The signed audit stream. Every state change emits a Vault-Transit-signed, hash-chained entry (ADR-0014) fanned to observability — tampering breaks the chain.
- 09:41:02
deploy.saga.startedapp/storefront
you@acme.ioSS-470x9f21…c4 - 09:40:55
image.admittedregistry/storefront:sha-8e1
ci@acme.ioSS-040x71ab…09 - 09:38:14
bucket.versioning.enabledbucket/assets
you@acme.ioSS-020x33cd…8f - 09:31:47
slo.evaluate-and-routeslo/checkout-latency
systemSS-060x0a44…12 - 09:22:03
apikey.createdkey/ci-deploy
kai@acme.ioSS-010xbe90…7a - 09:15:38
cred.rotateddb/orders
systemSS-050x5512…e3 - 08:58:12
case.containedfinding/anomalous-login
secopsSS-280xa7f1…44 - 08:44:29
claim.restoredb/orders @ 08:10
you@acme.ioSS-020x2c8d…b1