@axiorank/log-watchdog

Independently monitor an AxioRank audit transparency log. The watchdog polls the public checkpoint endpoints, verifies each signed tree head and the chain between them against a key you pinned out of band, pins the latest verified head locally, and alerts on any inconsistency. It trusts the pinned key, never the server it is auditing.

This is the "do not trust us, verify" half of AxioRank's verifiable audit: customers (and anyone else) can continuously check that the vendor's own log was never forked or rewritten.

What it detects

• rollback: the head's sequence went backward.
• equivocation: a sequence you already saw now presents a different root or signature (a split view).
• inconsistency: a gap, a broken chain link, or an invalid signed-tree-head signature.
• missing witnesses: the head lacks the independent co-signatures you require.

Exit codes: 0 verified and pinned, 1 tamper evidence, 2 a transient network or HTTP problem (nothing pinned).

Setup

1. Enable public monitoring for your workspace (Settings, Security, Public log monitoring) and copy the log id.

2. Pin the JWKS once, out of band:

   curl -s https://app.axiorank.com/api/v1/audit/public-key > jwks.json

CLI

npx @axiorank/log-watchdog \
  --base-url https://app.axiorank.com \
  --log-id <your-log-id> \
  --jwks ./jwks.json \
  --state ./head.json \
  --once

Run it on a schedule (cron, a CI job, or --interval <seconds> to loop). Keep head.json between runs so a rollback is detectable. Add --webhook <url> to POST findings, and --require-witnesses <n> --witness-keys ./witnesses.json to require independent co-signatures.

GitHub Action

- uses: axiorank/log-watchdog@v0
  with:
    log-id: ${{ vars.AXIORANK_LOG_ID }}
    jwks: ./jwks.json

The action caches the pinned head across runs, opens an issue on tamper evidence, and fails the job.

Programmatic

import { runWatchdog, loadState, saveState } from "@axiorank/log-watchdog";

const state = loadState("./head.json");
const result = await runWatchdog({ baseUrl, logId, jwks, state });
if (!result.ok) console.error(result.findings);
else if (result.head) saveState("./head.json", { logId, baseUrl, head: result.head });

Verification is implemented in the zero-dependency @axiorank/audit-verify package.

License

MIT