Prove the config hasn't changed since the audit with two GETs

The auditor signed off on the firewall policy on 30 June. It's November, and they want to know it's the same file.

GET /api/v1/files/etc/app/policy.yml?at=2026-06-30T00:00:00Z&hash returns the SHA-256 of the file as it existed at that moment: ?at reads from the journal, and it composes with ?hash. GET /api/v1/files/etc/app/policy.yml?hash returns the hash now. Same string, done; paste both URLs into the evidence folder and let them run the requests themselves. Different string, and ?diff&from_ts=2026-06-30T00:00:00Z shows every line that moved, while ?history shows when.

No ticket to the sysadmin, no git log on a repo that may not track the file, no screenshot of a terminal. The evidence is reproducible by whoever holds the URL.

Attestation isn't a signed PDF. It's a hash at a timestamp.