Verify a decision chain

Re-verifies an entire decision chain: the prev_hash linkage across all of its records (ordering / completeness) and every per-record Ed25519 signature (authorship). Read-only; never mutates the chain.

The chain is resolved by id only within the authenticated caller's organization (RLS-scoped); the org is taken from the request credentials, never from a path or query parameter. chainID is the decision id (a UUID).

Inspect authorship_proven for the strong non-repudiation claim (every record signed and all signatures + linkage verify). valid only means no integrity violation was detected and can be true for a chain with zero signed records, so do not gate non-repudiation on valid alone.

Authority (#2914). Authentication alone is not enough: this route requires COMPLIANCE READ AUTHORITY over the organization. Present a validated per-user token (X-User-Token, or Authorization: Bearer) whose role is admin, owner or policy_admin, or call from an internal service asserting X-Axonflow-Admin-Authority: true. A Community-mode deployment is exempt: it has no authentication and resolves every caller to one local operator. Anything else is 403.

Community SaaS (try.getaxonflow.com) refuses these routes, by design. The hosted evaluation stack runs with authentication enabled, so the Community-mode exemption above does not apply to it, and its evaluator accounts hold no entitled role. Verification there is a 403. Granting evaluators access would widen, on a public shared stack, the exact exposure this change closes. Verify audit records on a deployment you operate.