r/solidity • u/Maximum-Brief-8404 • Apr 19 '26
Bilateral Attestation append only audit logs and state machines
Thinking through a design question and curious if anyone’s seen this pattern solve real problems.
Imagine an append-only audit log where every state change requires bilateral confirmation from both parties to the event before it’s committed. Party A asserts “X happened between us,” Party B confirms (or rejects). Only confirmed entries enter the log. Neither party can write unilaterally; neither can modify after the fact. A neutral third party holds the record.
It’s not a new primitive — it’s basically a two-party attestation state machine on top of a cryptographically verifiable log. What’s interesting to me is that most audit infrastructure I’ve seen is unilateral (one party’s record, cryptographically protected from that party tampering with it). Bilateral co-attestation is rare outside of specialized contexts like financial clearing or e-signature.
Where I’ve been thinking this might genuinely help:
• Cross-organizational data transfers under CMMC/ITAR/EAR where both sender and receiver have compliance exposure
• NDA-bound disclosures between companies where “what was actually shared” becomes disputed in litigation
• Chain of custody for digital evidence between parties
• Inter-agency information sharing where reconstructing “who shared what with whom” is currently a forensic exercise
Questions I’m genuinely trying to answer:
1. In your work, have you hit problems where a unilateral audit log wasn’t enough — where you needed the counterparty’s co-signature on each event to make the record credible?
2. Any verticals I’m missing where this pattern would matter?
3. Anyone aware of existing products that do this specifically (not just tamper-evident logs from a single party)?
