Trust model

How a Proof Record becomes trustworthy.

Proof is a permanent ledger of on-farm trial evidence. This page describes the structural rules that make a record trustworthy: what is recorded, what is published, what stays private, what cannot be changed, and what Proof refuses to do.

It is the methodology document. Read it as you would a registry standard, not a marketing page.

PROOF RECORDPRF·UK·2026·000XXXWinter wheat. Biostimulant compared with untreated control.· Lincolnshire · Heavy clay · 2026YIELD · VS CONTROL+0.41t/haSTRUCTURED · PROTOCOL LOCKED8f4c·0c5e·91bA · IdentifierB · SubjectC · Public locationD · OutcomeE · Trust pipsF · Canonical hashG · Lock state

Proof records what happened, under stated conditions.

A Proof Record describes a real on-farm trial: what was tested, against what control, in what conditions, with what outcome. It does not say a product works. It does not say a product fails. It says what was recorded, by whom, on what evidence.

The reader draws the conclusion. Proof preserves the evidence the conclusion was drawn from.

§A recorded outcome, not a product verdict.

Sections II / III

Public evidence preserved.
Private farm data protected.

A Proof Record exists in two envelopes. The public envelope carries enough context for a reader to assess the evidence. The private envelope holds the farm identity and the raw files that produced it.

PUBLIC ENVELOPECrop · Season · Broad regionSoil class · Treatment / control designOutcome · Evidence ManifestConflicts · Addenda · QueriesCanonical hash · Trust stateBOUNDARYPRIVATE ENVELOPEFarm identityField boundariesRaw GPSRaw evidence filesEXIF · invoices · notes
II

What gets published.

  • Crop and season
  • Broad region
  • Soil class
  • Treatment and control design
  • Outcome direction and magnitude
  • Evidence Manifest
  • Conflicts and affiliations declared
  • Addenda
  • Evidence Queries raised and resolved
  • Canonical hash

Enough for an outsider to read the evidence honestly.

III

What stays private.

  • Farm identity
  • Field boundaries
  • Raw GPS
  • Raw evidence files
  • EXIF and metadata
  • Invoices and commercial documents
  • Private contributor notes

Identity stays with the contributor. Evidence becomes public.

Section IVRecord states

Six trust states. Three earned at lock. Three accrue over time.

Each Proof Record carries a six-pip trust state. Pips are filled when the record meets the structural test for that state. They describe the shape of the evidence. They do not describe the product.

Earned at lock
Accrues over time
  1. 01
    Recorded

    A real on-farm trial entered into the ledger by a verified contributor.

    Does not mean the trial was structured, controlled, or independently reviewed.

  2. 02
    Structured

    Treatment arm, control arm, and same-management declaration all defined.

    Does not mean the trial was randomised, replicated, or scientifically conclusive.

  3. 03
    Protocol locked

    Trial protocol declared and locked before treatment was applied.

    Does not mean the protocol was reviewed outside the contributor's organisation.

  4. 04
    Independently reviewed

    A verified contributor outside the recording organisation has reviewed the protocol, evidence and outcome.

    Not yet active. Independent review opens once the contributor base reaches the threshold.

  5. 05
    Replicated

    A separate Proof Record, by a different contributor, has tested the same claim under comparable conditions.

    Not yet active. Replication accrues as comparable records enter the ledger.

  6. 06
    Corroborated

    The record sits within a cohort that has passed the privacy threshold and shows a consistent direction.

    Not yet active. Corroboration is structural, not evaluative.

§Trust state is structural, not evaluative.

A positive result is not stronger evidence than a null result.

Proof renders positive, null, negative, mixed and observational outcomes in the same ink, at the same weight, in the same place on every record. The direction of an outcome carries information. It does not carry a verdict.

Evidence quality is described separately, by the record's trust state and by the cohort it sits within. A positive outcome from a single unstructured trial carries less evidential weight than a null outcome from a protocol-locked trial with three replicates. Proof shows both.

§Outcome direction is separate from evidence quality.

Section VIImmutability and addenda

Locked records do not silently change.

  1. Record locked
    28 Jul 2026 · 14:42 UTC
  2. Addendum 01
    04 Aug 2026 · Method clarification
  3. Evidence Query opened
    12 Aug 2026 · Cohort applicability
  4. Addendum 02
    21 Aug 2026 · Query addressed
  5. Original record
    Preserved in full

The original record is preserved as recorded. Every addendum and every Evidence Query sits beside it, dated and visible. The history of the record is the record.

