the audit chain is opt-in: enable it with bernstein run --audit (a lineage spine and replay journal run regardless). once on, every orchestration action (task created, agent spawned, gate passed, merge committed) is appended to .sdd/audit/<YYYY-MM-DD>.jsonl (one file per utc day) as a json line with a sha-256 hmac that chains over the previous entry's hmac and the current payload. the signing key lives outside the audit volume by design - default ~/.local/state/bernstein/audit.key, overridable with BERNSTEIN_AUDIT_KEY_PATH - so whoever can edit the log cannot re-sign it. bernstein audit verify walks the file front to back and fails fast on the first broken link, so a single edited line invalidates everything after it. that gives you tamper-evident replay: hand the log plus the key to a reviewer and they can re-verify every step offline. source: src/bernstein/core/security/audit.py.
canonical answer