QuoxCORE components · evidence

Don’t build your own evidence layer.

The record of what your agents did is the part you cannot retrofit. Skip it early and every incident review starts with an apology.

See what ships Try the live demo

Included in QuoxCOREFree, self-hosted, nothing to buy.

Build it yourself and you are signing up for

An append-only event store behind every surfaceevery route writing events, and a schema you will maintain forever
Execution traces someone can actually readwhat ran, with what inputs, in what order, assembled per run
A tamper-evident receipt chainhash-linked entries, witnessing, and the key custody that comes with it
An auditor-facing viewread-only access that proves the record without leaking the rest of your estate

Or install QuoxCORE. All of it is already there.

In plain words

What it is, where it lives, when to reach for it

What is it: The record layer of QuoxCORE: an append-only event store, assembled execution traces and a tamper-evident receipt chain.
Where do I use it: On the dashboard activity and evidence pages, and in your terminal through quox trace and quox governance.
When would I use it: When someone asks what your agents actually did, and the answer has to stand up.
How do I use it: quox trace list shows recent runs; quox governance ward status reads the receipt chain itself.

QuoxCORE is the free, self-hosted platform underneath this. What is QuoxCORE

audit events

If it happened, it is queryable.

Every surface writes to one append-only event store: agent actions, approvals, credential use, workflow steps, admin changes. The activity pages read from it, and so can you, filtered by actor, action or time.

How do I use itquox governance evidenceDashboard: Activityqueries the evidence records behind the activity pages, with the same filters.

The activity view in the QuoxCORE dashboard: the append-only event stream filtered by surface

traces

The whole run, assembled.

A trace is the story of one run: a narrative plus a per-layer waterfall of what executed, with what inputs, in what order. Traces can be listed, compared and replayed, so a strange result is an afternoon of reading, not archaeology.

How do I use itquox trace listDashboard: Activityquox trace get assembles one run into the narrative and waterfall view.

An assembled execution trace in the QuoxCORE dashboard: the per-layer waterfall of one run

underneath it all

Witnessed into a chain.

Events and receipts are witnessed into WARD, a write-once hash chain you can verify offline. The chain below is our own development platform’s, read live while building this page. The full story lives on the verifiable log page, and auditors get their own door.

How do I use itquox governance ward statusDashboard: Evidencequox governance ward verify checks a chain's integrity end to end.

$ quox governance ward status
  WARD Status
  chains            3
  entries           2220940
  witnessed         128317
  enabled           yes

Real output · our own dev platform's chain · captured 2026-09-09

Where it sits

Under everything, catching everything.

Bundled with QuoxCORE; the record is not an add-on. Whatever runs above it, plugins, workflows or your own code, lands here without asking.

if that’s not enough ...your code goes hereyour plugin can use everything underneath

you build this

Verifiable log/For auditors/Observability docs/WARD protocol/QuoxCORE

Ready when you are

Keep the receipts without building the till.

The event store, traces and the chain ship in the box with QuoxCORE: no extra licence, no extra install.

See the verifiable log Try the live demo