Tamper-evident tamper-proof: what an agent audit log can actually prove

说明与用途

开发者了解到Agenthof审计日志对已提交事件提供哈希链完整性证明，但并非不可篡改：截断重放问题已通过治理账本的外部透明日志锚点解决，仅运行收据通过手动--expect-head解决，而完整性（缺失事件）仍在设计中。

问题

How much can a developer trust an append-only hash-chained audit log produced by an AI agent gateway, and which guarantees are genuinely shipped versus still in design?

结果

The developer learns that agenthof audit verify provides genuine tamper-evidence for committed events (hash chain integrity), but the audit log is not tamper-proof: truncation-and-re-forge is solved for the governance ledger via automatic external anchoring to a named transparency log, solved for the per-run receipt only via manual --expect-head comparison, and completeness (missing events) is in design not shipped.

工作流

• Run agenthof audit verify <run> to walk the hash chain and confirm any edit/deletion/reordering breaks the chain
• Check audit verify control against the governance ledger's recorded anchors for third-party detection of root rewrite
• For per-run receipts, save the printed head and later run agenthof audit verify --expect-head sha256:<hex> to compare against an off-machine head
• Do not assume completeness is guaranteed; a missing event leaves no cryptographic signature, so detect it via accounting (ingress call count vs ledger event count) rather than crypto

证据

Open any 'AI agent governance' page and you'll find the phrase 'tamper-proof audit log'. Treat it as a tell. No append-only file on a machine someone administers is tamper-proof, and a vendor who says otherwise is either not thinking hard about it or hoping you won't.

来源

That gives you one real, strong guarantee: any edit, deletion, or reordering of a committed event breaks the chain and fails verify.

来源

So the honest scorecard on truncation: solved for the governance ledger (independent anchor, today), and for the per-run receipt it's the manual --expect-head path — bringing automatic anchoring to the per-run receipt is reserved, not yet built.

来源

today sequence numbers catch a dropped tail, and containment means a governed action has to pass through a recording door — but detecting a silently dropped door event is in design, not shipped.

来源

Independence comes from where the record is anchored, not from the gateway being neutral — because it isn't neutral, and claiming it is would be the same move as 'tamper-proof.'

来源