Every tool call, scoped token, and human approval — hash-chained. Tamper with a row and the chain breaks.