Every run is written to a signed log that can't be edited. Your browser has just re-checked it on its own. Now tamper with it and watch it fail.
How it works
Every agent run and policy change is a row in an append-only log. Each row is hashed (SHA-256), and each hash is chained to the one before it, so changing a single byte anywhere changes every link after it. The server signs the newest link with an Ed25519 key. Your browser recomputes all of it with WebCrypto.
…Checking in your browser…Hashing the record, the PDF and the chain.
Now tamper with it
Tap one. Your browser re-checks straight away.
What your browser just checked
Limits: timestamps are the server's own, and the head is signed when this page asks for it. This shows the stored history has not been rewritten since it was chained; it does not prove when each row was written. Data in the runs is synthetic.
What to do nextThat's the story. One more thing worth a look: the same firewall reading real PayPal sandbox disputes, live, with nothing sent.