Skip to main content

​
Every step leaves a record

An errand that says it read your APR should be able to show you the page it read it off. So Hence Assistant screenshots as it goes, and every act it performs produces a receipt: what was requested, of whom, on what date, by what route, what confirmation to expect, and the proof that it was delivered. Receipts exist for you, but they are also the reason an errand’s result can be checked rather than believed. A figure that arrives without a source and a date is an assertion.

​
Where the figures come from will matter

These three kinds are the contract for a figure once a result carries the numbers it read. They are not what a result carries today — see What you get back below, which says what is and is not returned.
  • From a document — a downloaded statement, or a structured response from the service itself. The strongest kind, because the artifact would be kept and the figure would point at it.
  • Read off a page — a number lifted from a rendered portal page, recorded as a reading and naming the page it was read from.
  • From you — something you told Hence Assistant in the conversation.
The kind would show alongside the figure. A number read off a page and a number taken from a stored statement are not the same claim, and Hence Assistant will not present them as if they were.

​
What you get back

A finished errand returns its state, the steps it took in order, a receipt for each act — what was requested, of whom, on what date, by what route and what confirmation to expect — the events along the way, and the remaining action with whose it is.
It does not yet return the figures it read. A step’s own account of what it found is discarded once the step lands, and the receipt is written from the errand’s description of that step rather than from the page, so today a result tells you what was asked and done rather than the number that came back. The provenance kinds above are the contract for a figure once they are carried through; they are not what a result carries today.

​
Where screenshots live

A screenshot is never pasted into your assistant’s transcript. A result points at evidence rather than carrying it, so an authenticated account page does not end up scattered through a transcript that belongs to the host rather than to us. That default is the boundary, and it is what makes the rest of this section survivable. Captures are kept on our side, encrypted under a key held for your household, for 30 days, and they are deleted when you ask for erasure. The receipt for an act points at the capture that acted as its proof, though there is not yet a page that plays a stored capture back to you — the receipt is still what you read. A receipt outlives the image it cites: once the 30 days pass, the reference on an older receipt points at nothing, which is the honest state rather than a broken promise.
Captures are stored unredacted during the pilot and through the first release: an account page that shows an account number is kept as it appears. Redacting at capture is planned after that release, with no date, and it is not what opens access — see Trust and control.