-- REQ-125 / F2: audit log tamper-evidence.
-- Add hash-chain columns + append-only trigger blocking UPDATE/DELETE.
ALTER TABLE audit_log ADD COLUMN prev_hash TEXT;
ALTER TABLE audit_log ADD COLUMN entry_hash TEXT NOT NULL DEFAULT '';

-- Append-only trigger: block UPDATE and DELETE on audit_log.
-- A tampered entry (UPDATE) or deleted entry (DELETE) is rejected.
CREATE TRIGGER IF NOT EXISTS audit_log_no_update
BEFORE UPDATE ON audit_log
BEGIN
    SELECT RAISE(ABORT, 'audit_log is append-only (REQ-125)');
END;

CREATE TRIGGER IF NOT EXISTS audit_log_no_delete
BEFORE DELETE ON audit_log
BEGIN
    SELECT RAISE(ABORT, 'audit_log is append-only (REQ-125)');
END;
