Haldir / tamper-evidence, live.

This is a real audit log for a demo tenant stored in Haldir's live Postgres. The Signed Tree Head below is an RFC 6962 Merkle root signed with HMAC-SHA256 — the same primitive Certificate Transparency uses to keep 7 billion TLS certificates honest. Click Tamper and Haldir will catch the DB mutation cryptographically, not by diffing or monitoring.

See full evidence pack haldir_merkle.py

Audit log tenant: demo-tamper-public · 5 entries

Entry IDActionToolCost USD
demo-entry-001 stripe.charge.create stripe $4.99
demo-entry-002 postgres.read postgres $0.00
demo-entry-003 stripe.refund.create stripe $12.50
demo-entry-004 github.issue.comment github $0.00
demo-entry-005 slack.message.send slack $0.00

Live Signed Tree Head GET /v1/audit/tree-head

{
  "tree_size": 5,
  "root_hash": "97e2ccb3ecc3bbcaf887a936fcdd1317d02b5a30c97141f390f37702523ce68d",
  "signed_at": 1791340054,
  "signature": "35f1447d9a250e0a7aecdfaecb70c399cf2bd18413da339eed8cfe577e07ae1f",
  "algorithm": "HMAC-SHA256-over-canonical-sth"
}

Inclusion proof captured pre-tamper for demo-entry-003

{
  "leaf_index": 2,
  "leaf_hash": "544994b61e5fd27c77ed7c0bebbe27611fd300764c90c94b0cac6db6ab9eeca9",
  "tree_size": 5,
  "root_hash": "97e2ccb3ecc3bbcaf887a936fcdd1317d02b5a30c97141f390f37702523ce68d",
  "audit_path": [
    "d1c03bde914f39b6650e0c1c093e69d51abbd595b5257d2f83d36633a3ed887b",
    "eee032d589ad5dea4c9f1f02f242819e6f9b6e9288522a2455afabae373f1e0b",
    "a0873310b1b38ef8d8435487c5d212c92b76b53e46ca664fc4b006fe13f643cb"
  ],
  "algorithm": "RFC6962-SHA256",
  "entry_id": "demo-entry-003"
}
Visitor-held proof vs. live root: VERIFIES against live root