The black box
Everything that touches a crisis goes through an append-only log. This is not an audit layer bolted alongside the application: it is the only write path.
What makes the log tamper-evident
The constraint is not in application code — that would be discipline, and discipline is worked around. It is held by the database, by triggers that refuse every update and delete on the event table.
-- A trigger also applies to the database owner, unlike a mere grant revocation,
-- which a superuser can grant back to themselves.
create trigger journal_pas_de_modification
before update or delete or truncate on evenement
execute function journal_refuser_mutation();
Every event carries the SHA-256 hash of its own content and of the previous hash. Removing, altering or inserting an event breaks the chain from that point on, and it shows.
| The event carries | Why |
|---|---|
| Its author, its session | Who did it, from which device |
| Its cell | Decision-making or operational |
| Its recorded time | The server's time — the one that orders events |
| Its entry time | The one declared by the client, kept but never authoritative |
| Its origin | Human, automatic, or injected by an exercise tool |
| Its hash, and the previous one | The chain |
Rewinding
Replay does not re-read a list of entries: it rebuilds the complete state of the crisis at a given moment. The rewind slider puts the interface into read-only and shows the crisis as it stood — decisions taken, actions open, applications recorded as down, deadlines remaining.
On a long crisis, replaying a million events on every slider move would be unusable: projection snapshots are frozen periodically, and replay starts from the nearest one.
What enters the log, and what does not
This is a product boundary, stated rather than suffered.
| Enters the log | Does not |
|---|---|
| Room messages, reactions, pins | Direct messages between two people |
| Decisions, arbitrations, actions | Live whiteboard strokes |
| Situation reports | Typing indicators, presence |
| Document references and their hashes | The bytes of the documents |
| Continuity checks, notifications sent | The external monitoring feed |
| Failed sign-in attempts |
Two reasons, always the same. Volume: a log that cannot be purged and that anyone can flood is a handle offered to an attacker. Third parties: writing in the words of people who do not know we exist would be permanent collection dressed up as a crisis record.
An append-only log is never purged. Data that enters it stays for the retention period of the crisis. That is the price of evidential value, and you should know it before going live.