Verifying without trusting us
A tamper-evidence guarantee you can only check by running the code of whoever claims it guarantees nothing. That is why Kastell ships an independent verifier.
The verifier
- 149 lines, no dependencies, talks to no server.
- Released under CC0 1.0 — public domain. Copy it, read it, rewrite it.
node outils/verifier-journal.mjs crisis-log.json
It checks the sequence for gaps, the hash chain, and that each event matches its hash. It detects altered content, truncation at the end, and a hole in the middle.
The computation, in ten lines
Each event carries the SHA-256 hash of:
[previous hash, or the byte 0x00 for the first]
++ utf8( crise_id | seq | type | occurred_at | acteur_id | cellule_id
| origine | charge_canonique )
charge_canonique is the exact form PostgreSQL hashed; it travels verbatim in
the export, precisely so the check has no normalisation to reimplement.
This file exists so that a third party — auditor, insurer, opposing counsel — can check a log without asking our permission. Putting it under AGPL would make verification depend on our terms.
The product's own verification suite
pnpm verif
More than six hundred guarantees, each tied to a requirement in the
specification. It resets its own database (…_verif, created as needed),
never touches your development one, and refuses to run if
KASTELL_ENV=production.
It does not only test that things work, but that the wrong ones are refused: that an event cannot be modified, that an API key comes back neither from the API nor from the log, that a mass send without confirming the recipient count is rejected.
Integrity in service
The root console verifies every log on the instance on demand, and reports the number of crises checked, the elapsed time, and any anomalies.