audit_chain 1.1.0

Audit Chain 1.1.0 adds a request-scoped collector, fail-loud signing-key handling, and clearer verification when history was written unkeyed.

Added

• A request-scoped collector (audit_chain.collector) so the obvious integration is safe. It buffers per request, deduplicates by channel, operation, and entity keys (first occurrence wins; metadata is not merged), and writes once at kernel.terminate. That avoids flooding the hash chain from high-volume hooks such as field access, and keeps the append lock off the request critical path.
• Status report warning when entries were encrypted under a profile the site no longer uses. Each row records the profile that encrypted it (encryption_profile, empty for plaintext). Reported at WARNING — chain integrity is intact; readability of old ciphertext is what is lost. Existing rows are left unrecorded rather than backfilled. There is still no re-encrypt command.
• key_id on each row, recording which Key entity produced the hash (empty when unkeyed). Advisory only: it is not covered by the row hash, so verification uses it only as a try-first hint, never as proof.
• Additive verify() keys: reason, unkeyed_rows, and unkeyed_through alongside ok and broken_at. Code that compares the whole return array needs updating; field-by-field checks do not.
• Retired signing keys (previous_hash_keys). Verification accepts the current key or any retired key from configuration, so rotating the signing key no longer makes earlier rows look like tampering.

Fixed

• A configured-but-unresolvable signing key no longer silent-downgrades to unkeyed SHA-256. Writes log an error naming the key; hook_requirements() reports ERROR. The entry is still written — dropping an audit record is worse than an unsigned one.
• drush audit-chain:verify no longer reports unsigned rows as tampering. It distinguishes content/order mismatch (tampered) from intact rows hashed without the key (written_unkeyed), and reports how many rows and through which id. Both still exit non-zero; only the diagnosis changes.
• Invalid UTF-8 in metadata no longer produces a permanently unverifiable row. Canonical payload and stored metadata use JSON_INVALID_UTF8_SUBSTITUTE. Valid historical payloads are unchanged; rows already destroyed this way cannot be recovered.