Audit Log Service  ·  View 21 of 40  ·  5 · Runtime

Seal, Chain, Sign, Publish

One fifteen-minute checkpoint end to end, including what happens when the key service is unreachable.

Editable source SVG draw.io All views
Kafka Buffer Sealer Immutable Blob Chain Service Managed HSM Timestamp Authority Confidential Ledger 1. poll committed offsets, ordered 2. group by tenant · date · event class 3. close at 60 s or 256 MB, whichever first 4. PUT segment — create-only permission 5. object digest + immutable-until 6. merkle_root, prev_root, object digest 7. extend this tenant's head 8. sign checkpoint over all tenant heads 9. signature — key never leaves the HSM 10. timestamp request over checkpoint root 11. RFC 3161 token 12. append signed head 13. ledger transaction receipt 14. key-use event, back into the log Seal, Chain, Sign, Publish — One 15-Minute Checkpoint If the HSM is unreachable, messages 1 to 7 continue and 8 onwards pause: ingest never fails because sealing cannot proceed. The unsigned interval is visible in verification as pending, never as a break. v 1.0 · owner Data & AI Global Practice · date 2026-09

Decisions

  • The sealer holds create-only permission on the segment container. There is no code path in the custody plane that can overwrite an object it has just written, and no role that would let it.
  • The checkpoint is signed over every tenant head at once, so one HSM operation every fifteen minutes covers 500 chains. That is what keeps HSM cost fixed rather than proportional to tenants.
  • The RFC 3161 countersignature comes from a TSA outside this estate. A timestamp authority we operated would be a clock we could move, which is the same as having none.

Degradation

  • If the HSM is unreachable, messages 1 to 7 continue and 8 onwards pause. Ingest never fails because sealing cannot proceed — durability outranks freshness, and this is where that principle is actually enforced.
  • The unsigned interval is visible in verification as pending rather than broken, and is alerted at 30 minutes.
  • If the sealer dies mid-segment it resumes from the last checkpoint and re-seals the incomplete segment. It is never discarded, and the gap is visible in verification.

Numbers

  • Segment seals ≤ 60 s. Checkpoints every 15 min. One HSM sign operation per checkpoint per region.
  • Every use of the signing key emits a key-use record into this log, which means the log records the operations that make the log believable.
◀  Synchronous Ingest All views An Investigative Query  ▶
Solution Architecture v1.0 · Data & AI Global Practice · 2026-09 · 40 views · Microsoft Azure and open source21-seal-and-checkpoint-sequence