A standing check on the log, run from a separate machine. Every hour it re-derives what the log claims and compares it against what the log serves.
A tamper-evident log proves nothing on its own. The proof exists only when someone verifies it. The monitor is that someone, running on a schedule from a machine that does not host the log, reading the same public endpoints any outside party reads.
The signed checkpoint is verified against the log's published key. A checkpoint the log did not sign is rejected.
Each of the seven independent witness cosignatures is verified against its pinned key. Fewer than four verified cosignatures is an alert; a cosignature that fails to verify is its own alert.
A consistency proof from the last head to the new one is checked from scratch. A rewrite, a fork, or a rollback fails here.
The records the log serves are hashed back into a tree, and the result must equal the signed head. A log that serves an altered or missing record under a valid-looking head fails this check.
Verified records are matched against watched keys. A watched key appearing in a record its owner did not make is the earliest signal of a compromised key.
A frozen but valid-looking checkpoint, or a stale cached view, is caught by the age of the newest witness cosignature.
The witnesses check the log at the moment it writes; they refuse to cosign a fork. The monitor checks what the log later serves to readers, which the witnesses never see. The two cover different sides of the same log. The monitor advances its trusted head only past a checkpoint that is signed, cosigned, consistent, and whose records reproduce the head, and it stops loudly rather than drift when any of those fail.
The two post-quantum cosignatures on each checkpoint are recorded, not verified. The seven Ed25519 cosignatures, the log signature, and the leaf-to-root recomputation are verified.
It runs on a different machine from the log, at the same hosting provider. A copy run by an unrelated party is the stronger version, and the same checks are reproducible against the public endpoints by anyone.
A watched record matched means the bytes matched. It says nothing about whether the record's content is true.
Nothing the monitor reads is private. The checkpoint, the witness cosignatures, the consistency and inclusion proofs, and the record bytes are all served openly, and the log is also published as static tiles you can mirror and recompute from end to end.