Most audit logs are a table anyone with database access can quietly edit. goca's is designed to be proven, not just read — three layers, each covering what the previous cannot.
Layer 1 — the hash chain. Every entry's hash covers the previous entry's hash plus its own fields. That proves alteration, deletion or reordering of any entry except the newest — no log can prove absence from inside itself.
Layers 2 and 3 — Merkle tree with signed checkpoints. Every five minutes the system signs a checkpoint: the Merkle root over the whole log, the tree size, the newest covered entry — chained to the previous checkpoint and signed by a dedicated Ed25519 audit key, never a CA key. That proves tail truncation: deleting entries a signed head covered becomes an arithmetic contradiction, including a fully wiped log. Exposure is bounded by cadence — entries newer than the latest head are protected only by the chain for a few minutes, and you can force a checkpoint before an export.
What is recorded: every management-plane mutation plus authentication events, each with actor, action, object, timestamp. Legacy entries from before the verifiable format are reported unverifiable — deliberately never as tampering.
Now I can name the three layers and what each one proves.