Expand description
The independent auditor (“the gatekeeper’s gatekeeper”).
Reads a repository (the daemon’s store, a pushed remote or a CI checkout) without writing to it and checks that:
- the operation log is an unbroken, correctly signed hash chain whose time never goes backwards;
- every decision is reproduced by the decision function from the state before it and the policy in force at that point;
- every recorded fact set equals the facts recomputed from the Git objects, and every merged commit equals the recomputed merge, both with the symbol engine version recorded in the entry;
- every daemon key switch (
daemon.rotate,daemon.recover) was authorised: its decision replays as allowed, so a forged human signature can not move the log to another key; - trunk and policy refs equal the replayed state;
- (
compare) a pushed log is a prefix of the local one, so history that was published can not be rewritten unnoticed.
It contains no AI and calls no network.