audit-verifier — Independent audit-chain check

Why this exists

Smartflow seals each VAS record into an HMAC-SHA256 chain. Verification inside the proxy is useful for operators. It is not independent: you are trusting the same code that wrote the chain.

audit-verifier is the check you can run without that trust. MIT license. No network calls. No Smartflow crates.

Try it in 30 seconds

Download the crate. Build it on your machine. The sample chain and key are in the tarball. The key is published sample material, not a production secret.

curl -fsSL -o audit-verifier-1.0.0.tar.gz \
  https://docs.aperion.ai/audit-verifier/audit-verifier-1.0.0.tar.gz
tar xzf audit-verifier-1.0.0.tar.gz
cd audit-verifier-1.0.0
cargo run --release -- verify \
    --chain    examples/sample-chain.jsonl \
    --hmac-key file:examples/sample-hmac.key

Same sample files, hosted separately:

Exit 0 = every HMAC and prev_hash link checks out. Flip one byte in the JSONL and it exits 1. That is the demo.

Exit codes

Code	Meaning
`0`	All signatures and links verified
`1`	Tampering (HMAC mismatch, broken link, missing or duplicate seq)
`2`	Usage / I/O error

What it actually checks

Fingerprint (record this next to the result):

audit-verifier@1.0.0 algorithm=hmac-sha256/canonical-sorted-json/v1

Strip entry_hmac from the entry JSON.
Recursively sort object keys.
HMAC-SHA256(key, canonical JSON) → lowercase hex. Must equal entry_hmac.
prev_hash[N+1] == entry_hmac[N]. Genesis prev_hash is genesis.

The tarball is the source. It mirrors Smartflow's canonical HMAC JSON byte-for-byte.

Production chain

Export the live chain from Smartflow, then:

audit-verifier verify \
    --chain     /path/to/chain.jsonl \
    --hmac-key  file:/path/to/hmac.key \
    --format    text

If you omit --hmac-key, it still checks prev_hash linkage and reports every entry as unsigned.