Audit Chain — Live Proof

Signed audit packs

The proof export has a replay path.

The public page never exposes signing secrets. It exposes the chain entry, the export endpoint, and the verification instructions so a tenant, auditor, or evaluator can replay the signature with their controlled secret.

1. Select an entry

Click any recent goal row to open the evidence package, reviewer votes, policy flags, hashes, and raw chain entry.

2. Export the pack

The export endpoint returns griff-audit-pack/v1 JSON with the entry, data source, canonicalization metadata, and HMAC signature.

3. Recompute the signature

Run the verifier with the tenant-held secret to canonicalize the unsigned pack and compare the HMAC-SHA256 digest.

Verifier command

GRIFF_AUDIT_PACK_SECRET=<secret> node scripts/verify-audit-pack.mjs pack.json

The repo includes scripts/verify-audit-pack.mjs. It removes the signature field, canonicalizes sorted-key JSON, and compares the expected digest with the exported signature.

Recent goals

Showing 3 most recent. Click a row to inspect the evidence package.

Seq	Timestamp	Goal / event	Agents	Source	Evidence hash	Status
#3	2026-05-06 16:00:10 UTC	Buyer-safe evidence export is ready with a verified hash chain.	Custody ledger, Verifier, Export service	master-atc-public-demo	38266340…f8f75c	allow
#2	2026-05-06 16:00:03 UTC	Policy engine allows Tier 3 public demo only after named human approval.	Policy engine, Olivia-HQ, MASTER ATC public simulator	master-atc-public-demo	5586df15…917723	allow
#1	2026-05-06 16:00:01 UTC	Public evaluator submits a read-only MASTER ATC demo mission.	Buyer operator, MASTER ATC public simulator	master-atc-public-demo	70d5c975…27a41a	allow

Evidence package · seq #3

Buyer-safe evidence export is ready with a verified hash chain.

audit.export.ready · source master-atc-public-demo · 2026-05-06T16:00:10.800Z

Open export endpoint

HMAC-SHA256 · canonical JSON

Claim and acceptance criteria

Hash chain verifies end to end
eventCount=9 verified=true
Public certificate contains no secrets or customer data
secretsTouched=false customerData=false
Export pack can be signed and replayed
pack_format=griff-audit-pack/v1 algorithm=HMAC-SHA256

Artifacts

Diffdemo://contract/no-code-diff
Testsdemo://verification/hash-chain-pass
Logsdemo://runner/public-deterministic-simulation
Artifactdemo://artifact/MASTER_ATC_demo_evidence_certificate.pdf
Artifactdemo://audit/public-demo-chain

Evidence quality score: 96.0%

Reviewer votes and judge decision

Decisionallowconfidence 95%

Reviewer votes

policyallow
custodyallow
exportallow

The export is buyer-safe, deterministic, and carries a replayable signature path.

Policy clearance and operating envelope

Forbidden files touchedCLEAR
Forbidden commands runCLEAR
Budget exceededCLEAR

Hard gates

tests passedPASS
security clearPASS
policy clearPASS
evidence completePASS
budget okPASS
lease validPASS

Cost

$0.0000

Runtime

10.80s

Chain of custody

Previous hash

5586df15d382a3120a47125de66ec72064cdf81df2af5901096dab12a2917723

This entry hash

3826634003563f13d26020939d4cda332aab43135fa8949b95d46254a3f8f75c

Tenant

griff-ai-public

Sequence

#3

View raw chain entry JSON

{
  "tenant_id": "griff-ai-public",
  "seq": 3,
  "previous_hash": "5586df15d382a3120a47125de66ec72064cdf81df2af5901096dab12a2917723",
  "ts": "2026-05-06T16:00:10.800Z",
  "event": "audit.export.ready",
  "source": "master-atc-public-demo",
  "payload": {
    "goal": "Buyer-safe evidence export is ready with a verified hash chain.",
    "agents": [
      "Custody ledger",
      "Verifier",
      "Export service"
    ],
    "evidence_package": {
      "task_id": "public-demo-task-001",
      "attempt_id": "public-demo-attempt-003",
      "artifact_ids": [
        "demo://artifact/MASTER_ATC_demo_evidence_certificate.pdf",
        "demo://audit/public-demo-chain"
      ],
      "diff_artifact_id": "demo://contract/no-code-diff",
      "test_output_artifact_id": "demo://verification/hash-chain-pass",
      "logs_artifact_id": "demo://runner/public-deterministic-simulation",
      "acceptance_mapping": [
        {
          "criterion": "Hash chain verifies end to end",
          "satisfied": true,
          "evidence": "eventCount=9 verified=true"
        },
        {
          "criterion": "Public certificate contains no secrets or customer data",
          "satisfied": true,
          "evidence": "secretsTouched=false customerData=false"
        },
        {
          "criterion": "Export pack can be signed and replayed",
          "satisfied": true,
          "evidence": "pack_format=griff-audit-pack/v1 algorithm=HMAC-SHA256"
        }
      ],
      "policy_clearance": {
        "forbidden_files_touched": false,
        "forbidden_commands_run": false,
        "budget_exceeded": false
      },
      "evidence_quality_score": 0.96
    },
    "judge_decision": {
      "decision": "allow",
      "confidence": 0.95,
      "hard_gates": {
        "tests_passed": true,
        "security_clear": true,
        "policy_clear": true,
        "evidence_complete": true,
        "budget_ok": true,
        "lease_valid": true
      },
      "votes": {
        "policy": "allow",
        "custody": "allow",
        "export": "allow"
      },
      "reason": "The export is buyer-safe, deterministic, and carries a replayable signature path."
    },
    "cost_usd": 0,
    "runtime_seconds": 10.8
  },
  "hash": "3826634003563f13d26020939d4cda332aab43135fa8949b95d46254a3f8f75c"
}