nx_journal_log.nx

nx_journal_log.nx -- hash-chained append-only event log (L1 of the storage substrate). ST-3 milestone of NISHI_STORAGE_SUBSTRATE_ROADMAP.md. Composes L0 nx_blob_store + nx_sha256 to ship the substrate-native replacement for bash lib_fact_emit.sh. Each appended event: 1. Payload bytes get stored as an L0 blob -> blob_hash 2. Entry struct = (seq_no, ts_us, schema_id, prev_entry_hash, blob_hash) is canonicalized to bytes 3. entry_hash = SHA-256(canonical_entry_bytes) 4. The new entry's prev_entry_hash field points to the PRIOR entry's entry_hash (chain link) 5. Entry-0's prev_entry_hash is zeroed (chain root) To detect tamper anywhere in history: - Recompute entry_hash(N-1) from the live entry struct - Compare against entry_N.prev_entry_hash - First mismatch returns its seq_no; -1 if chain is intact Tampering ANY field in entry K (prev_hash, blob_hash, ts, schema) changes entry_hash(K) -> next entry's prev pointer mismatches -> verify_chain catches it at K+1. Per Cardinal 13 (additive-only): the log NEVER deletes; updates to data write new events with new payloads; "removal" semantics at higher layers go via new is_current=0 events, not mutation. V1 scope: - In-memory entries (file-backed deferred to ST-3.5) - Max NX_JOURNAL_LOG_CAPACITY = 256 entries - Canary-bracketed for tamper-detect on the LOG itself (in addition to chain verification on its CONTENTS) - schema_id is operator-supplied (caller picks the meaning) Deferred per roadmap: - File-backed persistence (ST-3.5) - Merkle Mountain Range layout for O(log n) inclusion proofs (ST-3.5 or later) - Multi-process append (ST-4)