Tamper-evident verification log

○ planned

Keep a local, tamper-evident record of who verified a gated action, where, and when.

Every gated action records who verified, which statement, which target, and when - a local record for the question that always arrives later: “who ran that against production?”

What makes it tamper-evident

Not encryption, and not permissions - a log you can decrypt is a log you can rewrite. Each entry is chained to the one before it, so removing or editing an entry breaks the chain from that point onward. The log cannot stop someone changing it; it can make the change obvious, which is what “evident” means here and all that a local file can honestly promise.

It is a record, not an alibi. A local log proves what this installation of SQLly saw. For a claim that holds up against a determined insider, the server's own audit is the source of truth - this is the trail that tells you where to look in it.

Stays on device

The log is a plain local file, like everything else in SQLly's configuration. It is never uploaded, never synced unless you put your SQLly folder somewhere that syncs, and readable by you without the app. Exporting it is an explicit action.

Planned. The related piece that ships today is the local execution log, which already records every statement you run, with retention you control and an off switch - it is the surface this trail will build on.