StateMirror (Artifact v1.0.0) [ID: STM-01]
StateMirror is a self-hosted evidence snapshot primitive.
When your application makes a decision, it can submit the exact computed state used at that moment. StateMirror preserves that submitted payload as an immutable snapshot for later inspection, dispute resolution, and audit workflows.
StateMirror does not compute state, make decisions, enforce outcomes, or interpret payload meaning.
It records the evidence you submit. Your application owns the decision and the action.
What it records
- Computed state at decision time as an opaque JSON payload
- A stable evidence reference supplied by your application
- Capture and receipt timestamps
- Integrity hashes for tamper-evident storage
- Optional provenance metadata
What it does NOT do
- Does not compute the submitted state
- Does not decide whether the state was correct
- Does not interpret payload meaning
- Does not enforce allow, deny, grant, revoke, approve, or reject outcomes
- Does not provide search or analytics over payload contents
- Does not replace logging, tracing, or event sourcing
Typical use
Immediately before or after executing an outcome, your application submits a snapshot of the computed facts it used. Later, support, operations, or review workflows can retrieve the snapshot by reference.
Open-source runtime
The core StateMirror runtime is available as a public open-source repository for inspection, local deployment, and integrity review.
→ github.com/mlawrence427/statemirror-core
Boundary rule
Recorded facts are not enforcement.
StateMirror preserves what you submit. Your system owns outcomes.
If a snapshot is missing, incomplete, or cannot be written, your application must handle that condition explicitly.
Self-hosted. Signal-only. No hosted dashboard. No emergency support.
Failure modes
- Snapshot not submitted at decision time → no record exists later
- Payload is incomplete → snapshot is faithful but insufficient
- Idempotency not used → retries can create duplicate records
- Clock skew → captured_at and received_at may differ
- Database or network failure → ingest or retrieval can fail or time out
- Misusing snapshots as authorization proof → unsafe application behavior