Watch MultiWitness actually work

TRIGGER — Zapier: Stripe "charge.refunded" fires at 14:02:11Z. Your refund agent approved $1,240.00 to customer ORD-88413 after a support thread.

MultiWitness appends, same second:

seq 4417
ts 2026-03-04T14:02:11.884Z
actor agent:refund-bot-v3
action stripe.refund.create
input {charge: ch_3Qk8..., amount: 124000, reason: "damaged_on_arrival"}
approver human:dana@northlight.co (Slack ✓ 14:01:52Z)
prev 9f2c1a...e88d
hash 41b7d0...c3a9

Nine days later your bookkeeper flags the refund. You send them the log file plus the verifier binary — nothing else, no login, no server call.

They run it offline:

$ multiwitness verify ledger.mwl
▸ 4,417 entries scanned
▸ chain intact — every prev matches computed hash
▸ genesis 2026-01-02T00:00:00Z anchored
▸ 0 gaps, 0 reordered, 0 modified
VERIFIED

If someone had quietly edited that amount from 124000 to 24000, entry 4417's hash changes, 4418's prev no longer matches, and verify halts with "chain break at seq 4417."

Straight about the boundary: MultiWitness proves the record wasn't altered after it was written. It does not prove the agent told the truth when it wrote it — if your agent logs an action it never performed, the chain will faithfully protect that false entry. The integrity guarantee starts at write time, which is why entries are strongest when they carry the external ID (ch_3Qk8...) an auditor can independently check against Stripe.