layer: L4

name: Audit

code_anchor: api/ainfera_api/services/audit.py

standards: Sigstore-witnessed · hash-chained · EU AI Act Annex IV compatible

public_endpoint: api.ainfera.ai/v1/audit/public

L4 — Audit

Purpose

Hash-chained, Sigstore-witnessed AuditEvents. Every inference, cap violation, key rotation, AAMC vote — appended to an append-only chain. Verifiable offline (no Ainfera trust required).

Append-only discipline (LOCKED)

• No backfill of historical rows.
• Forward-only flips with signature_status: pre_v1.8 marker on legacy rows (for Phase 6 signed-sender migration).
• Each event has: event_id, seq, event_type, tenant_id, agent_id, payload_hash, previous_hash, event_hash, signed by HMAC + Sigstore witness.

Public endpoint

• GET <https://api.ainfera.ai/v1/audit/public?limit=N> — returns hash-chained events
• Public mirror at T+30 (delayed 30s for safety)
• Verifiable offline via Sigstore + receipt hashes

EU AI Act Annex IV

L1–L5 maps as lead must-have. Aug 2, 2026 enforcement. Penalties: €35M/7% global turnover for prohibited; €15M/3% other; €7.5M/1% incorrect info per Article 99.