Audit Log Service  ·  View 23 of 40  ·  5 · Runtime

Verification

Six stages from a request to a verdict — and why the verdict is never a boolean.

Editable source SVG draw.io All views
Trigger On-Demand Range 24 h in ≤ 90 s Rolling Sweep full corpus / 7 days Export Trigger before every bundle Fetch Segment List from registry Object Bytes read-only role Checkpoints from the ledger Recompute Leaf Hashes canonical bytes Merkle Roots per segment Head Chain per tenant Compare Root vs Header segment integrity Head vs Checkpoint ordering integrity Signature + Token authenticity, time Verdict Intact Through named segment, time Broken Here first divergence named Lawfully Disposed under certificate X Respond Divergence Alert ≤ 15 min Index Repair automatic, from segments Segment Incident never auto-repaired page security result is a record Verification — Intact, Broken Here, or Lawfully Disposed Application we own Security / platform Data store Decision point Opportunity Risk / gap failure / alternate event / async The verdict is never a bare boolean. Intact carries the segment and timestamp it is intact through; broken carries the first divergence and its position; disposed carries the certificate that authorised it. An auditor can act on all three and on none of a true/false. v 1.0 · owner Data & AI Global Practice · date 2026-09

Decisions

  • The verdict names something. Intact carries the segment and timestamp it is intact through; broken carries the first divergence, its segment and its time; disposed carries the certificate that authorised it. An auditor can act on all three and on none of a true/false.
  • Index divergence is repaired automatically from segments and is routine. Segment divergence is repaired by nobody and is an incident. That distinction is the architecture in one line.
  • Verification runs before every export, so a bundle can never be issued over a range that has already failed.

Targets

  • Chain verification of a 24-hour range ≤ 90 s.
  • Rolling full-corpus verification completes every 7 days; divergence is alerted within 15 minutes of detection.
  • Verification and export plane availability ≥ 99.5% — deliberately the lowest target in the set, because a verification that is late is not a verification that is wrong.

Risks

  • A seven-day sweep means an undetected segment tamper can persist for up to seven days unless an export or an on-demand verification touches that range first. Shortening the cycle is a compute cost decision; the number should be revisited once real corpus growth is known.
◀  An Investigative Query All views Evidence Bundle and Offline Verification  ▶
Solution Architecture v1.0 · Data & AI Global Practice · 2026-09 · 40 views · Microsoft Azure and open source23-verification-flow