Skip to content
Erebrosdocs

Audit log

The Audit log, at /audit, is the ledger. Every event carries a SHA-256 hash of its contents and the hash of the event before it, then an Ed25519 signature from the machine that wrote it.

The Erebros-T audit log — every event with its hash, prev-hash and signature

Both hash columns are shown

Section titled “Both hash columns are shown”

The claim the log makes is that each row’s prev equals the hash of the row below it, and showing both lets you check that claim by eye. A single green tick that always says verified teaches nobody anything and is impossible to distrust.

  • ⟳ Verify rereads the log itself — not the index — and rewalks the chain. Checking a derived copy against itself would prove nothing.
  • Rebuild throws the search index away and replays the log into a fresh one. Safe at any time.
  • The sig column marks any event whose signature does not match its hash.

Edit one line in the log by hand and every event after it fails, because each hash covers the one before. Deleting the tail is the one edit a chain cannot see — which is why the log is replicated rather than trusted on one machine.

What is not here

Section titled “What is not here”

Ephemeral events — presence, typing (kinds 9000–9999) — are never written. A heartbeat every fifteen seconds across three machines is a quarter of a million events a year that nobody will ever read.

From a shell

Section titled “From a shell”
Terminal window
curl -s localhost:3401/api/events/verify | jq
tail -f ~/.erebros-t/events/log.jsonl

Every machine’s chain is verified separately, because each one is its own file; ok: false names the sequence number where the break is. If the chain is broken, somebody edited log.jsonl — restore it from a backup; do not repair it by hand.

See also

Section titled “See also”