Hash-chained · twice-signed

The substrate
remembers.

Spawn, kill, capability change, scale event, egress denial, policy violation — every meaningful event enters a per-tenant audit chain. Each entry is hash-linked to the previous, signed by both the brane and the substrate operator, and optionally anchored to a Sigil chain for external long-term verification.

[chain]
BLAKE3 · per-tenant
[signing]
Ed25519 · brane + substrate
[anchor]
Sigil chain · optional
[retention]
manifest-declared · GC-enforced
At a glance

The properties
that matter.

record
CBOR-canonical · timestamp · event kind · brane DID · payload hash
link
BLAKE3 hash of (prev_link || record). HEAD is published per-tenant.
signing
brane signs; substrate co-signs at insertion. two ed25519 sigs per record.
anchor
Optionally publish HEAD to a Sigil chain block — third-party verifiable forever.
query
ω audit walk · filter by brane / event kind / time range / signature.
retention
Manifest declares retention; GC enforces; Sigil-anchored HEADs survive GC.
In operation

What it
looks like running.

$ω audit head
tenant did:omega:tenant:l1fe.ai HEAD b3:9af2c8e7d3f1... length 1,283,442 last record 2026-05-01T14:18:11Z last anchor sigil:omega-audit/block/18,221 (12s ago)
$ω audit walk --since 1h --kind cap.change
2026-05-01T13:42:18 brane.api add net.http allowlist += [api.next.com] 2026-05-01T14:01:04 brane.archive remove fs.local 2026-05-01T14:11:33 brane.score ttl 30m → 5m (tightened)
By design

What you
can rely on.

Brane + substrate both sign

Either signature alone is suspect. Both together prove the brane authored the record AND the substrate received it intact.
TWO-SIG

Sigil-anchored if you want forever

Anchoring HEAD to a Sigil block makes the chain auditable from outside the substrate. We can't rewrite history, even if we wanted to.
ANCHOR

Tenant-scoped, exportable

`ω audit export` writes the entire chain to a signed CBOR file. Move tenants between substrates with continuity of audit.
PORTABLE

BLAKE3 + CBOR · negligible overhead

Insertions are O(1). Verification is parallelizable per-segment. A 10M-event chain verifies in under 4 seconds on commodity hardware.
EFFICIENT