Experiment 0 - untampered record
{ valid: true, errors: [] }

Tamper 1 - edit one payload (4.00 -> 3.50)
{ valid: false, errors: [ 'payload_hash (seq 4)' ] }

Tamper 2 - delete one message (the counter-offer)
{ valid: false,
  errors: [ 'prev_hash (seq 4)', 'message_hash (seq 4)',
            'message_signature (seq 4)', 'countersignature (seq 4)',
            'message_count' ] }

Tamper 3 - edit the record statement (messageCount 5 -> 99)
{ valid: false, errors: [ 'statement_hash', 'message_count' ] }

Tamper 4 - recompute every hash around a forged acceptance, keep old signatures
{ valid: false,
  errors: [ 'record_signature', 'message_signature (seq 4)',
            'countersignature (seq 4)', 'message_signature (seq 5)',
            'countersignature (seq 5)' ] }

import crypto from 'node:crypto';

const H = (bytes) => crypto.createHash('sha256').update(bytes).digest();
const hex = (b) => Buffer.from(b).toString('hex');

// Canonical JSON: sorted keys, no whitespace.
// (A JCS/RFC 8785 subset, fine for this demo's data. Production systems
// should use a real JCS implementation and never hash JSON.stringify output.)
function canon(x) {
  if (x === null || typeof x !== 'object') return JSON.stringify(x);
  if (Array.isArray(x)) return '[' + x.map(canon).join(',') + ']';
  return '{' + Object.keys(x).sort().map(k => JSON.stringify(k) + ':' + canon(x[k])).join(',') + '}';
}

// Purpose prefix: a signature made for one purpose can't be reused for another.
function sigInput(purpose, digestHex) {
  return Buffer.concat([Buffer.from(purpose + ':', 'utf8'), Buffer.from(digestHex, 'hex')]);
}

const buyer = crypto.generateKeyPairSync('ed25519');
const supplier = crypto.generateKeyPairSync('ed25519');
const platform = crypto.generateKeyPairSync('ec', { namedCurve: 'P-256' });

// A synthetic clock: all timestamps in this demo are simulated so the
// narrative ordering is explicit. Production timestamps come from real clocks.
const T0 = Date.parse('2026-11-12T12:00:00Z');

const GENESIS = hex(H('genesis:buyer+supplier:po-1042'));
let prevHash = GENESIS;
const messages = [];

function send(agent, keys, payload) {
  const envelope = {
    seq: messages.length + 1,
    prevHash,
    from: agent,
    payloadHash: hex(H(Buffer.from(canon(payload), 'utf8'))),
    sentAt: new Date(T0 + messages.length * 1000).toISOString(),
  };
  const hash = hex(H(Buffer.concat([
    Buffer.from(prevHash, 'hex'), Buffer.from(canon(envelope), 'utf8')
  ])));
  const signature = { alg: 'Ed25519', sig: crypto.sign(null, sigInput('message', hash), keys.privateKey).toString('base64url') };
  const receivedAt = new Date(T0 + messages.length * 1000 + 100).toISOString();
  const countersignDigest = hex(H(Buffer.from(canon({ hash, agentSig: signature.sig, receivedAt }), 'utf8')));
  const platformSignature = {
    alg: 'ECDSA_P256_SHA256',
    sig: crypto.sign('sha256', sigInput('countersign', countersignDigest), platform.privateKey).toString('base64url'),
  };
  messages.push({ envelope, hash, signature, receivedAt, platformSignature, payload });
  prevHash = hash;
}

send('buyer', buyer, { type: 'rfq', item: 'bracket', qty: 100, maxUnitPrice: 4.5 });
send('supplier', supplier, { type: 'quote', item: 'bracket', qty: 100, unitPrice: 4.2 });
send('buyer', buyer, { type: 'counter', unitPrice: 4.0 });
send('supplier', supplier, { type: 'accept', unitPrice: 4.0, qty: 100 });
send('buyer', buyer, { type: 'purchase_order', po: 'PO-1042', qty: 100, unitPrice: 4.0, total: 400 });

