intact — the sequence

GET /v1/evidence/verify?period=24h

8,322 rows, hash-chained in order, none altered after they were written. Proves nobody edited history. Does not prove who wrote it.

signature_valid_rows — the author

same response

8,004 rows signed inside the process that acted, each chaining to the tenant's trust root. Proves authorship. The two are independent — a chain can be intact and unsigned, or signed and broken.

Recent rows

GET /v1/evidence?tenant_id=pivot-demo&limit=12

Recorded	Event	Process	Service	Decision	Control
22:00:03	tool_call_allowed	…/denial_writer/main/proc-1925198	aws_s3	allow	soc2 CC6.1
21:59:49	tool_call_allowed	…/policy_reviewer/main/proc-1925113	aws_s3	allow	soc2 CC6.1
21:59:40	tool_call_allowed	…/claims_analyst/main/proc-1924999	aws_s3	allow	soc2 CC6.1
21:59:33	tool_call_allowed	…/denial-review-crew-a2a/main/proc-1920949	aws_s3	allow	soc2 CC6.1
21:59:33	a2a_call_allowed	spiffe://agents.hexr.cloud/pivot-demo/hexr/hexr-a2a-sidecar/a2a-gateway/proc-1921033	hexr-a2a-sidecar	allow	soc2 CC6.1
21:56:29	tool_call_allowed	…/denial_writer/main/proc-1923095	aws_s3	allow	soc2 CC6.1
21:56:22	tool_call_allowed	…/policy_reviewer/main/proc-1922957	aws_s3	allow	soc2 CC6.1
21:56:09	tool_call_allowed	…/claims_analyst/main/proc-1922812	aws_s3	allow	soc2 CC6.1
21:56:00	tool_call_allowed	…/denial-review-crew-a2a/main/proc-1920949	aws_s3	allow	soc2 CC6.1
21:55:58	a2a_call_allowed	spiffe://agents.hexr.cloud/pivot-demo/hexr/hexr-a2a-sidecar/a2a-gateway/proc-1921033	hexr-a2a-sidecar	allow	soc2 CC6.1
21:51:53	a2a_call_allowed	spiffe://agents.hexr.cloud/pivot-demo/hexr/hexr-a2a-sidecar/a2a-gateway/proc-1154627	hexr-a2a-sidecar	allow	soc2 CC6.1
21:48:53	tool_call_denied	…/denial-review-orchestrator/main/proc-1154546	aws_s3	deny refused: this process has no identity	soc2 CC6.1

8 of 12 recent tool calls allowed. The refusal is the unregistered process asking for the same credential: it has no identity to sign with, so the row cannot be attributed — and that absence is the finding.