Synthetic evidence, real cryptographic checks.
A precise explanation of the demonstration, its trust boundary and what would need to change for a real integration.
Technical explanation
This clean-room demonstration illustrates Capture → Seal → Investigate → Prove. It is a prospect-discovery and technical-inspection asset, not a production integration or an independently audited LoopGrid release.
01 / What is simulated
Four fictional workflows cover a voice refund, mortgage income-file update, insurance reserve adjustment and enterprise role grant. A deterministic script stands in for an agent; no LLM or voice provider is called. Identities, authority grants, policies and reviewers are fictional. A browser-memory adapter simulates downstream state changes or failures. No real customer system is contacted.
02 / What actually runs
Each new run creates a non-extractable Ed25519 browser private key. The recorder hashes protected event content with SHA-256, creates workspace/decision-scoped links, signs each event and signs a checkpoint binding the event count and final hash. The browser recomputes commitments and verifies the signatures and a separately supplied signer fingerprint. The published reference fixture was signed offline; its private key is not shipped.
03 / Portable, independently checked
Reference exports include the manifest, JSONL events, signed checkpoint, public key and complete JSON bundle. The independent Python verifier supports only the documented synthetic format, requires an external trust pin, uses the established cryptography package, and makes no network calls. The format is not asserted to be compatible with production SDKs or exports.
04 / What verification checks
Content integrity, sequence and chain continuity, event signatures, workspace/decision identity, signer identity and the signed checkpoint. Field changes, missing/truncated events and wrong keys are rejected. Re-signing under another key can be mathematically valid, but fails against the original trusted fingerprint. A bundle cannot establish its own signer trust.
05 / What it does not establish
A valid bundle establishes integrity and provenance of captured records under the expected key. It does not prove upstream truth, capture completeness, genuine human approval, business correctness or legal compliance. A signed mock response is not evidence that a real bank, insurer, payment processor or EHR acted. Browser timestamps are not trusted timestamps; demo keys and policy logic are not hardened production controls.
06 / Relationship to LoopGrid v0.8
Existing project materials describe a Design Partner baseline with REST/SDK integration, signed evidence, privacy modes and offline verification. This deliverable does not independently validate that backend, production signing boundary or export protocol. A real pilot should connect one authorized workflow through trusted server-side capture, record authoritative downstream responses, and validate the actual product export, privacy and key management before using live data.
Reproduce the independent check
python verify_synthetic.py evidence.zip --pin-file trusted-pin.txt
Use the independently obtained fingerprint; a pin supplied by an untrusted exporter is not an external trust anchor. The verifier exits 0 on success and 1 on failure. See PROTOCOL.md for the exact reference canonicalization and signature construction.