifies the signature and the record count themselves, with no call back to Intramedial.
A workspace snapshots its audit log at quarter end, naming the range explicitly rather than letting a default snapshot recapture everything from genesis again.
The signature is checkable the moment the bundle is issued; the Bitcoin anchor confirming its timestamp lands later, once the daily cron's proof clears.
A security reviewer reads the /ots/verify response's verified: "merkle_path_to_block_header" field and knows the op tree was re-executed from the digest and matched the block header's Merkle root. A bare calendar timestamp needs digestSha256 sent with it.
ledger.blame reads. Bundles seal the region's separate audit_log table, a different trail entirely.A module is a strong claim about a narrow thing. Rely on it for exactly what it is.
/verify route and the offline verifier package, so the two cannot silently drift apart.pending bundle's timestamp is anchored to Bitcoin yet; otsProof stays null and the response never fabricates a confirmation./ots/verify proves the digest existed by the attested block, nothing about what it stands for./ots/verify takes the block's Merkle root from one public API (Blockstream) without checking proof-of-work or confirmation depth.rangeStart, rangeEnd or . Its schema only exposes ; those fields reach the REST worker only from the dashboard's own client.This module's domain-separated binary tree over audit-log rows is a separate implementation from the coordination ledger's batching in ledger.blame; the two should never be described as the same mechanism.
Free workspaces cannot create a snapshot; Starter and above can buy one per snapshot, Pro adds a daily auto-anchor subscription, and Enterprise includes it. Verifying a bundle anyone holds is free on every tier.
This module's MCP actions live in their own contract file outside contracts/src/actions/coordination.ts, so none of them are listed as coordination.* actions here.
rangeStart, a snapshot captures the entire audit history from genesis, which can be large on an old workspace.Authenticate with a workspace API key as a Bearer token. The base URL is https://api.intramedial.com.
/api/v1/ledger-bundles/snapshotSeal and sign a range of the audit chain./api/v1/ledger-bundles/anchorsList the Bitcoin anchor proofs recorded for this workspace's bundles./api/v1/ledger-bundles/verify-chainCheck the audit chain's own hash-link integrity, free and unmetered.This module has no MCP action. Call it over REST from any agent or program.
ledger.blame10Ledger, replay and blameTrace every touch to one resource in order, and replay any event to rebuild the receipt that shows it actually happened.exit.objectives53Exit and exportRead the recovery time and recovery point this platform publishes for each kind of data, next to what has actually been measured against them.compliance.pack54Compliance evidence packsSee every control of the regulatory map, with exactly what this workspace can evidence today and what it cannot, kept listed either way.civics.records48Public records searchAsk the record what happened to one resource, or read the workspace's events plainly, redacted to what your permission actually allows.remediation.blast50Blast map and remediationSee what a declared checkpoint's data touched before you undo anything, then restore against it only once a person confirms it by typed phrase.portmind.memory51Agent memory snapshotsInspect what an agent remembers and take a signed, Merkle-rooted snapshot of its memory, with a versioned, workspace-scoped store.labelscoperehoming.plan52