The audit trail is the algorithm.

// 01 payloadDigest — backend/services/hashChainService.js
function tracePayloadDigest(trace) {
  // Canonical view — excludes embedding (size) and deletedAt (mutable).
  const view = {
    traceId:         trace.traceId,
    organizationId:  String(trace.organizationId),
    agentId:         trace.agentId,
    inputContext:    trace.inputContext  ?? null,
    outputDecision:  trace.outputDecision ?? null,
    status:          trace.status,
    timestamp:       trace.timestamp.toISOString(),
    confidenceScore: trace.confidenceScore ?? null,
    // … plus 5 more fields: agentVersion, schemaVersion, rationale,
    //                        humanOverride, adapter
  };
  return sha256Hex(canonicalize(view));
}

// 02 chainHash — backend/services/hashChainService.js
async function appendTrace(orgId, trace) {
  const payloadDigest = tracePayloadDigest(trace);

  // Atomic single-writer-lock per org via Mongo $inc on hashChainCounter.
  const updated = await Organization.findByIdAndUpdate(
    orgId,
    { $inc: { hashChainCounter: 1 } },
    { new: true, projection: { hashChainCounter: 1, lastChainHash: 1 } }
  ).lean();

  const sequence  = updated.hashChainCounter;
  const prevHash  = updated.lastChainHash || GENESIS_HASH;  // 64 zeros
  const createdAt = new Date();

  const chainHash = sha256Hex(
    `${prevHash}|${payloadDigest}|${sequence}|${createdAt.toISOString()}`
  );

  // ... persist HashChainEntry, update Organization.lastChainHash
}

// 03 replay — backend/services/hashChainService.js
async function verifyChain(orgId, opts = {}) {
  const cursor = HashChainEntry.find({ organizationId: orgId })
    .sort({ sequence: 1 }).lean().cursor();

  let prevHash = null;
  let expectedSequence = null;
  let lastValidSequence = 0;

  for await (const entry of cursor) {
    // Sequence-monotonicity gap detection: a failed insert leaves the
    // counter incremented but no entry, so verify must catch the missing
    // sequence number, not just the prev-hash chain.
    if (expectedSequence === null) expectedSequence = entry.sequence;
    else if (entry.sequence !== expectedSequence) {
      return { verified: false, brokenAt: entry.sequence,
               brokenReason: 'sequence-gap', lastValidSequence,
               expectedSequence };
    }
    const expectedPrev = prevHash === null ? GENESIS_HASH : prevHash;
    if (entry.prevHash !== expectedPrev) {
      return { verified: false, brokenAt: entry.sequence,
               brokenReason: 'prev-hash-mismatch', lastValidSequence };
    }
    const recomputed = sha256Hex(
      `${entry.prevHash}|${entry.payloadDigest}|${entry.sequence}` +
      `|${entry.createdAt.toISOString()}`
    );
    if (recomputed !== entry.chainHash) {
      return { verified: false, brokenAt: entry.sequence,
               brokenReason: 'chain-hash-mismatch', lastValidSequence };
    }
    prevHash = entry.chainHash;
    lastValidSequence = entry.sequence;
    expectedSequence += 1;
  }

  return { verified: true, lastValidSequence };
}

{
  "verified":           true,
  "ok":                 true,
  "totalChecked":       17493,
  "lastValidSequence":  17493,
  "brokenAtSequence":   null,
  "brokenReason":       null,
  "durationMs":         842,
  "verifiedAt":         "2026-05-03T10:14:22.317Z"
}

You've seen four steps to a verdict, three guarantees that hold under attack, and a four-row comparison that makes the wedge concrete. Next: wire one trace, generate your own chain, export it, replay it offline. The first call lands at the engineer who wrote the chain — not at an SDR.