Tamper-evident event log + provenance
The audit trail isn't a log you keep after the fact — it's the substrate the product runs on, and it catches an agent's output disagreeing with reality before that output ever reaches your repo.
How it works
Each event links to the one before it, so a rewritten history is detectable, not just theoretically possible.
The chain can be verified on demand, with a tamper-evidence indicator surfaced directly on the Event Log page.
The activity log filters, searches, and paginates with full event detail — per project for members, and tenant-wide (including the governance stream) for an admin running an audit.
A coding agent's claimed diff and the actual diff in the sandbox are captured separately and cross-checked against each other.
A mismatch never gets silently reconciled — the proposal is blocked and flagged as possible tampering for a human to look at.
The agents behind it
Human control
Cross-check failures block the proposal gate outright — there is no automatic reconciliation path, by design.