Phase (a) of docs/DESIGN.md:
- Postgres DDL template and renderer: write-once triggers on the core
audit tables and worm_audit_* tables, lookup id/name protection, the
SECURITY DEFINER retention purge (call-stack guarded, chain prefix only,
recorded) and the INSERT/SELECT-only grant model;
- capability guard and a clear write-once error;
- RFC 8785 canonical audit content, a single-writer chainer (advisory
lock, settle horizon, contiguous ids, late arrivals and late details),
Ed25519 checkpoints with Merkle roots;
- a paged verifier naming the exact break, the Verify audit chain table
action, and the daily verification with QAlerts break/heartbeat;
- the assistant deny pattern for worm_audit_* (reflective until RC.6);
- tests: Postgres Testcontainers (triggers, grants, purge, tamper,
concurrency, time zone), PHI canary, chain and checkpoint units.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
james.maes
