The signed ledger and portable bundle

Every state-changing action in Modernize — ingest, document, characterize, translate, verify, advance, cutover, rollback, retire — is appended to a hash-chained, Ed25519-signed ledger.

What that gives you:
• Tamper-evidence — each entry commits to the previous one, so any alteration breaks the chain. The Ledger tab runs a SHA-256 chain check right in your browser and tells you if an entry was tampered or the head doesn't match.
• Provable rollback — because every artifact and transition is recorded, you can roll a bad cutover back to the exact prior artifact and the rollback is itself signed.
• Offline-verifiable provenance — auditors can verify the signatures against the published key without trusting Turtini's servers.

Portable bundle:
• The whole modernization — source, specs, characterization tests, and the signed ledger — exports as a self-contained signed bundle. You're never locked into Turtini; the record of how a regulated system was changed travels with you.

The server appends to the ledger; clients only read and verify — they can't rewrite history.