LoomSpan

LoomSpan is a draft profile of the LoomSeal format. The normative text lives in the spec; this page is the why.

The other half of proof

Signed logs, transparency logs, and attestation formats, LoomSeal included, prove records were not edited. None of them prove records were written. A system that quietly declines to log the incident produces a record that is intact, verified, and misleading. Auditors meet this every year as completeness testing: before a system-generated report counts as evidence, someone must establish that nothing was left out of the population. Accuracy is the cheap half. Completeness is the expensive half, assembled by hand from screenshots, exports, and professional skepticism billed hourly.

What LoomSpan does

Completeness cannot be proven absolutely. That would be a claim about events that left no trace. The achievable goal, and the one audit actually runs on, is to convert silent omission into an affirmative lie. On a fixed cadence the producer signs a beat: as of this moment, the chain head is this, and exactly this many entries have been appended since the last beat. Deleting an entry afterward contradicts the counts or the links. Switching the collector off during an incident no longer leaves an empty nothing. It leaves either a missing heartbeat, which is visible, or a signed false count, which is a materially different problem for whoever signed it.

Silence needs one more ingredient. A chain that stops beating simply ends, and a file cannot show what should have come next. Beats are therefore published where absence is visible: an append-only public feed on the declared cadence, where a missing entry is plain to anyone watching. The feed, not the file, is where going dark becomes loud.

What it looks like in an audit

A company sells to enterprises, and every deal stalls on the same SOC 2 question: prove the quarterly access review covered every system, not just the ones convenient to screenshot. The evidence has always been a folder of exports assembled the week the auditor arrives, and the auditor's hardest hours go to completeness, establishing by hand that nothing was left out of the population, billed hourly.

That sentence is the whole deliverable for the expensive half of the audit. It is honest about the one gap rather than hiding it, which is exactly what lets a reviewer trust the rest.

What it proves, and what it does not

A spanned chain proves the producer committed, beat by beat, to the exact population of its record, and that nothing attested was later removed without contradiction. It does not prove an event was captured in the first place: a beat bounds when an omission had to begin, not whether one happened. Coverage is reported as measurement, never as a badge. Attested every 60 seconds, publicly anchored, longest unattested window 74 seconds: that is the honest sentence, and the only kind this site is allowed to print.

Where it lives

LoomSpan is a profile of LoomSeal, not a second format. One claim type, loomseal.span/1, on the same chains, checked by the same verifier, under the same offline rules: no server, no account, no trust in KordLoom. The draft text sits in the spec, and SwitchTender's change chain is the first planned producer.

Status: shipped. The verifier checks span claims, five conformance vectors cover the profile, and the Go, Python, and browser verifiers agree on every one. The next step is conversations with the people who assemble completeness evidence by hand, not more code. hello@kordloom.com reaches the person writing it.