No unattributed fact
NewEntry::new requires provenance by value, with no Default and no Option. There is no path to a ledger entry that does not say who asserted it, when, and how.
Compile-time guarantees
Promises encoded in the type system.
Three commitments are not policies someone must remember. They are types. If a future contributor tries to violate them, the crate does not compile.
No unexplained score
The 300–850 value is computed from contributions. Passing a number without the per-factor breakdown is not something the API allows.
No medical scoring
The scoring engine consumes ScorableFacts, whose only constructor filters medical entries out. Inquiries are absent the same way, so no model configuration can reintroduce an inquiry penalty.
Append-only, four ways
The application role cannot update or delete. Triggers reject UPDATE, DELETE, and TRUNCATE. Every row is hash-chained over every field. Signed Merkle checkpoints make drift visible between audits.
Only the hash chain and the checkpoints survive full database compromise, which is why the ledger verifies every row it reads and exposes no unchecked accessor.