Audit Log
Append-only, hash-chained. Every mutation by the engine produces an audit row in the same transaction — if the audit write fails, the mutation rolls back.
Chain Valid0 entries verified — SHA-256 hash chain intact
Immutability enforced at DB level. The SQLite schema has triggers that raise on UPDATE or DELETE of any audit_log row. The hash chain allows independent verification — recompute sha256(prev_hash + canonical(row)) for each row and compare against row_hash.
No audit entries yet. Entries appear as soon as the engine processes its first mutation.