Skip to content
GHOST PROTOCOL
Platform

One engine for every step between raw evidence and a report you can defend.

Six stages, each with an output a reviewer can open. Deterministic where it matters, labeled where it is simulated.

  1. 01 · Ingest & provenance

    Every file is fingerprinted

    SHA-256 of the original bytes, content-type checks that catch a renamed executable, storage by hash, duplicates recognized.

  2. 02 · Time normalization

    Clocks aligned, originals kept

    Source time never changes. Normalized time is stored beside it with its rule. Offsets are inferred by matching moments that several sources recorded.

  3. 03 · Conflict rules

    Contradictions with a name

    RULE-DUP-001 copied records, RULE-TIME-001/002 declared and inferred clock offsets, RULE-CLAIM-001 unsupported identity. Each states what it cannot tell.

  4. 04 · Claims & hypotheses

    Four states, no fake odds

    Supported, Contradicted, Inferred, Unresolved, each citing evidence. Competing explanations compared side by side.

  5. 05 · Review & audit

    Humans decide, on the record

    Decisions need a reason and land in an append-only audit trail with who, when and why. They survive re-analysis.

  6. 06 · Report

    Exports that keep the doubt

    Markdown and JSON with sources, both times, rules, hypotheses, unresolved questions and limitations.

Architecture

Private engine, public interface.

The browser only talks to the website. The evidence engine runs beside it and is never exposed to the internet. No AI model decides an outcome.

ClientInvestigator’s browser
PublicWebsite · server actions
Private · 127.0.0.1Evidence engine
  • Rules: deterministic, versioned IDs
  • Store: resettable demo state
  • Files: content-addressed