Port-forwarded. Merkle-rooted.
RMF-mapped.

The 17th-century backstaff was named for the posture it required. Sailors turned away from the sun and read its altitude from the shadow it cast on the instrument, never the source. The genius was the indirection: you measure a thing too bright to look at by reading what it casts onto something solid in your hands.

Planisphere’s Backstaff keeps the posture. In the navigator’s three hands, the Astrolabe takes the reading — the measurement is the deliverable — and Starboard steers the fleet. The Backstaff is neither. It is the governance, risk & compliance layer: the independent witness that proves the reading can be trusted. It never ingests weights, never inspects callables, never holds a vendor secret. It reads the shadow the fleet casts on the ledger.

This is not modesty — it is the only physically honest posture for a witness. An instrument that consumes the thing it measures is not an instrument; it is the cargo. A compliance surface that steers the fleet it attests is not independent; it is a party to the act. The Backstaff’s back is turned by design, and its hands stay off the helm.

A device fleet that logs every reading to one ledger is only trustworthy if that ledger has four properties. It must be tamper-evident — no record can be edited after the fact without it showing. It must be attributable — every record names who cast it and when. It must be append-only — history grows, it does not get rewritten. And it must be safe to export — the view that leaves the substrate carries the evidence without the secrets.

Those four are the SOC 2 Trust Service Criteria made concrete for this substrate, and they are cheap pure-python primitives — so they live in the skeleton from the start rather than bolted on after a fleet is live. The Backstaff is the layer that holds all four:

These are the controls, not claims about controls. The functions are real and tested; the auditor’s evidence is the passing check and the redacted export, produced without a model or a socket.

Tamper-evidence is one primitive: digest_cast. Each recorded cast is hashed by SHA-256 over its immutable content — id, instrument, seed, result, flags, timestamp, actor — chained to the digest of the cast before it. The chain begins from a fixed genesis link of sixty-four zeros. Canonicalised with sorted keys, the digest is reproducible byte-for-byte by anyone holding the same content.

The chain hashes only the immutable fields. The mutable triage lifecycle — status, interpretation, fix — is deliberately excluded, so an analyst can advance a finding through triage without invalidating the integrity proof of the record. History is append-only at the layer that matters: the proof does not move, even as the work around it does.

Any after-the-fact edit to a recorded seed, result, or flag changes that cast’s digest and breaks every link downstream. A single walk of the chain — verify_chain — re-confirms the ledger or names the exact record where it broke. No vendor secret is required and no model is touched; the chain and the genesis link are sufficient. That passing walk is the auditor’s evidence for processing integrity.

A tamper-evident record that cannot say who is only half a witness. Every record on the ledger, and every lifecycle transition it later goes through, carries an actor and a timestamp. Who cast the reading, who triaged the finding, and exactly when — each step is attributable.

When no operator identity is supplied, the cast is attributed to the fleet itself — the system actor — rather than left blank. There is no anonymous write. The actor is one of the immutable fields the hash-chain commits to, so attribution is not a label that can be quietly swapped after the fact; it is pinned by the same SHA-256 proof that pins the reading.

This is what turns a log into an audit trail. A regulator, a program office, or a court can follow any finding back to the moment and the hand that recorded it, and can prove that the attribution has not been edited since.

The fourth property is confidentiality, and it is enforced at the boundary, not by trust. Before any text leaves the substrate — in a log export or a rendered view — a redaction pass scrubs the obvious secrets and PII: email addresses, bearer and API tokens, long digit runs that look like cards or accounts, and long hex runs that may be keys or hashes. Each becomes a typed placeholder — «email», «token», «digits», «hex».

Crucially, redaction is applied to the view, never to the stored cast. A seed that contained alice@example.com is recorded faithfully — integrity demands the chain commit to exactly what happened — but it surfaces as «email» the moment it is logged out. The record stays true for the auditor who holds it; the export stays safe for everyone who only needs to see that it holds.

This is the same posture as the Backstaff itself: read what is shown, not what is hidden. The fleet’s model is never undressed; the customer’s matter is never seen. The evidence crosses the boundary; the secrets do not.

The Astrolabe is the measurement instrument and nothing else: it grades a customer-furnished set of probe responses on distinctness, drift, coherence, and alignment, and emits a sha-pinned, Merkle-rooted, NIST-mapped evidence record. It has no UI, no scheduler, no vendor-management surface. The Backstaff is everything an operating program office needs around that instrument — but it stays on the evidence-metadata plane.

The Backstaff never touches the data plane. The customer continues to collect responses on their own infrastructure; the Astrolabe continues to process them in-enclave. The Backstaff works the metadata plane only. Its surfaces fill in build order — fleet creation (register subjects, freeze the engagement), continuous monitoring (the Drift Witness re-audit cadence), engine controls (thresholds per vertical, dry-run, explain), vendor tooling, and the per-vertical Boards that render a signed record for one audience.

And every one of those Boards is read-only. A Board renders a reading; it does not act on it. Steering is its own hand — the Starboard, the helm above the Boards, where an operator chooses which vessel to put to sea next. The Backstaff witnesses; it does not decide. That separation is the whole point: a witness that can steer the thing it attests is no longer independent.

The Backstaff is the witness-ledger; the ledger is here to be checked. To see what it records, read the Astrolabe at the Port — the reading the Backstaff stands behind. To steer a fleet once it is recorded, walk to Mission Starboard, the helm above the Boards. To watch the chain re-confirm a record with no vendor secret and no model in the loop, open the evidence check. To put the ledger to work on a fleet that is yours, open the audit trail below.