Context
Parent: #8828 (Phase 4 — trust surface). Decision records (sibling sub-issue) make individual verdicts legible; a hash chain makes the SEQUENCE tamper-evident: nobody can silently delete or reorder history without breaking the chain.
Requirements
- Append-only decision ledger: each row stores a monotonic sequence number, the previous row's hash, and its own hash = SHA-256(prev_hash ‖ seq ‖ canonical-JSON of the decision record's semantic fields). Contiguous migration for the table.
- A public verify endpoint that recomputes the chain from genesis (paginated/resumable for size) and reports the FIRST break, distinguishing: sequence gap, predecessor mismatch, row-hash mismatch.
- Writes ride the same path that persists the decision record — one transaction, no window where a decision exists unchained.
- Document the honest limitation in the module header: a self-operated chain is tamper-evident, not tamper-proof (wholesale rewrite by the operator remains possible); external anchoring (Sigstore/witness cosigning) is the tracked follow-up once tenants exist, per the epic's sequencing.
Test Coverage Requirements
99%+ patch coverage, branch-counted; verify endpoint tested against each corruption class (gap, predecessor, row-hash) plus the clean chain.
Expected Outcome
Any observer can verify no decision was deleted or altered after the fact — the property contributors and future tenants actually need, at ~1% of TEE's cost.
Context
Parent: #8828 (Phase 4 — trust surface). Decision records (sibling sub-issue) make individual verdicts legible; a hash chain makes the SEQUENCE tamper-evident: nobody can silently delete or reorder history without breaking the chain.
Requirements
Test Coverage Requirements
99%+ patch coverage, branch-counted; verify endpoint tested against each corruption class (gap, predecessor, row-hash) plus the clean chain.
Expected Outcome
Any observer can verify no decision was deleted or altered after the fact — the property contributors and future tenants actually need, at ~1% of TEE's cost.