Re-derives a hashChainedAuditSink trail: every line's hash must recompute over its
own bytes and its prev must name the prior line's hash. The preimage is the literal line
text minus its hash suffix, so verification needs no re-serialization to agree with the
writer. Stops at the first break: count is how many records verified before it, and
nothing after the break is checked. make audit-verify FILE=<jsonl> runs this over a trail
file from the command line.
The
./opsentry point: an in-process supervisor over the lab's meter/logger ports. The dependency runs one way — ops imports the core, the core never imports ops (eslint enforces it) — and leaving the supervisor out of the composition is the off switch.See
The supervisor for the tier model, the signal path, and the per-signature runbooks.