Every CA has an audit log. Ask the harder question: when the auditor reads yours, what proves nobody with database access trimmed it first? goca's log is designed to be proven, not just read.
Three layers, each with a stated claim. A hash chain proves no entry was altered, deleted, or reordered — every entry but the newest, because no log can prove absence from inside itself. A Merkle tree with signed checkpoints — signed every five minutes by a dedicated audit key — proves tail truncation: deleting entries a signed head covered becomes an arithmetic contradiction, up to and including a fully wiped log. And verification is a call, not a ceremony: GET /v1/audit/verify on demand, plus a background check every five minutes whose verdict the status surface reports honestly — before the first run it answers never-verified, never "intact".
You'll run the verifier yourself in Revocation, Notifications & Audit.