Instance-ledger kernel: signed, hash-chained, append-only history (SPEC-003 v1)

[IanFrelinger]

The kernel that will let ashlar verify say CERTIFIED with a real signature instead of VERIFIED · unsigned. An append-only, hash-chained, signed history under .ashlar/ledger/ — the read side of the same trust model the gate store (#386–#388) writes.

What landed (src/ + docs/ only — kernel-first, clean layer gate)

• InstanceLedger — one Ed25519-signed JSON entry per verification, each carrying Prev = the hash of its predecessor's canonical bytes. VerifyChain checks contiguous sequence, every signature, and every link, and throws (fail-closed) on any break; append verifies the existing chain before extending it, so a fresh entry can't bury a broken one. Verification is intrinsic — a keyless reader validates the whole chain.
• Reuses the gate store's proven shapes: a FileShare.None cross-process append lock, temp-then-rename writes, fail-closed reads, and the SPEC-006 CanonicalJson + Ed25519 machinery.
• docs/InstanceLedger.md — the on-disk format and an honest integrity statement.

Honest v1 scope (documented, not pretended)

• Tail truncation isn't detectable without an external anchor — v2; guarded meanwhile by the policy's truncate_ledger never-entry.
• The signer is the local operator key, not an org trust root — v2 (SPEC-006). The signer is deliberately not pinned across entries, so a key rotation is legitimate.

Review + verification

Adversarially reviewed across four lenses (chain integrity, canonicalization/hash determinism, append race, fail-open) — zero confirmed bugs. Applied its refuted-but-worthwhile hardening: collision-proof Subject (hash each document then combine), numeric file ordering with a foreign-file fail-close, a File.Move collision folded into the fail-closed contract, and stray-temp sweeping under the lock. 11 ledger tests (genesis, chaining, tamper/gap/reorder/foreign-file refusal, keyless read); kernel signing tests unaffected.

Next

The wiring slice: a provenance course in ProjectVerifier that runs VerifyChain, verify appending a signed entry on success, and the CERTIFIED display in VerifyCommand.