Hash chain evidence audit

Key features

• It can make edits to retained records, untouched-prefix removal, broken links, and partial final lines detectable when the existing file is verified.
• Leave a locally checkable execution trail without storing prompts, tool arguments, tool results, or session IDs in plaintext.
• It can show that this observer saw specific event categories and hashes in a particular local sequence.
• It cannot prove that a command ran correctly, that a result was truthful, who produced the file, or that a valid suffix was not deleted.
• Its hashes are not redaction, encryption, digital signatures, or an external trust anchor.