An append-only ledger

No silent side effects

Every mutation writes exactly one ledger entry, in the same transaction or durable-workflow step as the state change itself. A mutation without a ledger row is a defect, not an omission — the two cannot come apart, because they commit together.

That is what makes the ledger usable as evidence rather than as logging. Logs describe what a process believed; this records what actually changed.

Enforced, not promised

Append-only is enforced at the storage layer — no UPDATE or DELETE grants — including against the operator. A correction is a new compensating entry that references the original. Nothing is rewritten, so nothing can be quietly rewritten.

What this is not. Append-only storage is a strong integrity property, not third-party attestation. Verify it yourself through the signed conformance evidence and the export below rather than taking the claim on trust.

Who, what, why, how much

Who

The agent credential and, where applicable, the human principal who decided.

What

The action plus provider references — the identifiers the upstream system gave the resource.

Why

The agent's justification. Required on mutating calls.

How much

One-time cost and monthly delta, kept separate.

Undo

The undo information for this entry.

Provenance

The workflow or task id that produced it.

The ledger is how you leave

Undo and teardown plans are computed from the ledger plus a desired-state store — never hardcoded. That is the property worth having: nothing can be created through SproutPad that SproutPad cannot then find and remove.

You can export your ledger. Exports are integrity-protected with a running hash chain, so an auditor can detect truncation or tampering without trusting the export endpoint itself.

Related: exit paths, idempotency and compensation.

Keep reading