🔏 Graven

The tamper evident database

A normal, fast database where every write is cryptographically chained and anchored on Solana, so anyone can prove your data was never altered.

TypeScript · SQLite (MVP) · Postgres (production) · Solana anchoring · Merkle proofs

The idea

A regular database is fast and queryable, but it is trivially editable. Anyone with access can change a row, a balance, a log entry, a timestamp, and you would never know. For finance, compliance, health, audit trails and AI agent actions, that is a dealbreaker.

Graven keeps your data in a normal database, but turns the blockchain into the write log's seal:

1. Every write becomes an event in an append only, hash chained log (each event hash includes the previous one).
2. The event hashes form a Merkle tree. The Merkle root is anchored on Solana in a tiny transaction.
3. To verify, anyone recomputes the chain and the root and checks it against the on chain anchor. If a single byte of history was changed, the root no longer matches, and Graven points at the exact record that was tampered with.

Fast reads from the database. Provable integrity from the chain. The best of both worlds.

Your data, provably untampered.

How it works

write ──> append event (hash = sha256(prevHash + canonical(event)))
     ──> materialize current value into the state table (fast reads)

anchor ──> Merkle root over all event hashes ──> Solana memo transaction
       ──> store { merkleRoot, headHash, txSig, slot }

verify ──> recompute chain + root from the database
       ──> compare to the on chain anchor
       ──> tamper => first divergent record is reported

• Append only event log , the source of truth, hash chained so history cannot be silently rewritten.
• State table , a materialized view for fast queries, fully re derivable from the events.
• Merkle anchoring , one small Solana transaction seals the entire history; inclusion proofs prove any single record belongs to an anchored root.
• Audit , recompute everything and compare to the chain; report the exact tampered record.

API (core engine)

const db = new Graven({ file: 'data.graven' })
db.put('accounts', 'alice', { balance: 1000 })   // -> { seq, hash }
db.get('accounts', 'alice')                       // -> { balance: 1000 }
const anchor = await db.anchor()                  // Merkle root -> Solana (or local)
const proof = db.proof(seq)                       // Merkle inclusion proof
Graven.verifyProof(leafHash, proof, root)        // standalone verify
const report = db.audit()                         // { ok, issues[] } , catches tampering

What is built (MVP)

• Core engine: hash chained event log, materialized state, SHA256 + canonical JSON, Merkle tree with inclusion proofs, audit and tamper detection. Runs on SQLite, zero infrastructure.
• Solana anchoring module (memo transaction carrying the Merkle root), pluggable: local mode when no signer is configured, real on chain anchor when one is.
• A tamper demo that inserts a ledger, anchors it, then edits the database directly and proves the audit catches it.

Roadmap

• Phase 1 (this MVP): engine, Merkle anchoring, proofs, audit, tamper demo.
• Phase 2: REST API + client SDK, batched and scheduled anchoring, on chain root verification by re fetching the memo, Postgres backend.
• Phase 3: dashboard (tables, anchors with explorer links, one click verify, live tamper alarm), drop in adapters (Prisma, Drizzle), $ token utility for hosted anchoring and verification.

Run

npm install
npm run demo     # inserts data, anchors, tampers, and proves detection