sipa-voice-gate

AI infra logs are prose. To notice that a pipeline's risk jumped between two steps, someone has to read both log lines in full and hold the first in working memory while reading the second — slow under time pressure, and structurally hostile to anyone who processes information mechanically rather than narratively. Worse: most "audit trails" just trust whatever the log says, with nothing stopping a tampered entry from looking valid. sipa-trace fixes the shape, not the content. Every pipeline event becomes a TraceCard with a locked schema (stage, action_type, risk_class, reversible, state_delta). Risk is assigned by a fixed rule table, not by asking a model to grade its own step. Two cards in a row diff field-by-field — the diff IS the alert, not a paragraph you have to parse. Every card is hash-chained, and a real verifier recomputes each entry's hash from its actual payload and compares it — so content tampering (not just chain-linkage) is caught. Core (sipa_trace/): TraceCard schema, RiskClassifier (NONE→CRITICAL), hash-chained TraceLog, diff_cards() with risk_escalated/became_irreversible flags, verify() — 29 tests green, runs with zero API keys. Instrumentation: a real MCP-server / FastAPI middleware wraps tool calls with @traced, classifying real actions (e.g. credential_access → CRITICAL) automatically as they happen. Dashboard: React + FastAPI live view polling the trace stream — trace feed, live diff panel, and a Verify badge that flips Verified → Invalid the moment a card is tampered on disk, re-checked on demand.