---
title: "One call. One inspectable record."
description: "A Capsule connects the redacted intent, policy, result, trace and budget change of an actual run."
pubDate: "2026-10-23"
author: "OCLITH"
tags: ["receipts", "project-notes"]
---

## Record what actually happened

A useful trace belongs to a specific request. It should retain the policy version, permitted result, stage outcomes and time of that request. It should not be a fixed success animation that plays regardless of input.

The local Console uses actual processing events to build its trace. A rejected request stops at its failing stage. A successful request creates a Proof Capsule tied to the redacted intent, compiled policy, allowed result and budget change.

## Keep sensitive input out of the export

The Capsule stores an input digest and input length instead of the original submitted text. The exported policy is the public sample Manifest. Raw private sources and sensitive request input do not belong in a public registry or evidence document.

Output policy still matters. A digest does not make a sensitive output safe to disclose. An owner must define the return schema carefully and consider what repeated answers can reveal.

## Verify a narrow property

The verifier recalculates SHA-256 digests for the covered content using the documented canonical serialization. When the values agree, it reports Integrity matched. Changing a covered output or trace field without updating its corresponding digest produces a mismatch.

That establishes consistency with the included hashes. It does not establish private source authenticity, execution correctness, trusted hardware attestation or payment settlement. An internally consistent document still needs an independent trust anchor if its origin must be established.

## Replay keeps the identity

A replay displays the existing run. It keeps the same request ID, times, nonce, output and budget change. Copying, downloading, pausing and inspecting that run also leave its identity and budget effect intact.

Only a new call generates a new run. This distinction lets the animation explain recorded work without turning navigation or inspection into additional usage.

[Try a complete local run](/console?cell=private-code-risk) or [read the Capsule format](/docs/receipts).