When you test in shadow, this is what you watch: each admission accepted or refused, an entry in the one tamper-evident chain — filtered to you, in sequence, verifiable. Nothing here bound anything. authority_effect = 0.
Enter the namespace you reserved above and open its ledger — every decision it has reached, newest last, each one a signed link in the chain. Don't have one yet? reserve a namespace →
entry_hash, chained to the signed head at /v1/audit/checkpoint. A decision and a lifecycle event (a capability redeemed, a boundary revoked) sit side by side and are labelled by kind — a redemption is never shown as a refusal. Re-verify the whole chain yourself at the public ledger. authority_effect = 0.
Author your own boundary, send actions against it in shadow, and every decision lands here — signed, in order, and yours to verify. The refusals cost nothing and tell you the most.
shadow mode · a REFUSE is never billed · one signed chain, filtered to you · authority_effect = 0