Ed25519-signs every tool call and appends to a hash-chained, tamper-evident audit log. Zero config — signing starts immediately after install. No native dependencies (embedded WASM). Audit logs at ~/.signet/audit/ with optional CLI verification via signet audit --verify.