Audit Chain Integrity

What this package supports

A retroactive migration (20260507c) updated two label columns on historical CrewOS audit events; an audit-chain verifier flagged it (20 mismatches, 1,142 broken links); the investigation showed the touched columns were outside the hashed payload so chain integrity was intact; and the response was promoted into a fleet-wide operating standard plus Caliber criterion C49, with red/green fixtures. (Articles: foundational "When a CrewOS failure became a fleet-wide control"; technical companion §10.)

Proves

the payload boundary is real and checkable (payload-boundary.sql — 15 hashed columns, labels absent); the discipline exists as canonical doctrine (audit-chain-integrity-standard.md); the rule is mechanically enforced (c49-contract.md); and the enforcement is tested across allowed, forbidden, warned, and grandfathered cases (c49-fixture-matrix.md).

Does not prove

that the verifier's specific run counts (20 / 1,142) can be re-executed from this package — that run was against the foundryos-test sandbox on 2026-05-01 and is recorded in internal governance docs, not reproducible here. It also makes no claim about any production customer data: the affected rows were sandbox-only and were swept on tear-down.

↓ Download package (.zip)

8 files · 9.4 KB Every artifact, the manifest, checksums, and the full README — one archive.

Inside the archive — 8 files, 15.9 KB

File Size
artifacts/audit-chain-integrity-standard.md 2.6 KB
artifacts/c49-contract.md 1.9 KB
artifacts/c49-fixture-matrix.md 1.6 KB
artifacts/payload-boundary.sql 1.7 KB
checksums.txt 637 B
manifest.json 2.2 KB
README.md 3.0 KB
source-summary.md 2.2 KB

Full package README — claim, source provenance, redaction statement, reproduction

Claim supported: A retroactive migration (20260507c) updated two label columns on historical CrewOS audit events; an audit-chain verifier flagged it (20 mismatches, 1,142 broken links); the investigation showed the touched columns were outside the hashed payload so chain integrity was intact; and the response was promoted into a fleet-wide operating standard plus Caliber criterion C49, with red/green fixtures. (Articles: foundational "When a CrewOS failure became a fleet-wide control"; technical companion §10.)

Claim IDs: E1-C001, E1-C002, E1-C003, E1-C004 Evidence level: fleet-codified (installed → enforced → exercised → outcome → fleet-codified) Access classification: Sanitized public excerpt

What this package proves, and what it does not

Proves: the payload boundary is real and checkable (payload-boundary.sql — 15 hashed columns, labels absent); the discipline exists as canonical doctrine (audit-chain-integrity-standard.md); the rule is mechanically enforced (c49-contract.md); and the enforcement is tested across allowed, forbidden, warned, and grandfathered cases (c49-fixture-matrix.md).

Does not prove: that the verifier's specific run counts (20 / 1,142) can be re-executed from this package — that run was against the foundryos-test sandbox on 2026-05-01 and is recorded in internal governance docs, not reproducible here. It also makes no claim about any production customer data: the affected rows were sandbox-only and were swept on tear-down.

Source

Redaction statement

No secrets, credentials, private URLs, or customer/staff/tenant identifiers appear in these artifacts. The sources are framework scaffold SQL, scanner logic, fleet doctrine, and synthetic test fixtures. The one incident-specific identifier retained — the foundryos-test sandbox account name — is an internal test account, not a customer tenant, and is load-bearing for the claim (it establishes that no production data was involved). See manifest.json → redactions.

Reproduction