Notes/Architecture

Consent as a hash chain

2025-10-22

Consent in TrustOS is not a boolean column you flip twice. Each event appends to a per-principal hash chain. Tenant-scoped idempotency keys mean a retried Privacy Centre post does not create a second GRANT. Verify-chain walks previousHash and eventHash and can rebuild derived ConsentRecord rows. If the current allow/deny disagrees with the ledger, the ledger wins. Identifiers are AES-GCM at rest with blind indexes for lookup. Sessions store token hashes. OTP challenges store hashes. Auditor and consultant access is a grant in the database, not OWNER with a different label. A deal platform has the same shape of problem with more humans: SynergerAI will not move a deal into shared diligence until the seller and both consultants have approved. Hangfire sends the email. The API that recorded the flag does not wait on SMTP.