Tamper-Evident Audit Trace

The problem

It is difficult to know if sensitive data has been tampered with or to identify which specific point of a data breach is the most critical.

What it does

It creates a secure digital paper trail where every piece of information is linked together, and it marks which parts of that data are most important.

Why it matters

It allows you to verify that information remains untampered while pinpointing the most high-impact areas of a system.

Validation

It was run inside an isolated container with no network access. This is the exact command and the real output it produced — captured process output, not written by a model.

$ python3 audit_tool.py
Integrity Verification Result: {
  "integrity_ok": true,
  "issues": []
}

Audit Trail:
[
  {
    "data": "System initialized",
    "timestamp": "2026-08-12T06:03:07.905583+00:00",
    "previous_hash": null,
    "current_hash": "2badb3efdd9e0f308fdb82623b0017564faafa58602331a980139f6f3acf783f",
    "bottleneck_weight": 0.5,
    "critical_path": false
  },
  {
    "data": "User login successful",
    "timestamp": "2026-08-12T06:03:07.905624+00:00",
    "previous_hash": "2badb3efdd9e0f308fdb82623b0017564faafa58602331a980139f6f3acf783f",
    "current_hash": "cf84c9240e2b0bb9a4853b48b7eed9813213704c94fd643f922586d1137c7b9a",
    "bottleneck_weight": 0.5,
    "critical_path": false
  },
  {
    "data": "Data access request",
    "timestamp": "2026-08-12T06:03:07.905629+00:00",
    "previous_hash": "cf84c9240e2b0bb9a4853b48b7eed9813213704c94fd643f922586d1137c7b9a",
    "current_hash": "94c0e05cc9008ab822cb2ac1c0e02dcf2a8552e94aa697138e24e15afdf294e5",
    "bottleneck_weight": 0.5,
    "critical_path": false
  }
]

A screenshot of that run.

A clean run proves this does what is shown above, in a CPU-only sandbox. It is a small research demo — not a production tool, and nothing here was published anywhere.

The code

All of it — 115 lines, one file, standard library only.

# Tamper-Evident Audit Tool with SHA-256 hash chaining and breach detection
import hashlib
import json
from dataclasses import dataclass
from typing import List, Dict, Optional
from datetime import datetime, timezone

class AuditEntry:
    """Represents a single entry in the audit trail"""
    def __init__(self, data: str, previous_hash: Optional[str] = None):
        self.data = data
        self.timestamp = datetime.now(timezone.utc).isoformat()
        self.previous_hash = previous_hash
        self.current_hash = self._calculate_hash()
        self.bottleneck_weight = 0
        self.critical_path = False

    def _calculate_hash(self) -> str:
        """Generates SHA-256 hash of the entry"""
        content = f"{self.data}{self.previous_hash}{self.timestamp}".encode()
        return hashlib.sha256(content).hexdigest()

    def detect_bottleneck(self, threshold: float, path_metrics: Dict) -> bool:
        """Detects if this entry is a critical path bottleneck"""
        # Calculate weight based on path metrics (example implementation)
        self.bottleneck_weight = sum(path_metrics.values()) / len(path_metrics) if path_metrics else 0
        if self.bottleneck_weight > threshold:
            self.critical_path = True
            return True
        return False

class TamperEvidentAudit:
    """Main audit trail implementation"""
    def __init__(self):
        self.chain = []
        self.current_threshold = 0.5  # Adjust based on specific use case

    def add_entry(self, data: str, path_metrics: Dict = {}) -> AuditEntry:
        """Adds new entry to the audit trail"""
        previous_hash = self.chain[-1].current_hash if self.chain else None
        new_entry = AuditEntry(data, previous_hash)
        new_entry.detect_bottleneck(self.current_threshold, path_metrics)
        self.chain.append(new_entry)
        return new_entry

    def verify_integrity(self) -> Dict:
        """Verifies the integrity of the audit trail"""
        integrity_ok = True
        result = {"integrity_ok": True, "issues": []}

        for i, entry in enumerate(self.chain):
            # Recalculate hash to verify
            recalculated_hash = entry._calculate_hash()
            if recalculated_hash != entry.current_hash:
                integrity_ok = False
                result['issues'].append({
                    "entry": i,
                    "issue": "Hash mismatch - potential tampering detected",
                    "expected_hash": entry.current_hash,
                    "actual_hash": recalculated_hash
                })

            # Check critical path validity
            if entry.critical_path and entry.bottleneck_weight <= self.current_threshold:
                integrity_ok = False
                result['issues'].append({
                    "entry": i,
                    "issue": "Invalid critical path marking",
                    "weight": entry.bottleneck_weight,
                    "threshold": self.current_threshold
                })

        result['integrity_ok'] = integrity_ok
        return result

    def to_json(self) -> str:
        """Returns the audit trail as JSON string"""
        return json.dumps([{ 
            'data': e.data, 
            'timestamp': e.timestamp, 
            'previous_hash': e.previous_hash, 
            'current_hash': e.current_hash, 
            'bottleneck_weight': e.bottleneck_weight, 
            'critical_path': e.critical_path 
        } for e in self.chain], indent=2)

if __name__ == "__main__":
    # Example implementation for running as a command-line tool
    import sys
    import os

    def main():
        audit = TamperEvidentAudit()
        
        # Example path metrics for demonstration
        path_metrics = {
            'critical_path': 0.7,
            'non_critical': 0.3
        }

        # Add example entries
        audit.add_entry('System initialized', path_metrics)
        audit.add_entry('User login successful', path_metrics)
        audit.add_entry('Data access request', path_metrics)
        
        # Verify integrity and output results
        integrity_result = audit.verify_integrity()
        print("Integrity Verification Result:", json.dumps(integrity_result, indent=2))
        
        # Output audit trail JSON
        print("\nAudit Trail:")
        print(audit.to_json())

    if __name__ == "__main__":
        main()