{ "audit": "a2ally core ledger no-rewrite audit", "spec_id": "core-ledger-v1", "spec_sha256": "6f77cbdd64c749354fc692bd1f2d49e534a62c1db919fcab924c82e337eebd04", "audited_at": "2026-11-07T04:42:31.525Z", "ok": true, "verdict": "No code path rewrites a sealed record: every guarded table carries its update and delete guards, every mutation probe against a sealed row was blocked by those guards, the code-path census holds, and the full chain recomputation passes.", "trigger_census": { "method": "Read live from sqlite_master at audit time.", "guarded_tables": [ { "table": "ledger_entries", "update_guard": true, "delete_guard": true, "triggers": [ "ledger_entries_no_delete", "ledger_entries_no_rewrite" ] }, { "table": "ledger_blocks", "update_guard": true, "delete_guard": true, "triggers": [ "ledger_blocks_no_delete", "ledger_blocks_no_update" ] }, { "table": "ledger_commitments", "update_guard": true, "delete_guard": true, "triggers": [ "ledger_commitments_no_delete", "ledger_commitments_no_update" ] }, { "table": "ledger_anchors", "update_guard": true, "delete_guard": true, "triggers": [ "ledger_anchors_no_delete", "ledger_anchors_no_update" ] }, { "table": "ledger_witnesses", "update_guard": true, "delete_guard": true, "triggers": [ "ledger_witnesses_no_delete", "ledger_witnesses_no_update" ] }, { "table": "ledger_witness_checks", "update_guard": true, "delete_guard": true, "triggers": [ "ledger_witness_checks_no_delete", "ledger_witness_checks_no_update" ] }, { "table": "ledger_cosignatures", "update_guard": true, "delete_guard": true, "triggers": [ "ledger_cosignatures_no_delete", "ledger_cosignatures_no_update" ] }, { "table": "ledger_witness_declarations", "update_guard": true, "delete_guard": true, "triggers": [ "ledger_witness_declarations_no_delete", "ledger_witness_declarations_no_update" ] }, { "table": "ledger_witness_challenges", "update_guard": true, "delete_guard": true, "triggers": [ "ledger_witness_challenges_no_delete", "ledger_witness_challenges_no_update" ] }, { "table": "ledger_witness_challenge_withdrawals", "update_guard": true, "delete_guard": true, "triggers": [ "ledger_witness_challenge_withdrawals_no_delete", "ledger_witness_challenge_withdrawals_no_update" ] } ], "complete": true, "exception": { "table": "ledger_texts", "update_guard": false, "delete_guard": false, "why": "Redactable by design (takedowns). Its only writer after insert is the redaction path, which clears the text and stamps redacted_at; the sealed payload commitment is never touched. Redactions on record: 0." } }, "mutation_probes": { "method": "Each probe attempts the named mutation against a real row inside a savepoint that is always rolled back, whether the guard blocks it or not. blocked = the guard aborted the statement. no_rows = the table is empty, so there was nothing to probe — reported, not counted as a pass.", "probes": [ { "target": "ledger_entries (sealed entry)", "action": "update", "result": "blocked" }, { "target": "ledger_entries (sealed entry)", "action": "delete", "result": "blocked" }, { "target": "ledger_blocks", "action": "update", "result": "blocked" }, { "target": "ledger_blocks", "action": "delete", "result": "blocked" }, { "target": "ledger_commitments", "action": "update", "result": "blocked" }, { "target": "ledger_commitments", "action": "delete", "result": "blocked" }, { "target": "ledger_anchors", "action": "update", "result": "blocked" }, { "target": "ledger_anchors", "action": "delete", "result": "blocked" }, { "target": "ledger_witnesses", "action": "update", "result": "blocked" }, { "target": "ledger_witnesses", "action": "delete", "result": "blocked" }, { "target": "ledger_cosignatures", "action": "update", "result": "blocked" }, { "target": "ledger_cosignatures", "action": "delete", "result": "blocked" } ], "blocked": 12, "run": 12 }, "code_path_census": { "method": "Count of SQL write statements (INSERT INTO / UPDATE / DELETE FROM / REPLACE INTO) naming a core ledger table, over every TypeScript source file under src/ (recursive), excluding this audit module (src/ledgerfreeze.ts). Recomputed from source by the test suite on every run; the suite fails if the shipped code and these published counts drift apart.", "audit_module_exclusion": "src/ledgerfreeze.ts is excluded from the census because its only write statements are the audit's own mutation probes — 6 updates and 6 deletes, each executed against a real row only inside a savepoint that is always rolled back, to prove the guards block them. The probes are listed in this document's mutation_probes section, and the suite separately pins the probe count in the audit module, so the exclusion cannot hide a write path.", "insert_sites": 11, "insert_sites_by_table": { "ledger_entries": 1, "ledger_blocks": 1, "ledger_commitments": 1, "ledger_texts": 1, "ledger_anchors": 1, "ledger_witnesses": 1, "ledger_witness_checks": 1, "ledger_cosignatures": 1, "ledger_witness_declarations": 1, "ledger_witness_challenges": 1, "ledger_witness_challenge_withdrawals": 1 }, "update_sites": [ { "file": "src/ledger.ts", "table": "ledger_entries", "kind": "sealing_transition", "detail": "sets block_height on still-unsealed entries when their block seals; the one transition the rewrite guard permits" }, { "file": "src/ledger.ts", "table": "ledger_texts", "kind": "text_redaction", "detail": "clears a free text and its salt and stamps redacted_at; the sealed payload is never touched" } ], "delete_sites": 0, "replace_sites": 0, "files_with_core_writes": [ "src/anchor.ts", "src/ledger.ts", "src/witness.ts" ], "outside_src": "scripts/gen-sdk-fixtures.mjs inserts one anchor row into a throwaway fixture database. It is a test fixture, not a shipped code path, and is named here so the census is complete." }, "chain_verification": { "ok": true, "blocks_checked": 138, "entries_checked": 267, "head_hash": "313dba9d195aa20fe2c5e244f8d533497b9a4521adfa5cc58454408d9916c2b8", "signing_keys": [ "key_a521921c2ba20669" ], "errors": [], "checked_at": "2026-11-07T04:42:31.524Z" }, "sealed_counts": { "entries_total": 267, "entries_sealed": 267, "entries_pending": 0, "blocks": 138, "commitments": 2, "anchors": 637, "witnesses": 1, "cosignatures": 54, "texts": 0, "redactions": 0 }, "limits": [ "The audit covers the application code paths and the database triggers in the running service. It does not stop someone holding the database file or the host, who could drop the triggers; a rewrite made that way is caught from outside — Bitcoin anchors, witness cosignatures, daily snapshots and mirrors hold copies the host cannot rewrite.", "It does not prove the production server runs exactly this code. The deployed commit and build hash are published at /v1/transparency/build; until builds are reproducible from a public source, a reader can check consistency over time but cannot independently prove the running code.", "It does not cover the content of ledger_texts (redactable by design — the commitment in the sealed payload is what is frozen, not the displayed text), tables outside the core ledger, or duplicate and mirror ledgers, which carry their own guards.", "It proves sealed records were not rewritten. It says nothing about whether what an entry records was true when it was written.", "The code-path census counts SQL write statements in the shipped sources, rechecked by the test suite on every run; the audit module's own mutation probes are excluded from the count, listed as probes, and pinned separately by the suite. It is a census of the source, not a proof about machine code." ], "spec": "/v1/ledger/spec", "page": "/ledger/spec" }