Rows checked (24h)
7,692
sequence intact
Signatures valid
7,676
0 invalid · 0 unverifiable
Unchained rows
130
arrived outside the chain
Agents seen
6
1,565 tool calls · 1161 model calls
intact — the sequence
GET /v1/evidence/verify?period=24h 7,692 rows, hash-chained in order, none altered after they were written. Proves nobody edited history. Does not prove who wrote it.
signature_valid_rows — the author
same response 7,676 rows signed inside the process that acted, each chaining to the tenant's trust root. Proves authorship. The two are independent — a chain can be intact and unsigned, or signed and broken.
Recent rows
GET /v1/evidence?tenant_id=pivot-demo&limit=12| Recorded | Event | Process | Service | Decision | Control | Signed |
|---|---|---|---|---|---|---|
| 00:16:38 | tool_call_allowed | …/denial-review-orchestrator/main/proc-1151811 | aws_s3 | allow | soc2 CC6.1 | |
| 00:16:30 | tool_call_allowed | …/policy_reviewer/main/proc-1151652 | aws_s3 | allow | soc2 CC6.1 | |
| 00:16:17 | tool_call_allowed | …/denial-review-orchestrator/main/proc-1151535 | aws_s3 | allow | soc2 CC6.1 | |
| 00:16:10 | tool_call_allowed | …/denial-review-crew-a2a/main/proc-998763 | aws_s3 | allow | soc2 CC6.1 | |
| 00:16:10 | a2a_call_allowed | spiffe://agents.hexr.cloud/pivot-demo/hexr/hexr-a2a-sidecar/a2a-gateway/proc-998872 | hexr-a2a-sidecar | allow | soc2 CC6.1 | |
| 00:13:07 | tool_call_allowed | …/denial-review-orchestrator/main/proc-1149635 | aws_s3 | allow | soc2 CC6.1 | |
| 00:12:56 | tool_call_allowed | …/denial-review-orchestrator/main/proc-1149505 | aws_s3 | allow | soc2 CC6.1 | |
| 00:12:47 | tool_call_allowed | …/denial-review-orchestrator/main/proc-1149397 | aws_s3 | allow | soc2 CC6.1 | |
| 00:12:40 | tool_call_allowed | …/denial-review-crew-a2a/main/proc-998763 | aws_s3 | allow | soc2 CC6.1 | |
| 00:12:40 | a2a_call_allowed | spiffe://agents.hexr.cloud/pivot-demo/hexr/hexr-a2a-sidecar/a2a-gateway/proc-998872 | hexr-a2a-sidecar | allow | soc2 CC6.1 | |
| 00:09:37 | tool_call_allowed | …/denial-review-orchestrator/main/proc-1147543 | aws_s3 | allow | soc2 CC6.1 | |
| 00:09:30 | tool_call_allowed | …/denial-review-orchestrator/main/proc-1147329 | aws_s3 | allow | soc2 CC6.1 |
10 of 12 recent tool calls allowed. The refusal is the unregistered process asking for the same credential: it has no identity to sign with, so the row cannot be attributed — and that absence is the finding.