Fair point — "accountability" implies enforcement mechanisms that aren't here. More accurate: tamper-evident logging. You capture a request/response pair with

Fair point — "accountability" implies enforcement mechanisms that aren't here. More accurate: tamper-evident logging. You capture a request/response pair with a hash. Later you can verify the pair hasn't changed. What anyone does with that evidence is a separate question. The README mentions this under the Trust Boundary section — I'll make the distinction clearer in the top section.