CT changed TLS certs. ASTL changes governance. Publish surface_manifest_hash to an append-only public log before bind — auditors grep, strangers verify, operators can't rewrite what was possible.
Composes with everything:
POST /api/v1/astl/publish
{"tenant_id":"carrier-x","domain":"insurance",
"surface_paths":["policy_bind","policy_renewal","premium_commit"]}
GET /api/v1/astl/lookup?manifest_hash=…
GET /api/v1/astl/log.json