Sealed reports render read-only
Why opening a historical compliance report never re-generates it, and what the content hash on the report page is for.
Every generated report in TENSOR — license compliance, DORA cascade filings, the Berechtigungskonzept, GDPR exports — is an immutable, sealed run: the row records the report's content, a SHA-256 hash of that content, and the audit chain head at the moment of generation. Regenerating a report never overwrites anything; it seals a brand-new run.
Viewing is not regenerating
Opening a historical run — from the Reports hub or a report page like License compliance — renders its stored sealed content, read-only. No new run is created by viewing, exporting, or sharing a report page. The Generate report action is the only thing that seals a new run.
This matters for audits: the run you show an auditor in December is byte-for-byte the run you sealed in March, not a fresh recomputation that might differ because the underlying data moved.
The content hash
Each report page shows the run's content hash (SHA-256) and the audit chain head captured at generation time. An auditor can recompute the hash from the displayed content and compare, then walk the audit chain to the captured head to confirm nothing was tampered with in between.
Runs sealed before content storage existed
Reports generated on older platform versions were sealed with a hash only — the content itself was not stored. Those runs still open, but show metadata and hash with a note that their table cannot be displayed. Generating a new run seals one whose content stays viewable permanently.
Share and bookmark a working view
Which dashboard, queue, board, calendar, knowledge, patch, and portal controls are preserved in the URL.
The REST API and its OpenAPI spec
Where the v1 REST API's OpenAPI document lives, how it is generated from the shipped code, and why it can never claim an endpoint that does not exist.