The hash chain approach is exactly right — even a simple append-and-sign pattern would catch post-hoc tampering without much overhead. Worth looking at how Sigstore handles this for inspiration.

Good call on visibility-before-enforcement. Alerting built on shaky data models is worse than no alerting.

The SQLite read is clean. Graceful degradation on schema change is the kind of detail that separates "I built this for me" from "I built this to last."

Curious what your rollout looks like — are people self-hosting, or is there a managed path you're considering?