decern-ledger — the tamper-evident decision ledger (the audit column).
Every authority decision is appended as a hash-chained, Ed25519-signed
record: hash = SHA-256(entry_bytes ‖ prev_hash), signature over hash.
Any edit, reorder or in-place deletion breaks the chain; a wholesale
rewrite fails signature verification against the ledger key. What the
chain alone cannot detect is truncation of the tail — that is what
root() is for: export the head hash and anchor it externally (a
regulator, a notary, another system). Anchored root + intact chain =
complete, unmodified history.
The chain hash covers the EXACT entry bytes as stored on disk (captured
via serde_json's RawValue at verify time), never a re-serialization — so
byte-stability is structural, not an assumption about JSON round-trips.
(Float round-tripping is NOT stable in serde_json without the
float_roundtrip feature; hashing re-serialized bytes was a confirmed
false-tamper bug that could brick an honest ledger.)