A design for an append-only event log whose entries can be redacted, and disclosed to different readers at different depths, without breaking verification. It is described so that it can be implemented in any language on any platform.
The design rests on four practices: the log is a truth separate from the application's live state rather than the source that state is rebuilt from, redaction preserves the chain instead of breaking it, one committed entry serves every audience at a different depth, and the format's version moves when meaning moves rather than when fields are added.
This is a design for logs of one shape rather than for logs in general, and the shape is what decides whether it applies. Entries are events attributed to a principal. They accumulate in order and are not edited afterwards. Some of them carry content that only a subset of readers may see. Some of that content has eventually to be destroyed, on request or on a schedule, while the fact that t