Log AI decisions /
tamper-evident, chain-linked.

What decisional logging provides.

A single POST endpoint accepts a decision event, validates it against the Strict-B schema (hashes and non-identifying fields only), writes the event to the append-only audit chain, and returns the audit_id and chain_hash. The event is independently verifiable at https://yolo.solutions/verify/{audit_id} with no login required.

Decisional logging writes to the same audit chain as the Agent Commerce Protocol — same SHA-256 chain linkage, same nightly Merkle anchor, same Base mainnet provenance. The two surfaces are additive: the same API key and agent UUID work for both.

The audit chain produces the record-keeping evidence EU AI Act Article 12 requires of high-risk AI systems listed in Annex III. The Annex III enforcement date is August 2, 2026 (legally operative); a December 2, 2027 extension has been proposed via the EU Digital Omnibus provisional agreement (May 7, 2026) and is pending formal enactment. Plan for the earlier date.

Replace YOUR_API_KEY with your issued key and YOUR_AGENT_UUID with the agent UUID the key is scoped to.

# You compute content_hash locally over your readable decision; Yolo never sees it.
curl -X POST https://yolo.solutions/api/agents/YOUR_AGENT_UUID/log \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "event_type":    "routine",
    "content_hash":  "3b8e...<64-char SHA-256 hex>...a1",
    "model_id":      "spam-classifier",
    "model_version": "2026-05-01"
  }'

# Response (201):
# {
#   "audit_id": 1234,
#   "chain_hash": "abc123...",
#   "content_hash": "3b8e...a1",
#   "tier": "routine",
#   "timestamp": "2026-05-23T10:00:00.000Z",
#   "verification_url": "https://yolo.solutions/verify/1234"
# }

# You hash the readable decision AND each evidence file locally; send only hashes.
curl -X POST https://yolo.solutions/api/agents/YOUR_AGENT_UUID/log \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "event_type":    "high_stakes",
    "content_hash":  "9f2c...<64-char SHA-256 hex>...a1",
    "model_id":      "clinical-triage",
    "model_version": "2026-04-01",
    "evidence_manifest": [
      { "type": "json", "sha256": "be7d...<64-char hex>" }
    ],
    "correlation_ref": "opaque-ref-001"
  }'

# Response (201):
# {
#   "audit_id": 1235,
#   "chain_hash": "def456...",
#   "content_hash": "9f2c...a1",
#   "tier": "high_stakes",
#   "verification_url": "https://yolo.solutions/verify/1235"
# }

# The verification_url in the response is public:
curl https://yolo.solutions/verify/1235

# Or open it in a browser — any auditor, regulator, or counterparty
# can verify the chain hash math without credentials.

Every event is cryptographically bound to the previous.

Each audit log entry stores a chain_hash computed as:

# Chain hash formula
SHA-256(agent_id + ":" + seq + ":" + prev_hash + ":" + payload_hash)

# First entry for an agent:
# prev_hash = "genesis"

# Verify any entry with openssl:
printf '%s' "<agent_id>:<seq>:<prev_hash>:<payload_hash>" \
  | openssl dgst -sha256 -hex

The full formula is published at /methodology. The nightly anchor cron commits a Merkle root per agent over that agent's entries since its previous anchor (bounded by sequence, not by date), making every event provable to a third party without trusting Yolo.

The verification_url returned with every response points to a public page showing the entry fields, the chain math inputs, and a copy-pasteable openssl command to independently recompute the chain hash. Auditors and regulators can verify any entry without credentials or Yolo system access.

Per-request webhook delivery with HMAC-SHA256 signature.

Supply webhook_url and webhook_secret in the request body to receive a signed delivery notification after the event is logged. In Tier 1 beta, webhook configuration is per-request (no stored config).

{
  "event":    "decision_logged",
  "job_id":   "<audit_id>",          // matches audit_id in the response
  "status":   "routine",             // the event_type tier
  "timestamp": "2026-05-17T10:00:00.000Z",
  "metadata": {
    "audit_id":   1234,
    "agent_uuid": "<uuid>",
    "tier":       "routine",
    "chain_hash": "abc123...",
    "content_hash": "9f2c..."
  }
}

Every POST includes an X-Yolo-Signature: sha256=<hex> header. Verify it before trusting the payload. Use timing-safe comparison (e.g., crypto.timingSafeEqual in Node.js):

# Verify in bash
printf '%s' "$PAYLOAD" | openssl dgst -sha256 -hmac "$WEBHOOK_SECRET"

# Compare to the value after "sha256=" in X-Yolo-Signature

If no webhook_secret is supplied with a webhook_url, a random 32-byte hex secret is generated per-event. This is insecure — always supply your own secret to enable verification.

Machine-readable endpoint metadata is available at:

GET https://yolo.solutions/well-known/decisional-logging.json

# Returns: endpoint URL, tiers, rate limit, verification, evidence options,
# webhook behavior, and documentation link.
# No auth required. Cache-Control: public, max-age=3600.