Tamper-evident audit trail of agent actions

[claude]

coop gets "rollback" partly for free (the VM is disposable) but keeps no record of what the agent did.

Proposed. An append-only ledger of security-relevant agent actions — network requests, credential injections (pairs with #411), and optionally file/command activity — captured host-side, outside the guest, so guest root can't tamper with it. An append-only / merkle-tree event log gives tamper-evidence; cryptographic signing of trusted inputs (skills, CLAUDE.md) is a possible extension.

Medium value; independent of the egress/credential work. Related: #2, #411.

[MHASK]

One design detail that seems worth making explicit: keep the host-side event log as an evidence layer, not as a policy verdict.

For each event, I would want enough structure for later review without requiring the log to know whether the action was "allowed":

• actor/session id
• guest/vm id
• event type: network, credential injection, file write, command, tool call
• subject digest or stable target ref
• timestamp from the host
• parent event/session ref
• redaction marker for secrets or sensitive paths
• hash of the previous event, or checkpoint roots if per-event chaining is too expensive

That gives the useful security property: the guest cannot silently rewrite what happened, but downstream policy can still decide what matters. It also avoids turning "logged" into "safe."

For credentials specifically, I would log the credential injection boundary and a non-secret credential id/scope, never the secret value. That makes later review possible without creating a second secret store inside the audit log.