Once a Proof Record is locked, the values, the evidence references and the canonical hash become permanent. The record cannot be edited. It cannot be deleted. It cannot be quietly revised.

Corrections, clarifications and late evidence are added as addenda. An addendum sits beside the original record, dated, attributed, and visible. Readers see the original and the addendum together. Nothing is overwritten.

If a contributor's circumstances change, or if a record is found to contain a material error, the addendum captures the change. The original is preserved as recorded. The history of the record is the record.

Each piece of evidence is named, hashed, and tied to the part of the record it supports.

The Evidence Manifest lists every file the record relies on: application photos, yield files, protocol documents, lab reports, weighbridge tickets, soil analyses, field maps. Each item carries a type, a hash, the part of the record it supports, and a visibility state.

Visibility is explicit per item. Some items are published in full as redacted derivatives. Some are published as metadata only. Some remain entirely private. The reader can see what kind of evidence backs each part of the record without seeing the raw file itself.

Raw files stay private by default. The contributor chooses what becomes a redacted public derivative. The ledger records the choice.

A structured way to question a record without erasing it.

A verified contributor may raise an Evidence Query against any locked record. The query asks a structured question about the evidence: a method clarification, a confounder, a measurement concern, a cohort applicability question.

The query does not erase the record. It does not invalidate the record. It opens a public, dated question that the contributor may address with an addendum or further evidence. The query and its resolution become part of the record's history, visible alongside the original.

Evidence Queries are deliberately not adversarial. Proof uses the term "query" rather than "challenge" because the goal is structured clarification, not a contest. A record that has been queried, addressed, and resolved sits with greater clarity, not less.

A declared conflict changes how a record is read. It does not invalidate the record.

Contributors may have commercial relationships with the products they record. A trial may be sponsored. A contributor may distribute a product. A manufacturer's R&D team may run trials on their own materials. Proof records all of this and makes it visible on the record itself.

Sponsored trials, manufacturer-affiliated contributors, and distributor relationships appear in the Conflicts section of every affected record. The underlying evidence is recorded under the same rules as every other contribution. The reader sees the evidence and the conflict together, and reads the record accordingly.

A null or negative outcome from a sponsored trial is published with the same prominence as a positive outcome. The conflict declaration changes how the record is read; it does not change which records get published.

Section X

The redaction bar
is the boundary
made visible.

Where it appears, the public envelope ends and the private envelope begins. The boundary is structural, not editorial: the same fields are redacted on every public record, regardless of what the record says.

Section XIWhat Proof does not do

Proof refuses several things that other evidence platforms do.

  • 01
    Proof does not rank products.
    Records sit alongside one another. Cohorts describe shape and direction. Nothing is ordered from best to worst.
  • 02
    Proof does not endorse products.
    A positive record is one outcome under stated conditions. It is not a recommendation.
  • 03
    Proof does not verify that a product works.
    Proof verifies that a contributor recorded a trial under structural rules. The conclusion belongs to the reader.
  • 04
    Proof does not delete records to protect anyone.
    Negative outcomes, null outcomes, sponsored outcomes and contributor-affiliated outcomes all remain visible.
  • 05
    Proof does not interpret outcomes for the reader.
    Records show what was tested, what was measured, and what was recorded. The reader interprets.
  • 06
    Proof does not re-publish private farm data in any form.
    The private envelope is not derived, not inferred, and not exposed.

A trustworthy evidence base cannot be built from positive outcomes alone.

A null trial is evidence. So is a negative trial. So is a mixed trial whose primary outcome went one way and whose secondary outcome went the other. So is a trial whose protocol unravelled in the third week of June.

Proof preserves these records with the same care as positive ones. They sit in the same explorer, in the same ink, with the same trust pips, under the same rules. A reader looking at a category sees the full cohort, not a curated selection.

This is structural, not editorial. Proof does not choose which outcomes to keep. The contributor records, the schema validates, the record locks. The outcome direction is recorded as it was measured.

§A recorded outcome, not a product verdict.

Proof exists because serious agronomic evidence deserves a permanent home. The records entered here in the first seasons will define what trustworthy on-farm evidence looks like for the decades that follow. The trust model is the rule set that keeps the ledger honest.

Independent evidence ledgerTrust model · v1proof.ag