The Black Box: An Append-Only Record of Everything

I promised the recorder at the end of the pipeline post. Here it is — every operator action, every gate verdict, every command that reached a vehicle, written to a log that only ever grows. After an incident, you replay the tape.

In the command-pipeline post I ended on a promise: next up is the recorder — an append-only, replayable log of every input and every decision. This is that. And it's the piece that turns "trust me, the pipeline checked it" into "here is the record that it did."

Every operator action, every gate verdict, every command that reached a vehicle — written to a log that only ever grows. Nothing is edited. Nothing is deleted. Kaya nga black box (that's exactly why it's a black box) — after an incident, you replay the tape.

Why a recorder is the actual product

A ground control station that can fly a drone is a demo. A ground control station that can prove what it did and why, six months later, to someone who wasn't in the room — that's the thing a regulated operator can actually deploy.

The whole security architecture only means something if there's a durable record that it ran. RBAC, the safety gates, two-person authorization — each is a claim. The recorder is what makes the claim checkable after the fact.

The one rule: append-only

The recorder has exactly one non-negotiable property: you can add to it, and that's all. No update. No delete. An event, once written, is permanent.

That constraint is the entire value. A log you can edit is a log an attacker — or an embarrassed operator — can rewrite. The moment "fix the record" is possible, the record proves nothing. So the design removes the capability rather than governing it. Same instinct as the read-only knowledge platform: make the dangerous operation impossible, don't manage it with a permission.

What gets recorded

Every meaningful thing that happens becomes an event with a type, a timestamp, and a payload: a connection, an operator command, each gate's verdict, the final send, telemetry milestones, link changes, faults. The stream is the complete story of a mission, in order.

And because every command already flows through the pipeline, the recorder sits at exactly one choke point. It doesn't need to be sprinkled through the code — it watches the one road every command travels.

Replay

An append-only event stream gives you something a normal log doesn't: you can replay it. Feed the events back in order and you reconstruct the exact state of the system at any moment — what the operator saw, what the pipeline decided, where every asset was. Not a summary of the mission. The mission itself, re-runnable.

That's the difference between "logging" and "an audit trail." Logging tells you what happened. Replay lets you stand inside it.