Erilog records distributions offline, preserves every accepted event when devices reconnect, and exports a signed audit bundle that anyone can independently verify.
( from conflict to evidence )
4
distributed
96
remaining
1
exception
Built around evidence, not connectivity
Append-only events
Physical handouts cannot be silently deleted
Deterministic reconciliation
Same events, any order, same result
Offline-first recording
No network required for handout confirmation
Independently verifiable bundles
Static page, no backend, no trust required
( the real problem )
Two operators serve the same entitlement while disconnected. Neither device knows about the other. Both records describe a physical event that already happened.
Device Alpha
Distribution point east
No network. Cannot know what Bravo recorded.
Device Bravo
Distribution point west
No network. Cannot know what Alpha recorded.
Erilog preserves both events and raises an explicit exception. Neither event is deleted. Neither is marked as the duplicate.
( How evidence survives )
Field operators confirm physical handouts on their device with no network dependency. Each event gets a hash-chained sequence number and is stored in durable local storage.
When devices reconnect, every event is accepted exactly once. Duplicate entitlement use becomes an explicit exception — both records remain as peers. No winner is selected.
Export a signed audit bundle. Open the static verifier offline. Drag in the bundle. It either passes or names the exact check that failed.
( One continuous evidence journey )
Operators record what physically happened. Coordinators see the resulting stock position and every exception—without either view pretending to know more than the evidence supports.
Device Alpha
50 kits allocated
Entitlement
Quantity
● Recorded locally — pending sync
Coordinator evidence
after sync4
handed out
96
remaining
1
exception
HH-042 · 2 peer events
No winner selected. Both records remain inspectable.
( Proof, not promises )
The verifier is designed to recompute reconciliation from the exported events rather than trusting the summary it receives.
PASS all checks passed
file: events.json
observed e08f20b8c474…
FAIL integrity violation
Events are append-only
Accepted physical events cannot be deleted via any API or admin operation
Replays cannot create another handout
Same event ID accepted exactly once; retries return already_seen
Merge order cannot change the result
Property-tested: all permutations produce byte-equivalent output
The honest limit: Erilog cannot determine which physical operator was "right." It guarantees that conflicting records remain visible and inspectable instead of being silently discarded.
Open verifier( Built with Kiro )
Requirements were checked for contradictions before implementation. Invariants became tests before they became features.
Inspect the real spec( Questions )
The shortest honest answers to how Erilog records, reconciles, and verifies evidence.
Yes. Once a mission package is provisioned to a device, handout recording works entirely without network. Events are stored locally and synced when connectivity returns.
No. When two devices record against the same entitlement, both events are preserved as equal peers in a duplicate exception. Resolution is a separate decision that appends context — it never deletes evidence.
The bundle proves internal consistency: the signature matches the manifest, checksums match the files, and recomputing reconciliation from the events produces the declared summary. It does not prove who created the bundle — that requires trust in the signing key.
No. The hackathon release uses only opaque salted token hashes. No names, biometrics, phone numbers, or precise locations appear in events or exports.
Yes. The README provides a fresh-clone setup path. Docker Compose starts PostgreSQL, and all domain logic runs in Node.js with no paid dependencies.
( Try the evidence journey )
Run the seeded conflict, inspect the preserved peer events, and verify the resulting audit bundle independently.
