Function buildAuditChain

src/cli/maintain-audit.ts:65–82

(runs: AuditableRun[])

/** Build a tamper-evident chain from runs (chronological, oldest first). PURE. */
export function buildAuditChain(runs: AuditableRun[]): AuditEntry[] {
  const ordered = [...runs].sort((a, b) => Date.parse(a.at || '') - Date.parse(b.at || '') || 0);
  const entries: AuditEntry[] = [];
  let prevHash = AUDIT_GENESIS;
  ordered.forEach((r, seq) => {
    const base = {
      seq, at: r.at || '', scope: r.scope, status: r.status,
      filesChanged: Number.isFinite(r.filesChanged) ? r.filesChanged : 0,
      prUrl: r.prUrl || '',
      verification: (r.verification ?? []).map(v => ({ command: String(v.command), passed: !!v.passed })),
      prevHash,
    };
    const hash = sha256(entryContent(base));
    entries.push({ ...base, hash });
    prevHash = hash;
  });
  return entries;
}

/** The chain head — what a signature commits to. PURE. */
export function chainHead(entries: AuditEntry[]): string {