Audit trail

453 rows, each one hashed into the next.

Every decision is written here before it is acted on. The chain rule is hmac-sha256(key, prev_hash ‖ payload), so editing any historical row breaks every hash after it and verification reports the first broken index rather than a bare pass or fail. A log that can be quietly revised afterwards is not an audit trail.

It is keyed rather than plain, because a plain chain catches an accident and nothing else: anyone who can write to the database can recompute every hash after their edit and the result verifies clean. Unset, the key falls back to a published constant and verification reports tamper-evident rather than tamper-proof, in those words — a clone must run out of the box, and it must not claim a protection it does not have.