audit

Requires the audit:read scope. Who sees what follows the audit trail's own rule rather than the ordinary role matrix: an OWNER, an ADMIN or an AUDITOR reads the whole trail of their own tenant, and everybody else reads their own events - transparency towards the employee rather than a lesser administrator's view. A request that names somebody else's actor_id without the right to the whole trail is refused, and the refusal is itself an entry. Filtering by period, action, actor, target, and outcome; cursor pagination.

A read that succeeds is not itself recorded. A trail that grew by being read would bury what it is for - the second page would contain the reading of the first - and reading is not among the events that must be recorded. What is recorded is the refusal, and the export.

Checks the hash chain and the absence of gaps over a period. Requires the audit:read scope and the right to the whole trail: a chain checked over one actor's entries would be a chain with every other entry missing, and would answer "broken" for a trail that is intact.

A clean check records nothing. A break is recorded as a critical entry of its own, because an auditor reading the trail months later has to be able to see that somebody noticed, and when.

External anchoring: once a day a job reads this workspace's chain end - the last sequence number and its hash - and writes it as hubtask-anchor-<tenant>-<YYYYMMDD>.json to the backup target named here, recording the row audit_anchor with the target as its destination and the object's digest as its receipt. :verify with anchors: true reads the last copy back and compares it. A null target switches anchoring off; the anchors already written stay. Needs STRUCTURE at the workspace - a workspace administrator - and is audited with the target before and after. The target is one of the workspace's own backup targets, so what is recommended for a tenant's target (object lock, a retention no shorter than the audit period) applies to it; an anchor is a few hundred bytes, so the lock can be long.

Requires the audit:export scope and the right to the whole trail. The archive is written to a backup target - JSON Lines or CSV, with a checksum manifest and the period it covers - because an export over four hundred days is not something a request can hold; this answers a JobRef and the work happens in the background.

The export produces an audit entry of its own. A copy of the evidence leaving the installation is itself an event an auditor asks about, and it is the first audit.* action the system records about itself.