Tamper-Evident Hash-Chained Audit Log

An append-only log where each entry commits to the previous entry's hash, so tampering is detectable AND locatable.

THE SILENT FAILURE. Audit logs are trusted exactly when they matter most, and almost none can detect modification. A row edited in place looks like a row that was always there. The usual fix -- hashing each entry independently -- detects a changed entry but NOT a deleted one and NOT a reordered one: the survivors all still verify individually, so verification passes while the log is a lie. Truncation is the same; chop the last fifty entries and every remaining one still hashes correctly.

Verification returns WHERE the chain first breaks, not a boolean, because a boolean tells an operator nothing about what happened. Truncation is handled explicitly, since a truncated chain is internally consistent and needs an anchored expected head to detect -- that anchoring is an explicit part of the API. Canonical serialisation is pinned and tested, because two structurally identical entries must produce identical bytes or verification fails for reasons unrelated to tampering.

HONEST ABOUT THE LIMIT: a hash chain proves internal consistency, not authenticity. Whoever can rewrite the log can recompute the whole chain unless the head is anchored somewhere they do not control. This is tamper-EVIDENT, not tamper-proof, and that distinction is the whole value -- the README states it rather than implying otherwise.

VERIFIED: 76 tests. Every mutation was observed FAILING before the source was restored -- a test never seen to fail is a decoration. Independently reviewed by a verifier whose job was to find what is wrong, not to agree.

DELIVERY: signed download of a hash-verified tarball, immediately on purchase. Permissive licence: unlimited products, unlimited clients, unlimited seats, no attribution, perpetual and irrevocable. One restriction, do not republish the source as source.

This is an engineering tool, not legal, tax or accounting advice. It computes and reports; a human decides.

Interface

What you call, and what comes back. Types and signatures only — the implementation ships with the source.

  export function canonicalizeJson(value: unknown): string;
  export function computeEntryHash(entry: HashableEntry): string;
  export function verifyChain( entries: readonly LogEntry[], options: VerifyOptions = {}, ): VerificationResult;