The Forensic Provenance Ledger records the artifacts of an engagement — bytecode, detector configs, CLI invocations, scan reports, findings, capsules — into a hash chain, so each one’s provenance can be verified rather than taken on trust. You anchor artifacts as you go, and verify the chain whenever you need to prove nothing was altered.
Why it exists
Audit output is only defensible if its provenance holds up. Recording each artifact’s hash in a chain makes tampering detectable: change any anchored record and the chain no longer verifies. This page makes that property visible — you can anchor, verify on demand, and even simulate a tamper to watch the verification fail.
Who uses it
- Auditor — anchors the key artifacts of an engagement as they’re produced.
- Reviewer — verifies chain integrity for reporting or court use.
Using the page
Anchor artifact opens a form with a kind selector — bytecode, detector config, CLI invocation, scan report, finding, capsule, or custom — and adds the artifact to the chain. Verify chain recomputes the hashes and reports whether the chain is intact, and Try Me loads a sample chain to explore. Export JSON and Export CSV download the ledger or its records.
Two actions are deliberately restricted: Clear ledger is admin-gated, and Simulate a tamper is disabled against the live ledger — it explains that server-kept records are tamper-evident by construction, so you can’t quietly rewrite one from here.
Limits
- Requires a signed-in account.
- Clearing the ledger and tampering with a record are admin-restricted and can’t be done from this page against the live ledger.
- The chain is self-contained — it doesn’t cross-reference external anchors such as third-party timestamping services.
Related pages
- Security at Sigvex — the platform security overview this sits under.