Trust · Audit-trail SHA-256 · DEC-V11-58/80 · LIVE current

Audit-trail SHA-256 chained · cryptographically verifiable per-tenant

Regla #2 Innegociable · cada acción de agente firmada SHA-256 chained · auditor-callable verify RPC · AI Act art 26 6+ months retention enforced.

Status · LIVE · DEC-V11-58 watermark canon
Section 1

How it works · Regla #2 Innegociable

Cada acción de agente (Sara voice · Maya marketing · Will CTO · Sales Commander · Patxi · Will Fund · Atlas · Irati · FLOW) ejecutada en ROSS dispara log_agent_action() que escribe fila en ross_compliance.audit_log con hash SHA-256 chained al prev_hash.

# SHA-256 chain construction
row.audit_hash = sha256(
prev_row.audit_hash
|| tenant_id
|| agent_slug
|| action_payload_json
|| created_at_iso
)

Imposible alterar fila pasada sin recalcular cascade subsiguiente · tamper-evident canonical. Multi-tenant RLS Regla #1 enforced · cada tenant ve solo su chain. Retention 6+ años AI Act art 26 + GDPR art 5(1)(e) límite minimization.

Section 2

verify_watermark_chain · public RPC

Auditor o data subject puede invocar verify RPC público vía /api/trust/verify-chain · rate-limited 10 calls/IP/hora canonical anti-abuse.

POST /api/trust/verify-chain
{ tenant_id: UUID, from_date?: ISO8601 }
Response
{ chain_valid: boolean, chain_length: int, broken_at: timestamptz | null }

NO PII expuesta · solo resultado verificación binario + metadata chain length + first-break timestamp si rota. Audit log per public verify (DEC-V11-80 transparency) · auditor accountability firmada.

Section 3

AI Act art 26 6+ months retention canonical

AI Act art 26 obliga deployer mantener logs sistemas IA HIGH-RISK 6+ meses (art 26(6)). ROSS retiene canonical 6 años (alineado GDPR art 5(1)(e) + statute of limitations contractual EU 5-6 años estándar). Auto-purge post-retention.

Retention schedule per data category · voice transcript 90 días default + opt-in 6 años regulated · audit_log 6 años hard · finops cost data 7 años (tax retention). Configuration per tenant · DPIA firmada per use case.

Live demo · canonical proof-of-concept

Paste audit_hash + tenant_id · verify integrity online. Result cryptographic proof chain valid o break-point timestamp. Demo público sandbox · rate-limited.

Auditor walkthrough · verify chain live

Auditor o compliance officer · walkthrough verify_watermark_chain RPC + forensic audit canonical · 30 min.

Book ROSS Hour · audit walkthrough
AI Act art 50 disclosure · contenido generado con asistencia IA (Claude · Anthropic) · revisión humana firmada Will CTO + Patxi Compliance · DEC-V11-80.