AHL Protocol

Anchored History Log (AHL) is an open specification (v0.3-draft) for record-level, tamper-evident provenance in data and ML pipelines.

Abstract

A derived record — a resolved identity, a risk score, an enriched attribute, a batch release certificate — is produced from other records by a transform. AHL defines how to prove, later and independently, what a record was asserted to have been computed from, and what must happen when one of its sources is corrected or withdrawn.

Industry lineage tooling records this as mutable metadata: dataset- and column-level lineage, asserted by the pipeline about itself, changeable without a trace. AHL instead binds derivation to signed, digest-bound statements over individual records, anchored in an append-only, cryptographically verifiable log. The log is pluggable — any log meeting the binding contract in The Protocol §4 conforms; ATL  is one example alongside RFC 9162-class transparency logs.

AHL standardizes three things:

1. AHL statements — signed, digest-bound records of derivation: this output record was produced from these input records, by this code and model version, with these parameters, at this time (bitemporal: valid time, issued time, and log-attested incorporation time, kept distinct). Seven statement types: ingestion, derivation, retraction, correction, propagation, manifest, key.
2. Log anchoring — normative requirements for committing statements to an append-only, cryptographically verifiable log (inclusion proofs and consistency proofs, RFC 9162 class), plus a witness protocol for detecting split views.
3. Revocation propagation — semantics for what a retraction or correction requires: at L3, computing the transitive closure of affected downstream records over the statement graph and proving the disposition of every member, anchored as a propagation statement, relative to a declared corpus checkpoint, never unconditionally; L2 carries no closure duty and states plainly that revocation was recorded, not propagated.

Core Principles

Record-Level, Not Dataset-Level
Every derived record carries its own signed statement naming the exact input records, code, model, and parameters that produced it — not an assertion about the dataset it belongs to.

Pluggable Log
Statements anchor into any log satisfying the binding contract: append-only, inclusion and consistency proofs, authenticated enumeration at L3. AHL mandates no specific operator or product.

Bitemporal Statements, Index-Ordered
valid_time (asserted domain validity), issued_at (asserted creation), and log-attested incorporation time are three distinct fields, never conflated. Every “before”, “after”, “latest”, and checkpoint-membership rule uses the entry’s position in the log — never a timestamp.

Revocation Propagation With a Named Boundary
At L3, a retraction or correction obliges computation of the transitive closure over the statement graph, disposition of every affected record with evidence, and an anchored propagation statement — completeness defined and checkable at the trigger’s declared corpus checkpoint, not claimed to hold forever after. L2 carries no closure duty; its conformance claims state “revocation recorded, not propagated” verbatim.

Every Guarantee Names Its Boundary
AHL does not assert that any statement is true, that unstated derivations do not exist, or that the declared corpus is a producer’s whole world. Trust in the log operator is reduced to detectability of misbehavior, never claimed to be eliminated. An Evidence Receipt proves exactly its declared claim, nothing more.

Independent Verifiability at L3
Witnessed checkpoints and authenticated enumeration let a verifier reconstruct the corpus and recompute closure without the producer’s cooperation for entries, and with mechanically checkable completeness for committed tree material.

Architecture