Audit Log Service · View 16 of 40 · 4 · Data
Decisions
- The tombstone is the load-bearing entity. It keeps the Merkle root and the certificate reference after the bytes are gone, so a disposed range verifies as lawfully disposed rather than as tampering.
- The disposal certificate is written back into the log as an ordinary audit record with its own event_id. Deletion is a governed, evidenced act, and the evidence lives in the thing it deleted from.
- An evidence bundle references checkpoints rather than containing the whole chain, which is what keeps a bundle for a thousand records measured in megabytes rather than gigabytes.
Model notes
- object_digest binds the immutable blob's bytes to the merkle_root, so an altered object is detectable without recomputing every leaf.
- prev_root in the segment header is what makes removal detectable: taking a segment out invalidates every hash after it.
- Inclusion proofs are materialised on demand rather than stored — they are a function of the segment and the checkpoint, and storing them would be a third copy to keep consistent.
Omitted here
- Proof of non-existence over a covered range is phase 3 and needs the absence filters shown on view 14; the model above supports it without change.
