@mikeargento/bitgraph-audit

Offline audit of BitGraph evidence: npx @mikeargento/bitgraph-audit <bundle>.

An Audit Bundle is a portable collection of BitGraph proofs, optionally accompanied by the original artifact bytes, anchor witness material (for proofs floored by Ethereum anchors, before the Base floor), and a manifest, packaged as a directory, a .tar, or a .tar.gz. A single BitGraphed file (a file with its proof inside) is also accepted: it is unpacked and audited as the bundle it carries, its own verdict printed first. The download package a bitgraph.ing proof page offers (proof.json, committed/, original/, bitgraphed-file/, ethereum-anchors/, base-ceiling/) is such a bundle. The premise: the operator's database is not the evidence. BitGraph proofs are self-contained objects, and this package lets an independent reader take a bundle, verify whatever evidence it contains fully offline, and reconstruct the causal record without asking the operator which history to trust. The on-disk format is specified in docs/BUNDLE-FORMAT.md; both this consumer and the bitgraph.ing exporter conform to it.

The tool reports exactly what the evidence supports, nothing more. Incomplete input produces an incomplete reconstruction: missing proofs surface as unexplained counter positions and broken predecessor links, which means the supplied evidence cannot reconstruct those positions, not that the authority failed to create them. Divergence between valid objects is presented, never resolved; the reader adjudicates. Proofs without their artifact bytes pass through the bytes-free integrity checks and are reported as artifact-unavailable, never as fully verified. In the chain analysis, wall-clock bounds appear only when independently verifiable offline evidence (a locally reconstructed Ethereum block header, for proofs made before the Base floor) is present in the bundle; a tree/1 export's floor and ceilings are checked by verifyExport. There is no network access at runtime of any kind.

Exactly one proof schema is supported: bitgraph/1. The legacy occ/1 schema is pre-release beta data and is permanently out of scope; proof-shaped files with any other version are rejected at ingest with the stable code unsupported-version. All verification semantics come from @mikeargento/bitgraph-verify (MIT), the same verifier anyone can run against a single proof. The bitgraph-audit CLI runs the whole pipeline (ingest, verification tiers, causal reconstruction, anomaly classification, authority analysis, anchor identification, witness verification, temporal bounds, offline attestation validation) and writes audit-report.json and audit-report.md; runAudit() is the one-call library entry point, and every stage is also exported individually. See docs/HOW-TO-AUDIT.md for the recipient walkthrough and docs/BUNDLE-FORMAT.md for the on-disk format.

Exports (bitgraph-export/1)

A tree/1 BitGraph (one position for one or more files, one file a tree of one) travels as one JSON export beside its files, with SPEC.md, the text the proof pins. The export holds no file copies and no anchor proofs. The audit finds every export in a bundle by its format field, checks it with verifyExport once for each file in the bundle it covers (by SHA-256: a member's committed bytes or original, or any leaf of the owner's export), and reports every claim with what it rests on, the covered files, and the three time claims apart: the floor, the ceiling on Base (provisional until its block is checked against Base) and the ceiling on Ethereum, which is the settlement of that Base block through Base's output root. The proof inside joins the chain analysis like any proof. An export with a FALSE claim fails the audit (exit 1); a claim the export does not carry never does. Requires @mikeargento/bitgraph-verify 1.16.0.

License

MIT. See LICENSE.