Record-keeping: no operational guidance on showing a log was not altered

The record-keeping page explains the Article 12 obligation clearly, including that logs need to be tamper-evident. What I could not find, here or anywhere else, is the next step: what a team actually builds so that a log can be shown not to have been altered, and by whom.

The distinction that seems to be missing everywhere is **altered by whom**. A hash chain detects an outsider's edit and proves nothing against the party that wrote the record, which is the party a deployer's own auditor is asking about. Most guidance treats those as the same property.

I have written that up:

https://machinetestimony.org/tamper-evidence/

It compares append-only storage, hashes, hash chains, signatures, RFC 3161 timestamps and transparency logs, and says what each proves and against whom. It gives runnable commands, including the verification failure and what that failure does not tell you, and it is explicit that none of it establishes that a record is true, complete, or the only one produced.

It is not about any particular format and works with whatever a reader already logs.

If it is useful, a link from the record-keeping page might save somebody the search. If it duplicates something you already have, or you would rather not link out, no reply needed and no offence taken.