Most consulting disputes are not about the work. They are about who said what, when, and what was agreed. We removed that argument by writing it down — once, in order, and in a place that cannot be quietly rewritten.
What the ledger actually is
For every engagement we open, there is a single append-only file: the engagement ledger. Every commitment, every decision, every change of scope, every artifact we deliver, every approval the client gives — each one lands as a new line at the bottom, with a timestamp and a signature on the entry. Nothing earlier ever moves. Nothing earlier is ever rewritten. If a line was wrong, the correction is a new line that points back to the old one (Class C — this is how the file is configured and enforced in our toolchain).
We picked this shape because it removes a category of failure we have seen too often in our industry: the slow, plausible-sounding drift where, six weeks in, the deliverable everyone "remembers agreeing to" is not the one that was actually agreed. With an append-only ledger, the question "what did we say in week 2?" has exactly one answer, and both sides can read it in the same place.
What it makes impossible
It is worth being concrete about what the ledger forecloses, because the value is mostly in the things that can no longer happen:
- We cannot quietly broaden scope and bill against the broader version. Scope is a ledger entry; expanding it requires a new, signed entry.
- We cannot retroactively "remember" an approval you did not give. An approval is an entry; if it is not in the file, it did not happen.
- You cannot be told, six weeks later, that the thing you asked for in week 2 was "never actually agreed." Week 2 is still in the file.
- Neither side can be ambushed by a forgotten promise. If it is not in the ledger, it is not a commitment. If it is in the ledger, it is.
This is the part that matters to clients more than the technical mechanics: the ledger is symmetric. It protects you from us, and it protects us from us. A consultancy that wants room to drift will not adopt a tool that removes that room.
A redacted slice from a live engagement
Here is a real (redacted) sequence from a current SWU engagement, lightly edited to remove identifying detail. Names are placeholders; the structure and the timestamps are real.
2026-05-14T09:12Z SCOPE-OPEN Discovery sprint, 2 wks, fixed fee.
2026-05-21T16:40Z DECISION Drop integration vendor A; cost > value.
2026-05-28T11:02Z ARTIFACT Discovery report v1 delivered (sha …c4f1).
2026-05-28T15:18Z APPROVAL Client signs off on v1 findings.
2026-06-02T10:30Z SCOPE-CHANGE Add a second workshop. New fee line added.
2026-06-02T10:31Z APPROVAL Client signs the scope-change entry.
2026-06-15T14:05Z CORRECTION Entry 2026-05-21 vendor name misspelled;
see entry 2026-06-15 for canonical name.
Notice what is not there: no edits to the May 21 line. The misspelling is fixed by a new entry that points back. Six months from now, anyone reading the file in order sees the misspelling, sees the correction, and knows exactly which one is current. That is what append-only means in practice (Class C).
Why this is grown-up engineering, not paranoia
Append-only logs are not exotic. They are how banks reconcile, how Git itself works under the hood, and how serious incident-response teams keep forensic trust during an investigation (Class E — append-only / immutable audit logs are a standard control in security and finance engineering literature). What is unusual is applying that same discipline to the soft parts of a consulting relationship — the conversations, the approvals, the "we said we would do this" moments — that almost everyone else leaves in email threads and Slack DMs where they can be quietly lost.
We are not the first to point at receipts as the missing ingredient in trustworthy professional services. We do not claim to have invented this posture. We claim only that we are actually doing it, in the open, in a form a client can inspect at any time, on every engagement.
What this gets you as a client
You get one place to look. You get a file you can hand to your own auditor, your own lawyer, or your own successor if you change roles mid-engagement. You get a relationship where neither side has to remember correctly — because the file remembers, and the file does not move.
You also get one less reason to be afraid of hiring a consultancy: the single biggest source of post-engagement bitterness is the drift between what was bought and what was delivered, and that drift cannot survive contact with a working ledger.
If you want to see this posture in context, the surrounding pieces are here:
- The Trust Receipts Standard — the short version of what we promise and how we make it checkable.
- Transparency Architecture Overview — how the ledger fits with the rest of the receipts stack.
- Book a workshop — the first ledger entry on your engagement is the one that opens it. Start it whenever you are ready.