verify_audit
Verify every audit chain read-only and report where each first breaks, returning the seq of the first altered record per plan and for the host chain.
Instructions
Verify every audit chain and report where each one first breaks.
Read-only: nothing is appended, rewritten or repaired. The answer is
{"ok": True, "plans": {<plan>: None | <bad seq>}, "host": None | <bad seq>}. A plan appears only when it has an audit file; the value is the
seq of its first altered record, or None when the chain is intact.
The host-scoped chain — events with no plan to belong to, such as a host
config write — is verified the same way and reported under host.
A chain with no externally recorded head cannot prove that trailing records
were not removed, so truncation of the tail verifies intact. When
PIPELINE_AUDIT_ANCHOR names a sink, the answer gains an anchor
mapping from the same chain names to this tool's tamper verdict for each
one, which is what catches a cut tail. If the anchor log itself cannot be
read, that mapping holds a single * entry with an anchor log unreadable verdict: the anchors are unknown, so no chain is reported
clean.
Tool call template
This tool declares no required parameters. Add optional parameters from the input schema as needed.
{
"id": 1,
"jsonrpc": "2.0",
"method": "tools/call",
"params": {
"arguments": {},
"name": "verify_audit"
}
}Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
No arguments | |||
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
No arguments | |||