Design discussion: tamper-evident reuse results (hash-chained repair_cache/events)

从 README 的 threat-model 声明开始，检查 append-only 的 repair_cache 和 events 接口，以及 workflow_status。将提议的 prev-hash 链和 workflow_verify 风格的检查与现有的 workflow 生命周期进行比较；完成意味着形成一个达成共识的设计，在不串联步骤或添加外部依赖的情况下报告首次出现的分歧。

repair_cache rows are inputs to future execution decisions: a reused result bypasses a fresh agent call, and its output flows into downstream nodes. Today the SQLite file has no integrity protection — the README is upfront that the service is "not protected against other local processes". This is not about attackers; it is about agent mistakes: a buggy tool call, a careless script, or a well-meant cleanup that silently edits or drops reuse rows would be undetectable before those rows are trusted again.

Would you be open to a small hash chain over the append-only surfaces?

• repair_cache inserts and events are append-only today; chain them prev-hash style (SHA-256 over the canonical row plus the previous head) and keep the chain head where workflow_status can report it, so a human or the dashboard can check "the results I am about to reuse are the ones earlier runs actually produced"
• mutating rows (steps) stay out of the chain — they change through their lifecycle by design
• a workflow_verify-style call (or an extension of workflow_status) recomputes the chain and reports the first divergence instead of a vague mismatch

Constraints we think matter: chain only append-only surfaces; the threat model is accidental mutation, not adversaries; no git, network, or account dependencies. We run a similar append-only hash-chain trail in our own open-source agent-governance engine (sih-engine — NDJSON event trails with prev-hash and a verify sensor), and are happy to work out a full design and a PR if this fits the roadmap — we would rather align on the shape first.