Skip to content
SIMPLESTATES / SELF-HOSTED DECISION EVIDENCE

StateMirror preserves what your application knew when it acted.

Most systems can explain what they did. Fewer can explain what they knew.

Run StateMirror locallyRead the specificationGitHub ↗

Three weeks later, a customer disputes an access denial.

Their subscription was active. Their entitlement state has since changed, and your team has deployed the application twice. Support asks engineering: “Why did the application deny access at that moment?”

Application submits

state_payload in POST /v1/snapshots

FIG 01 / JSONTX_EVIDENCE
{
  "subject": "customer_123",
  "inputs": {
    "plan_status": "active",
    "seats_used": 10,
    "seat_limit": 10,
    "read_at": "2026-06-15T18:22:30.000Z"
  },
  "rule_version": "access-rules@2026.06.12",
  "decision": "deny",
  "reason": "seat_limit_reached",
  "correlation_id": "request_001"
}
APPLICATION → STATEMIRROR

StateMirror returns

Abbreviated receipt; illustrative ID/time, hashes computed for this example.

FIG 02 / JSONRX_RECEIPT
{
  "snapshot_id": "71be5886-a779-4c28-ae90-c389165c90a2",
  "sequence_num": 1,
  "received_at": "2026-06-15T18:22:31.120Z",
  "payload_hash": "PbQTKH7/sGHUg+GjB0acqsNluk4DuU42HAZaHUwQ5r4=",
  "chain_hash": "NZpNkbVJ5z7OzkbmqpiGM89RqzAA9A0+eUVvAyUPkOg="
}
STATEMIRROR → APPLICATION

Your application defines the payload shape. The Quickstart shows the full request envelope and required headers.

Follow the access-denial example →

A decision-time evidence ledger

FIG 03 / SCHEMATICAPPLICATION_BOUNDARY
Application-owned action and evidence pathsThe application reads external or application state and makes the decision. Two separate paths leave the application: it performs or denies the action itself, and it submits evidence to StateMirror. StateMirror preserves the submitted evidence in PostgreSQL. StateMirror does not authorize or enforce the action.APPLICATION-OWNEDExternal / application statechosen inputsApplicationreads + decidesActionperform / denyEvidencesubmitted JSONStateMirrorpreserves evidencePostgreSQLsnapshot storage
Application-owned action and evidence pathsThe application reads external or application state and makes the decision. Two separate paths leave the application: it performs or denies the action itself, and it submits evidence to StateMirror. StateMirror preserves the submitted evidence in PostgreSQL. StateMirror does not authorize or enforce the action.APPLICATION-OWNEDExternal / app statechosen inputsApplicationreads + decidesActionperform / denyEvidencesubmitted JSONStateMirrorpreserves evidencePostgreSQLsnapshot storage
StateMirror receives evidence; your application owns authorization and enforcement.

State is queried. Decisions are made. Actions remain application-owned. Verification checks evidence integrity; it does not establish upstream truth or decision correctness.

Understand StateMirror →

Retrieve the snapshot. Verify its integrity.

After submitting a snapshot in the Quickstart, use its returned ID. Bash commands below use the Quickstart’s local test key.

REF 04 / BASH / LOCAL DEVELOPMENTRETRIEVE_VERIFY
SNAPSHOT_ID='PASTE_RETURNED_ID'
BASE='http://localhost:8080/v1/snapshots'
# Retrieve
curl "$BASE/$SNAPSHOT_ID" \
  -H 'Authorization: Bearer smr_test_read_key_123'
# Verify
curl "$BASE/$SNAPSHOT_ID/verify" \
  -H 'Authorization: Bearer smr_test_read_key_123'
Retrieve by ID, then verify the stored snapshot.
EXAMPLE RESULTINTEGRITY /PASS
TEST 04 / JSONINTEGRITY_VERIFY
{
  "snapshot_id": "71be5886-a779-4c28-ae90-c389165c90a2",
  "sequence_num": 1,
  "valid": true,
  "message": "Preserved evidence integrity verified."
}
Abbreviated example response. PASS is a presentation of valid: true, not an additional API field or a live test.

Verify the stored payload hash and chain links within StateMirror’s documented trust model. Privileged database rewrites can evade these checks.

Open Evidence Workbench →
MATRIX 05 / EXISTING_SYSTEMS

Why not use logs or database history?

Your existing system may already preserve the inputs and integrity you need.
ToolPrimary jobHistorical decision inputsIntegrity verification
LogsOperations and debuggingIf explicitly captured and retainedDepends on logging design
Current DB stateOperational stateRequires separate historyDoes not itself verify past decision inputs
History / eventsHistorical state and reconstructionIf modeled and linked to the decisionDepends on the system
StateMirrorPreserve submitted decision evidenceBy explicit application submissionPayload hashes and chain checks within its trust model

On smaller screens, scroll the matrix horizontally to compare all columns.

StateMirror provides a narrow evidence contract when your existing system does not already supply these properties.

Compare logs, audit logs, databases and event systems →

Run StateMirror locally

Node.js 20+ · PostgreSQL · HTTP API · Apache-2.0 Core

Run StateMirror locallyGitHub ↗

Complete Core, free and self-hosted.

Apache-2.0 Core includes capture, retrieval, verification, inspection and export. Current paid packages are optional versioned artifact and license packages; they do not unlock additional StateMirror runtime capabilities.

StateMirror Production is a planned maintained lifecycle offering and is not currently available.

Compare packaging and licensing →