What the record holds: signed transitions, content-addressed state fingerprints, and an explicit marker wherever it could not see.
Every recorded transition carries the same fields: when it happened, which actor performed it, what action was taken, which artifact it touched, the content-addressed fingerprint of the state before and after, the predecessor it follows, and the signature that binds them.
A read that changes nothing records unchanged state. An edit records two fingerprints that differ — cryptographic evidence that the recorded state changed, rather than a description of the change.
Each row is one execution event: timestamp, signature status, the session it belongs to, the event fingerprint, and the actions it covers. The session identifier is colored by value, so a new session is visible without reading it.
Signatures are verified as they are printed. A signature that cannot be confirmed is marked in the output rather than quietly accepted.
The same holds for state. When recorded state jumps, a change has arrived that no monitored event accounts for. The chain is marked as unaccounted for at that point rather than shown unbroken.
chain: 2 sessions · 7 events · 1 unaccounted-for transition · all captured signatures validsession A[3dcca739]First Claude Code session2026-08-10T08:51:24Z✓3dcca739f026957aclaude:session-start,prompt2026-08-10T08:52:07Z✓3dcca739e96a3979claude:bash,read,edit2026-08-10T08:52:18Z✓3dcca739ca556ea7claude:session-end⚠UNACCOUNTED-FOR STATE TRANSITIONrecorded state at session B does not follow from session Asession B[d47cf728]New Claude Code session2026-08-10T08:52:41Z✓d47cf728e0cec939claude:session-start,prompt2026-08-10T08:53:39Z✓d47cf728a19ce1f2claude:bash,skill,read,edit2026-08-10T08:54:39Z✓d47cf7284a905c5fclaude:prompt2026-08-10T08:55:14Z✓d47cf728cb738110claude:read,bash,editchain end · 2026-08-10T08:55:14Z · signatures verified
Every witnessed transition is an edge in a graph of values. A lineage query returns every path connecting one value to another — shortest first, including the paths that went through intermediate states.
Conventional logs do not necessarily preserve the transition relationships required to reconstruct this execution lineage.
path 1 (2 hops):---Hop 1t:2026-08-10T08:52:07.389052Zident:sha-256:e96a397902349f2192795783ade70f38a91bbc631db9f577a55eb3b186fe5850ws:/private/var/folders/…/T/slmn-monitor-019feade-7d2c-7b51-94ee-21883dcca739/commit:sha-1:7403598f5dd08e7425ffcc6e52829265f12e7de9 → sha-1:94edc5caa5b34e303632564e3bfe260e5adabe25---Hop 2t:2026-08-10T08:53:39.850093Zident:sha-256:a19ce1f2fc93fe9c5744a4e532cb7b44ddd9926a9fe8b345717d91fb3c0c4611ws:/private/var/folders/…/T/slmn-monitor-019feadf-b26e-7e63-ab59-d468d47cf728/commit:sha-1:94edc5caa5b34e303632564e3bfe260e5adabe25 → sha-1:946e9f499d71e05aa13f0b9bee7d13f79fd83131
Execution is organized into labeled attribution boundaries. Capture is scoped to a session, the unit inside which execution is recorded and attributed: a human session, an agent session, and the sub-agent activity inside it.
Toolchain activity and infrastructure automation sit outside a recorded session today. The record marks what happens there as unaccounted for rather than treating it as part of the chain.
Execution now comes from AI agents, humans, and automation. Salmon establishes a verifiable execution record for supported execution, captured as it occurs rather than reconstructed solely afterwards.