The audit log

vaigil auditlog verify
vaigil auditlog show SEQ
vaigil auditlog prove SEQ
vaigil auditlog head --save
vaigil auditlog consistency

Every change is a record in a hash chain, with a Merkle tree over it. A tree head is signed with Ed25519 and ML-DSA (post-quantum), and prove gives a receipt anybody can check against a head.

Anchoring#

vaigil auditlog anchor submit
vaigil auditlog anchor upgrade
vaigil auditlog anchor status

The head is committed to Bitcoin through OpenTimestamps, so rewriting history is detectable by somebody who never trusted the operator.

Its own writer#

vaigil logd
vaigil logd status

Run as its own account, the log writer is the only process that writes the log, so the console cannot rewrite what it recorded. A decision that is nothing but its record is reported as failed when the record cannot be written.

Streaming to a SIEM#

vaigil config set siem.stream.url https://siem.example.com/ingest
vaigil siem stream key
vaigil siem stream status

Batches of OCSF, each following the last exactly, each carrying a signed tree head and an HTTP message signature (RFC 9421), so the receiver can prove nothing was dropped or changed. vaigil siem ocsf, cef and jsonl export the log as files.