- Every Activity Trail record written since 6 September carries the previous record’s hash and its own.
- 33 named gateway and device actions record before and after values; eleven high-risk ones email administrators.
- Verification names the first broken link and never reports intact by default.
What’s new
Since 6 September 2026 the Kapālins Activity Trail has been append-only and hash-chained inside the database, so an edit, deletion or reordering of an earlier record breaks the chain at a numbered point.
The same release named 33 actions that record their before and after values, emails tenant administrators when one of eleven high-risk actions happens, and added a verify check to the Activity Trail page.
Why it matters
The Activity Trail also records changes to the controls themselves, such as the gateway’s fail mode or a device credential, so a weakened setting leaves a record the application cannot quietly edit or delete.
How it works
The chain is built inside the database. Each record gets an increasing sequence number, the previous record’s hash and its own hash, and the database refuses edits and deletions from the application, except a declared retention job.
Each of the 33 named actions records what changed, from old value to new. Eleven are treated as high risk, including changing the gateway fail mode or deep inspection, adding a gateway credential, an MCP server or an A2A agent, and revoking a device credential. For these, tenant administrators are emailed with the actor and the change.
The verify check walks the chain from the organisation’s first chained record, says how many records it checked, and names the first break. The page shows the chain as intact, broken at a numbered record, or not verified, and never as intact by default. Records written before the chain began are marked as such.
Exports carry each record’s outcome, sequence number and hash, so an exported record can be matched to the one in the console. The check runs inside the Kapālins platform; recomputing the chain independently from an export is not yet offered.
How the chain holds
- Each record carries the previous record’s hash and its own.
- An edit, deletion or reordering of an earlier record breaks the chain.
- The verify check walks the chain and names the first break.
Availability
The hash chain reached production on 6 September 2026. The verify check is available to tenant administrators.
