The moat isn't an app — it's a verifiable cognitive audit ledger: crypto-signed, causally ordered, replayable, cross-vendor, in one inspectable artifact. korgex v0.4.0 just proved it's buildable. The question now: how do we carry that guarantee out of one app and into the substrate everything else depends on?
-The moat is real in exactly one place — korgex's Python hash-chain — and aspirational everywhere else. The Rust core that korgchat and the bridge actually write through still has no per-event chain. The guarantee is trapped inside an app instead of living in the substrate.
-korgex writes a tamper-evident, hash-chained journal. The Rust core it's supposed to define writes plain JSON. Until the chain lives below, the headline claim — "cryptographically-signed ledger" — is true only for the .ktrans envelope, not the events themselves.
chain_hash / verify_chain + HMAC tamper-proof variant. korgex verify localizes any edit to a seq_id. Verified across 5 models / 3 vendors.
EventMetadata has no prev_hash/entry_hash; spec §1.2 is PROPOSED, not frozen. Real HLC ordering & Ed25519 — but only the campaign envelope is signed, not the events. This is the weakest link in the moat.
Six components, scored on maturity and — what actually matters — their role in the verifiable-cognition moat. Green = the guarantee is real here. Amber = it's claimed but not yet true at this layer. Red = absent.
-ledger_write in introspect (cli/introspect.rs:378) — but zero callables use it.The mistake would be "polish thumper's TUI" or "give korgchat a web/Tauri UI." Both are already real and good — and both are app polish that doesn't compound the moat. The leverage sits below both: freeze the chain into a spec, then push it into the Rust core. Do that and thumper-with-audit-trail and chained-korgchat both become easy. Skip it and you're decorating apps over a fractured substrate.
-but as a ledger producer: wire its self-healing loop to emit chained events. Second independent codebase proving the spec — and an audit trail for the highest-stakes autonomous action.
already beta with real writes; its events are unchained today. Prettifying the client ships a nicer window onto an unverified record. Do it after the Rust journal carries the chain.
extract the hash-chain into a frozen spec + conformance vectors, port it into the Rust core. Everything else is downstream of this.
Every move scored on one question: does it carry the verifiable-ledger guarantee outward into the shared substrate — or is it catch-up any competitor also ships? Ordered into waves; later waves depend on the keystone.
- -chain_hash / verify_chain / verify_dag into a tiny dependency-free spec module: frozen canonicalization (JCS), the prev_hash/entry_hash preimage, the HMAC tamper-proof variant, and a language-agnostic conformance vector file (golden JSONL + expected verify output). Promote spec §1.2 from PROPOSED to FROZEN. korgex then imports it instead of owning it.EventMetadata (log.rs:275) and implement chain-on-append + verify-on-load using the same canonicalization as the reference. Make CapabilityJournal::load() reject a tampered/reordered journal. Run the Wave-1 conformance vectors in CI.record_* path and korgex's durability ladder through it. The bridge becomes the one in-process WAL that carries the chain natively — Python callers get the guarantee for free.memory.py + memory_drift.py are built and korgex drift exists, but run_task() never recalls. Load anchored memories at task entry, check_drift() vs baselines, inject fresh facts as @memory, and route drifted items through a reconcile decision recorded as a chained event.self_healing.py exists but needs explicit invocation. On run_test_gate() red, auto-spawn a healing subagent with the failure log, bounded retry until red→green — each attempt and the final result a chained event.Everything in the thesis is downstream of this. The moat is "verifiable cognition as a shared open substrate" — but the verifiable part lives in one Python app, while the substrate it's meant to define has no per-event integrity at all. Freezing the definition + golden vectors turns a feature into a standard; porting it to Rust makes the headline claim finally true at the layer everything depends on. It unlocks chained korgchat (#3), thumper audit (#4), cross-vendor adapters (#7), and the launch explorer (#6) — all of which need a frozen format to emit to. M+L effort, not XL: the working logic already exists in korgex. This is extraction and porting against a test oracle, not invention.
-