Reviewers seal it.
Nobody relays it.
A line goes on a Bureau file only when reviewers release it. Their decisions never pass through the operator: each reviewer seals their own signed record in a review log kept in CounterAudit, and the Bureau and CounterAudit each work out from that log who the reviewers are and what they decided. This is one run of the whole flow on the production services, with the real ids.
Operator-held testnet reviewers. The three reviewers here are keys the operator holds, named as such. With one party holding every key the two-person guarantee does not hold, so while this testnet genesis is pinned the Bureau counts no decision on live data and releases no live line. Before any live data, independent reviewers seal a genesis of their own and it replaces this one.
The operator relays nothing
The reviewer sealed their approval with their own key. The Bureau read it from the log; the operator only ran the sync.
Two systems, one answer
The Bureau and CounterAudit each replay the log by the same rules and name the same three reviewers.
Keys need reviewers
In the review organization a new key took one reviewer's signature of that exact request, and revoking it took two. Since 2 November 2026 a new key needs two reviewers' approvals too.
Four sealed positions.
One released line.
Testnet review organization ad7b94fc-05be-45e6-9124-62f576f2d812 in CounterAudit. Each position is a sealed packet in its hash chain, numbered from 0.
- SEQ0–2
Three reviewers sign one genesis
Each testnet reviewer made an Ed25519 key, signed the same genesis naming all three, and sealed it with their own key. All three saw the same genesis hash, which the Bureau and CounterAudit both pin.
- Genesis hash
- 8cb804864151e37ef952ddfef76ff788dffe6508bab7d50cfb17a5f51b5456df
- rev_testnet1
- ed25519:cDXnzRJ4znsK6bW_k7Xn0Wnp2FDmOLPguXWt_RPz2v4
- rev_testnet2
- ed25519:HM1Xr7fk4yjykWmKoK84FZMWubORUt3l3d75eHNf-X4
- rev_testnet3
- ed25519:8u_dWiYgLkRi3XJNfTFwyzkxtR_4wfuVA-pp-cANbEI
sequence 0: rev_testnet1 signed the genesis of rev_testnet1, rev_testnet2, rev_testnet3 sequence 1: rev_testnet2 signed the genesis of rev_testnet1, rev_testnet2, rev_testnet3 sequence 2: genesis of rev_testnet1, rev_testnet2, rev_testnet3 took effect, signed by all of them
- LINE
A line waits for review
The pilot line: a delivered outcome, test data, signed by the pilot furnisher and sealed in CounterAudit. Its proof passed. No machine check exists for a delivery, so a person must judge it and waive the evidence with a reason.
- Line
- fur_bureaupilot01/pilot-test-20261030234110
- Signed event
- 569ef03a85983fea9fa02c50487ee59dc5bcc9ae6e5995192c14d04b558cbe0c
- Sealed as
- packet 29879d36-30e6-49e4-baed-524a08a1787f
delivered test data shown unverified proof passed; evidence needs_review: no machine check exists for delivered outcomes
- SEQ3
A reviewer decides, and seals it themselves
Testnet reviewer 1 signed an approval that waives the evidence. It is bound to this line, this version of its event, its data class and the evidence as they saw it. They sealed it in the review log with their own key and kept CounterAudit's signed receipt.
- Decision
- approve_with_waiver, by rev_testnet1
- Reason
- Testnet demo: the pilot delivery was checked by hand
- Sealed as
- packet fff8bbc2-00c4-4a7d-8110-031d79e25563
- Signature
- ed25519:6rR2KaFr-zScm8Pxlxn3K5_CP3q8K3-iiuLNvQlzo8P6qyJpXq60C_hN9mJObDhgGlSid1XrzqDnemvSdUN0DQ
- SYNC
The Bureau reads the chain and releases the line
The operator's sync read the new packet and settled every line. One reviewer is enough for test data. The run printed the new state as verified, its name until review finding M-04 renamed it released: a release records what the checks and reviewers found, not that the outcome happened.
fur_bureaupilot01/pilot-test-20261030234110: unverified -> released sealed: rev_testnet1 approve_with_waiver at sequence 3 released (one reviewer, test data)
Released through the review log
No key changes
without reviewers.
Whoever administers the review organization could otherwise issue or revoke its keys alone. Each change here was an approval request that ran only on reviewers' signatures over that exact request. Since 2 November 2026 a new key needs two reviewers' approvals too.
- REQA
The admin asks for a new key
In the review organization, CounterAudit answers with an approval request instead of a key.
- Request
- 2564c6a7-55a8-4b9f-8c99-bfd07bf5d6a7
- Needs
- 1 reviewer's signed approval
- SIGN
Reviewer 2 reads it and signs
The approval covers this request's id, organization, operation and the SHA-256 of its payload. CounterAudit checked it against reviewer 2's current key in the review log and ran the request. The key's secret was never shown.
create a key with role "ingest", labelled "testnet demo ingest", expiring in 7 days
Created on one reviewer's approval - REQB
The admin asks to revoke that key
The request names the key well enough for a reviewer to tell whose it is. Revoking takes two different reviewers.
- Request
- 983fba95-29a2-4eb4-8ef8-26ce54adf486
- Key
- role "ingest", labelled "testnet demo ingest", prefix ca_live_d3da2c1a
- REUSE
An old approval cannot be spent again
Reviewer 2's approval of request A, sent for request B:
403 reviewer_approval_refused: the approval is for another request
Refused - 1 OF 2
Reviewer 1 approves
One of the two approvals it needs. Nothing runs yet.
"executed": false, "reviewer_approvals_remaining": 1
- 2 OF 2
Reviewer 3 approves, and it runs
Two different reviewers, each signing this exact request.
"executed": true, "operation": "revoke_key"
Revoked on two reviewers' approvals
- With a read key to the testnet review organization,
GET /v1/audit/review-orgon api.counteraudit.io returns the pinned genesis hash and the reviewers CounterAudit counts, with their public keys. GET /v1/audit/verify/<packet_id>with the same key returns each sealed record, signature included. Any Ed25519 library verifies it against the public keys above.
- Three independent reviewers make their own keys and seal a genesis in a review organization of their own. Its hash replaces the testnet pin in the Bureau and in CounterAudit.
- Subscribers receive a verifiable, redacted release bundle for each released line.
- Counsel reviews how the Bureau keeps and uses files. Until then no file with live lines is signed.