How does CueCrux produce a verifiable record of what an agent fleet did?

The Crux Daemon signs a CROWN receipt (Ed25519) for every state mutation an agent performs, and chains each receipt onto a BLAKE3 append-only spine. That gives the trail two properties logs never have:

1. It cannot be quietly edited. Changing, inserting, or removing any record breaks the chain visibly.
2. It verifies offline. corecruxctl verify-store checks a whole store; an exported trail verifies on someone else's machine with no network and no CueCrux account. Tamper rejection on that flow is a release-blocking CI gate.

Because every connection binds to a passport, each receipt also resolves to who acted, at what trust tier, under which grants. "Prove every one" is meant literally: the proof is the mechanism, not a report generated after the fact.