The ledger has no external anchor

[M-ballabio1]

The ledger is hash-chained and tamper-evident against edits, deletions and reordering. It is not evident against someone with write access rebuilding the chain wholesale — every link would be valid, because they were all recomputed.

Wanted. An anchor outside the machine that holds the ledger, so a rebuilt chain does not match something already published. Periodic publication of the head hash to an append-only external location is the cheap version; anything stronger is a design decision worth arguing in an ADR rather than picking here.

Until this exists, the honest phrasing is "tamper-evident to anyone without write access", and the README should say that if this stays open long.

Source: README, "What is built, and what is not".

[M-ballabio1]

The value to anchor is already computed and already named as such. runner/audit/ledger.py:249:

@property
def head(self) -> str:
    """Hash of the last entry — the value worth anchoring externally."""

and the module docstring already lists the external anchor among the things the HLD leaves open. So this issue is not missing a design, it is missing a destination and a publisher — plus the one piece nobody thinks about until it is needed, which is the verifier.

Three parts, and the third is the one that decides the shape of the other two.

1. A publisher: periodically read head, publish it.
2. A destination that is append-only to us and not writable by whoever holds the ledger.
3. A check that takes a ledger and a published history and reports whether the chain that exists today is the chain that was published. Without this, anchoring produces evidence nobody can evaluate, which is worse than none — it looks like a guarantee.

Working backwards from (3) constrains (2) usefully: the verifier needs the published heads to be retrievable and ordered, which rules out several otherwise appealing destinations. It also means the anchor should carry (seq, head, timestamp) and not just the hash — a bare hash tells you a chain existed, not where in it you are, so a rebuilt-and-truncated chain would still match an old anchor.

Worth splitting off now, cheaply. The issue ends with:

Until this exists, the honest phrasing is "tamper-evident to anyone without write access", and the README should say that if this stays open long.

It has stayed open long enough. That correction costs one sentence, depends on nothing here, and should not wait for the anchor — the README currently makes the stronger claim, and this issue is the record that we know it is stronger. I would do that as a separate small PR rather than leaving it bundled, because bundling it means the honest phrasing ships only if the feature does.

Labelled needs-decision for part (2). The candidates differ by more than convenience — a public transparency log, a customer-held witness, and a notary each imply a different answer to "who is this evidence for", and on a sovereignty product that is not a detail: an anchor published to a service outside the operator's jurisdiction is a small, permanent egress of metadata about when work happened, which is exactly the class of leak this project exists to make visible. That belongs in an ADR, as the issue says.