tracking: externally verifiable audit log (anchoring, coverage, format, retention)

[MastaP]

Summary

Tracking issue for making Astrid's audit log externally verifiable: its
history anchored on an independent ledger (AOS uses the Unicity aggregator),
and its contents complete and precise enough to support claims about what an
agent did.

Motivation

Astrid's audit log is signed and hash-linked, which makes it tamper-evident
only to parties who do not hold the runtime key. External anchoring removes
that limit for history already written. It is only as useful as what the log
records, and how completely and precisely it records it. The steps below are
ordered by how much they add.

Proposed Implementation

• feat(audit,cli): signed chain-head snapshot and raw chain export for external anchoring #1995 / feat(audit): signed audit.heads snapshot and paged audit.export #1996: signed chain-head snapshot and raw chain export (the
  interface for anchoring and verification)
• feat(audit): record LLM/HTTP exchanges, tool calls, approvals, capability changes and capsule loads #1998: record agent-significant events: LLM/HTTP exchanges, tool
  calls, approvals, capability changes, capsule loads
• fix(audit): make host-audit recording ordered and loss-accounted #1999: ordered, loss-accounted host-audit recording
• feat(audit): canonical, fully signed entry format (v2) with registered-key verification #2000: canonical, fully signed entry format (v2) with registered-key
  verification
• feat(audit): retention that never deletes history that has not been anchored #2001: retention that never deletes history that has not been
  anchored

Later, to be discussed:

• Capsule access. A capsule-based anchoring service calling audit.heads
  and audit.export under a capability grant (distro-level grant or admin
  routing change).
• Replay. Deterministic-replay prerequisites for re-executing recorded
  capsule steps: wasmtime determinism settings, host-call record/replay,
  instance model, persistent bus order. Relates to Proof-carrying execution receipts over causal observations and state transitions #1367.

Alternatives Considered

Waiting for the native audit root (#1759). It is the long-term root of trust
for the native kernel, but it doesn't cover the hosted runtime AOS ships today.
The steps above apply to the hosted runtime and would carry over.

Related: #678, #683, #693, #675, #1367, #1542, #1759.

[MastaP]

Pull requests for this series, in the proposed merge order:

1. feat(audit): signed audit.heads snapshot and paged audit.export #1996: signed audit.heads snapshot and paged audit.export (feat(audit,cli): signed chain-head snapshot and raw chain export for external anchoring #1995)
2. feat(audit): retention that never deletes unanchored history #2002: retention that never deletes unanchored history (feat(audit): retention that never deletes history that has not been anchored #2001). Stacked on feat(audit): signed audit.heads snapshot and paged audit.export #1996; its diff includes feat(audit): signed audit.heads snapshot and paged audit.export #1996's commits until that merges.
3. fix(audit): make host-audit recording ordered and loss-accounted #2003: ordered, loss-accounted host-audit recording (fix(audit): make host-audit recording ordered and loss-accounted #1999)
4. feat(audit): record HTTP exchanges, tool calls, approvals, capability changes and capsule loads #2004: recording coverage for HTTP exchanges, tool calls, approvals, capability changes and capsule loads (feat(audit): record LLM/HTTP exchanges, tool calls, approvals, capability changes and capsule loads #1998)
5. feat(audit): canonical, fully signed entry format (v2) with registered-key verification #2005: entry format v2 with registered-key verification (feat(audit): canonical, fully signed entry format (v2) with registered-key verification #2000)

#2003, #2004 and #2005 are each based on main and independent of the others. #2003 and #2004 both touch the host-audit writer, so whichever lands second is rebased onto the other.

[joshuajbouw]

Updated the five checkboxes to reflect the merged source work: #1996, #2004, #2003, #2005 and #2002 respectively. The v2 export-hash correction also landed in #2012 today. This records what is on main, not a release or an operational external-anchoring claim. Capsule access and replay remain the separate, later discussion already described above.