When the spatial record is the evidence, who has the receipt?
A spatial capture of a facility is a candidate evidentiary artifact. Today it sits as an opaque file on a vendor’s phone or a marketing-team drive. There is no cryptographic record of what was captured, when, by whom, where, or whether the bytes have been mutated since. The Knox layer pins all five at upload moment.
A spatial capture becomes a self-authenticating record the moment Knox anchors it.
- The gap. Spatial captures today are decorative — sales assets and marketing walk-throughs. There is no cryptographic record of what was captured, when, by whom, where, or whether the bytes have been mutated since.
- What Knox pins. Five things at upload: SHA-256 of the canonical scene file, hash of the metadata bundle (timestamp + GPS + device fingerprint + capture-app version), operator attestation digest, sequence-link to the operator’s previous capture, and the chain commitment that submits to OpenTimestamps for Bitcoin-block attestation. The chain commitment is what removes the bytes from operator-side rewrite — once anchored, the recomputed hash either matches or it does not.
- Vendor-neutral. Above any spatial-capture pipeline. The capture-app vendor handles capture; Knox handles audit-permanence. Same primitive across every vertical.
- Verification. Any third party — regulator, FDA inspector, plaintiff counsel, defense counsel, insurance adjuster, IG office, civil-rights bar, or counterparty — verifies via the public endpoint at /api/knox/verify without contacting Bonis. Architecturally aligned with FRE 902(13)/(14) self-authentication.
- Posture. Defensive-only. Bonis hashes what the operator uploaded; never accesses cameras, drones, or phones; never mutates the scene file; never stores raw capture data unredacted.
From decorative capture to evidentiary commitment.
Industry default for spatial capture today is decorative. Real-estate listings, construction marketing, retail walk- throughs — used as a sales asset, not an evidentiary one. The AAM extension flips it from decorative to per-execution audit-permanence.
What AAM commits
- Capture file fingerprint. SHA-256 of the canonical scene file, whatever the capture app emits — .ply, .splat, glTF KHR_gaussian_splatting.
- Capture metadata commitment. Hash of the metadata bundle: timestamp, GPS, device fingerprint, capture-app version. Pinned by the chain commitment at upload — independent of any later device-clock manipulation.
- Operator attestation. Signed declaration: “I, operator X, captured facility Y at timestamp T, this scene is the unmodified output of capture session S.”
- Chain link. Sequence-link to the operator’s previous capture (or genesis if first). Re-captures are provably linked across time.
- Bitcoin anchor. Hourly Merkle root → Bitcoin block via OpenTimestamps. Verifiable years later by any party, no Bonis call required.
One audit primitive. Every vertical that needs a spatial record on a date.
The same Knox event type (spatial_evidence_anchored) serves every vertical. The same chain primitive. The same self-authentication architecture. Categories below; named operators are not surfaced on this page per Stealth Posture.
Cannabis
Operator captures grow op or dispensary interior on production date; export-prep dossier; state-CRA inspection record; federal-rescheduling-era audit dossier.
Clinical trial
Site-on-date documentation for FDA inspection (21 CFR §312 / ICH GCP); trial-site monitoring record; investigator-binder spatial-evidence component.
Construction
Work-as-performed proof for lien claims; pre-loss / post-loss spatial record for insurance adjustment; building inspector record.
Insurance
Pre-loss baseline capture; post-loss damage assessment; subrogation evidence.
Real estate
Condition-on-date proof for purchase-and-sale agreement; landlord-tenant move-in / move-out record.
Federal facility
Periodic security-control documentation; visit-log spatial baseline; chain-of-custody for evidence storage spaces.
Cyber-physical
Data-center walkthrough proof; physical-access-control record; PCI-DSS-adjacent facility documentation.
Forensic chain-of-custody
Crime-scene spatial baseline as a public-chain-anchored record produced by lawful authority; Bonis is the audit primitive only.
Five proof rows. Each one is independently checkable.
Every claim below resolves to a live endpoint, a canonical taxonomy entry, or a published reference primitive. No screenshots, no PDFs, no closed-source attestations.
Canonical entry in the Knox event taxonomy. Verifiable in the live taxonomy at /aam/taxonomy.
Shipped 2026-04-28 as a vertical-agnostic upload + Knox-anchor + verify primitive. Pluggable chain target (in-process or remote). Tamper-detection proven end-to-end via single-byte XOR.
Same primitive that anchors every other Knox event class. Public verify endpoint at /api/knox/verify.
Architecturally aligned. The court determines admissibility on the record; Knox provides the foundation.
Operator declares: 'I, operator X, captured facility Y at timestamp T, this scene is the unmodified output of capture session S.' Signed digest committed alongside the scene-file hash.
Bonis is the audit primitive. Never the operator.
- The operator captures. Their facility, their device, their capture app — Polycam, Luma, Scaniverse, KIRI, or any other. Bonis does not select the capture vendor.
- The operator uploads. To a Bonis-instrumented surface or to their own surface via the Knox API.
- Bonis hashes and anchors. The canonical bytes get a SHA-256 commitment, the operator attestation gets a signed digest, the metadata bundle gets a hash. The chain commits.
- Bonis never operates the device. Never captures facilities, never operates cameras / drones / phones, never mutates the scene file, never stores raw capture data unredacted.
- Lawful authority decides what to do with the evidence. Courts, regulators, FDA inspectors, state-CRA auditors, IG offices, plaintiff counsel, defense counsel, insurance carriers. Bonis provides the audit primitive; the verdict is the court’s.
A cryptographic flight-data recorder for the physical facility.
Differentiated from C2PA by structured event taxonomy plus self-authentication architecture. Differentiated from notarization by per-capture cost plus automated chain. Differentiated from spatial-capture vendors by audit-permanence layer. Differentiated from raw OpenTimestamps by operator attestation plus verify endpoint plus admissibility framework.
Per-capture receipt for every facility walkthrough. Spatial integrity attestation independent of the capture vendor. Self-authenticating record at commodity capture cost.