A design for an append-only event log whose entries can be redacted, and disclosed to different readers at different depths, without breaking verification. It is described so that it can be implemented in any language on any platform.
The design rests on four practices: the log is a truth separate from the application's live state rather than the source that state is rebuilt from, redaction preserves the chain instead of breaking it, one committed entry serves every audience at a different depth, and the format's version moves when meaning moves rather than when fields are added.
The encoding beneath this design is neither new nor specific to it. Entries are Gordian Envelope structures serialized as deterministic CBOR, both published specifications with a reference implementation that this system's output is checked against. What is specified here is the profile written over that stack, together with the practices that came out of operating it.