# Audit-chain export bundle

> Produced by `fastpace audit export-bundle`. Hand this directory to your
> external auditor; they verify the chain without installing fastpace.

## Files

| File | Purpose |
| --- | --- |
| `audit.log` | Verbatim copy of the install's hash-chained audit log (NDJSON, append-only). |
| `identity-pubkey.pem` | Active F0.1 Ed25519 public key. Verifies signatures on every signed entry. |
| `identity-archive/` | Archived (rotated) public keys. Verifies signatures from before the most recent rotation. |
| `verify-offline.js` | Single-file Node script (zero deps) that walks the chain, recomputes hashes, and verifies signatures. |
| `manifest.json` | Bundle metadata: install id, fingerprint, export timestamp, line count, byte sha256, head entry hash. |

## Run the verifier

```bash
cd <this-directory>
node verify-offline.js
```

Requirements: Node 18+. No npm install. The script is checked into the
fastpace package — what you run is the same bytes every install ships.

## What it checks

1. **Hash chain.** Every entry's `prev_hash` must match the previous
   entry's `entry_hash`. Every entry's `entry_hash` must equal
   `sha256(canonical_json(body without entry_hash + signature))`. The
   first entry's `prev_hash` must be the genesis hash
   (sixty-four zeros).
2. **Signatures.** Every entry that has a `signature` field must verify
   against the public key in `identity-pubkey.pem` (or any key in
   `identity-archive/`). Unsigned entries (legacy, pre-0.5.0) are
   counted but not failed.
3. **Bundle wrapper.** The byte-level sha256 of `audit.log` must match
   `manifest.json > audit.sha256_of_bytes`. The last entry's `entry_hash`
   must match `manifest.json > audit.head_entry_hash`. If either
   differs, the bundle has been modified after export.

## Output

Each check prints `[PASS]` or `[FAIL]`. Final line is `RESULT: PASS`
or `RESULT: FAIL`. Exit code is non-zero on any FAIL — wire into CI
or grep-based assertions as needed.

## Privacy

This bundle contains:

- **Hashes** of prompts, responses, and contexts (sha256 digests, never plaintext).
- **Tool names**, **file paths**, **agent ids**, **commit shas** in the audit summaries.
- **Install identity public key** + fingerprint.

It does **not** contain:

- Any prompt text, response text, or source-code content.
- The install's private key (which never leaves the originating machine).
- Per-user PII or secrets — those are stripped at prompt-submit time by
  fastpace's redaction hook.

## Verifying without trust in this script

The auditor can re-implement the verifier in any language:

- Hash function: SHA-256.
- Canonical JSON: sorted keys, no whitespace, RFC 8785-ish.
- Signature: Ed25519 over the SHA-256 digest of the canonical body.
- Public key: standard SPKI PEM (RFC 5280).

The fastpace specification is at:
<https://github.com/fastpace-ai/fastpace/blob/main/packages/fp/assets/docs/audit-schema.md>.