AHL Protocol

Anchored History Log (AHL) is an open specification (revision 0.4) for record-level, tamper-evident provenance in data and ML pipelines.

Abstract

A derived record — a resolved identity, a risk score, an enriched attribute, a batch release certificate — is produced from other records by a transform. AHL defines how to prove, later and independently, what a record was asserted to have been computed from, and what must happen when one of its sources is corrected or withdrawn.

Industry lineage tooling records this as mutable metadata: dataset- and column-level lineage, asserted by the pipeline about itself, changeable without a trace. AHL instead binds derivation to signed, digest-bound statements over individual records, anchored in an append-only, cryptographically verifiable log. The log is pluggable — any log meeting the binding contract in The Protocol §3 conforms; ATL  is one example alongside RFC 9162-class transparency logs, and the ahl-adaptor-atl-v1 profile binds AHL to it.

AHL standardizes three things:

1. AHL statements — signed, digest-bound records of derivation: this output record was produced from these input records, by this code and model version, with these parameters, at this time (bitemporal: valid time, issued time, and log-attested incorporation time, kept distinct). Seven statement types: ingestion, derivation, retraction, correction, propagation, manifest, key.
2. Log anchoring — normative requirements for committing statements to an append-only, cryptographically verifiable log (inclusion proofs and consistency proofs, RFC 9162 class), plus a witness protocol for detecting split views.
3. Revocation propagation — semantics for what a retraction or correction requires: at L3, computing the transitive closure of affected downstream records over the statement graph and proving the disposition of every member, anchored as a propagation statement, relative to a declared corpus checkpoint, never unconditionally; L2 carries no closure duty and states plainly that revocation was recorded, not propagated.

The stack

The specification is revision 0.4 of the Internet-Draft draft-zatona-ahl-00, and the reference implementation is published. Four crates, all on crates.io under Apache-2.0, with sources at github.com/evidentum-io: ahl-core 0.5.0 — the statement, closure and receipt library, shipping the deterministic conformance corpus; ahl-cli 0.4.1 — issuing and reading Evidence Receipts against a live log; ahl-mirror 0.3.2 — byte retrieval by entry id, authenticated enumeration and the checkpoint series a deployment owes; ahl-witness 0.4.1 — the independent cosigning witness. One adaptor profile is released as an immutable, content-addressed artifact: ahl-adaptor-atl-v1, binding AHL to the Anchored Transparency Log. See Reference Implementations.

Core Principles

Record-Level, Not Dataset-Level
Every derived record carries its own signed statement naming the exact input records, code, model, and parameters that produced it — not an assertion about the dataset it belongs to.

Pluggable Log
Statements anchor into any log satisfying the binding contract: append-only, inclusion and consistency proofs, authenticated enumeration at L3. AHL mandates no specific operator or product.

Bitemporal Statements, Index-Ordered
valid_time (asserted domain validity), issued_at (asserted creation), and log-attested incorporation time are three distinct fields, never conflated. Every “before”, “after”, “latest”, and checkpoint-membership rule uses the entry’s position in the log — never a timestamp.

Revocation Propagation With a Named Boundary
At L3, a retraction or correction obliges computation of the transitive closure over the statement graph, disposition of every affected record with evidence, and an anchored propagation statement — completeness defined and checkable at the trigger’s declared corpus checkpoint, not claimed to hold forever after. L2 carries no closure duty; its conformance claims state “revocation recorded, not propagated” verbatim.

Every Guarantee Names Its Boundary
AHL does not assert that any statement is true, that unstated derivations do not exist, or that the declared corpus is a producer’s whole world. Trust in the log operator is reduced to detectability of misbehavior, never claimed to be eliminated. An Evidence Receipt proves exactly its declared claim, nothing more.

Three Results, Never Two
A verification run that completes reaches exactly one of verified, invalid, or unverifiable (Protocol §7.7). A capability the verifier lacks is never reported as a defect in the artifact, and only verified may be rendered in words that assert the property.

Independent Verifiability at L3
Witnessed checkpoints and authenticated enumeration let a verifier reconstruct the corpus and recompute closure without the producer’s cooperation for entries, and with mechanically checkable completeness for committed tree material.

Architecture