Ledger seal

What it measures

A daily SHA-256 digest of canonical ledger lines containing tx_hash|chain|block_number|from_wallet|to_wallet|amount_raw|timestamp. Each line represents one payments.db row and contains only fields treated as immutable on-chain facts.

How it is produced

The source script is ledger_seal.py. It orders canonical lines by tx_hash, hashes each settled UTC day, and links daily digests into a chain. Only days at least two UTC days old are sealed. Every run re-verifies the last three days; any drift raises an alert, exits with status 2, and blocks publication.

Chain construction

chain(D) = sha256(chain(D-1) + "\n" + digest(D))
genesis  = "smartflow-observatory-ledger-seal-v1"

State files

seals.jsonl
SEAL-LATEST.txt

Limits and assumptions

• tx_hash must not repeat in the table so the ordering is deterministic.
• Historical settled rows must not change in the hashed columns. Mutable classification and detection columns, including wash_flag, tx_sender, is_facilitator_mediated, and detected_at, are intentionally outside the seal.
• The tracker must not add records to settled days after the 48-hour buffer.
• The seal does not prove correctness or completeness. It commits to what the tracker collected, including any errors or gaps.
• A legitimate historical backfill changes an earlier daily digest and requires a public new-version seal plus a correction entry.
• A hash of a private database demonstrates publication consistency over time, but an external verifier cannot confirm the contents without a database dump to recompute the digest from.
• Editable historical posts are weaker anchors than immutable publication. The source note mitigates this by archiving a snapshot after each publication and optionally publishing the hash separately.

How to refute this

1. Show that sealed data is incorrect or incomplete. The seal covers what the tracker collected, including its errors and gaps. Sealed does not mean audited.
2. Perform a legitimate historical backfill and show that the prior chain no longer verifies without a new-version seal and a correction entry.
3. Show that an external verifier cannot confirm the database contents without access to a dump and a digest recomputation.
4. Show that an old publication used to pin the hash can be edited after publication, weakening it as an independent timestamp.

Last validated

2026-07-05