// Close: the witness signs a statement over the final head.
const statement = {
  v: 1, type: 'record', session: 'po-1042',
  participants: ['buyer', 'supplier'],
  headSeq: messages.length, headHash: prevHash, messageCount: messages.length,
  issuedAt: new Date(T0 + messages.length * 1000 + 5000).toISOString(), // after the last receive
};
const statementHash = hex(H(Buffer.from(canon(statement), 'utf8')));
const record = {
  statement, statementHash,
  platformSignature: { alg: 'ECDSA_P256_SHA256', sig: crypto.sign('sha256', sigInput('record', statementHash), platform.privateKey).toString('base64url') },
};

// The verifier. It gets the record, the messages, and public keys from
// outside the bundle. Nothing else. Payloads may be omitted entirely
// (notary-style privacy): the chain still verifies, but the verifier is then
// checking content commitments, not content - it cannot tell whether the
// omitted payloads ever said what any party claims they said.
function verifyRecord(record, messages, platformPub, agentPubs) {
  const errors = [];
  const require = (ok, code, seq) => { if (!ok) errors.push(seq ? `${code} (seq ${seq})` : code); };
  const platVerify = (purpose, digestHex, sigB64) => {
    try { return crypto.verify('sha256', sigInput(purpose, digestHex), platformPub, Buffer.from(sigB64, 'base64url')); }
    catch { return false; }
  };

  require(hex(H(Buffer.from(canon(record.statement), 'utf8'))) === record.statementHash, 'statement_hash');
  require(platVerify('record', record.statementHash, record.platformSignature.sig), 'record_signature');

  let prev = GENESIS;
  for (const m of messages) {
    const env = m.envelope;
    require(env.prevHash === prev, 'prev_hash', env.seq);
    if (m.payload !== undefined) {
      require(env.payloadHash === hex(H(Buffer.from(canon(m.payload), 'utf8'))), 'payload_hash', env.seq);
    }
    const h = hex(H(Buffer.concat([Buffer.from(prev, 'hex'), Buffer.from(canon(env), 'utf8')])));
    require(h === m.hash, 'message_hash', env.seq);
    require(crypto.verify(null, sigInput('message', h), agentPubs[env.from], Buffer.from(m.signature.sig, 'base64url')), 'message_signature', env.seq);
    const cd = hex(H(Buffer.from(canon({ hash: h, agentSig: m.signature.sig, receivedAt: m.receivedAt }), 'utf8')));
    require(platVerify('countersign', cd, m.platformSignature.sig), 'countersignature', env.seq);
    prev = m.hash;
  }

  require(record.statement.messageCount === messages.length, 'message_count');
  require(record.statement.headHash === prev, 'head_hash');
  return { valid: errors.length === 0, errors };
}

const agentPubs = { buyer: buyer.publicKey, supplier: supplier.publicKey };

console.log('Experiment 0 - untampered record');
console.log(verifyRecord(record, messages, platform.publicKey, agentPubs));

// Tamper 1: edit the accepted price
const t1 = structuredClone(messages);
t1[3].payload.unitPrice = 3.5;
console.log('\nTamper 1 - edit one payload (4.00 -> 3.50)');
console.log(verifyRecord(record, t1, platform.publicKey, agentPubs));

// Tamper 2: delete the counter-offer
const t2 = structuredClone(messages);
t2.splice(2, 1);
console.log('\nTamper 2 - delete one message (the counter-offer)');
console.log(verifyRecord(record, t2, platform.publicKey, agentPubs));

// Tamper 3: forge the record statement
const r3 = structuredClone(record);
r3.statement.messageCount = 99;
console.log('\nTamper 3 - edit the record statement (messageCount 5 -> 99)');
console.log(verifyRecord(r3, messages, platform.publicKey, agentPubs));

// Tamper 4: the forger rewrites the acceptance AND recomputes the whole
// chain to fit it - every payloadHash, prevHash, message hash, the head in
// the record statement - but is stuck keeping every original signature,
// because it holds no private keys.
const t4 = structuredClone(messages);
t4[3].payload = { type: 'accept', unitPrice: 0.01, qty: 100 };
t4[3].envelope.payloadHash = hex(H(Buffer.from(canon(t4[3].payload), 'utf8')));
let p4 = GENESIS;
for (const m of t4) {
  m.envelope.prevHash = p4;
  m.hash = hex(H(Buffer.concat([Buffer.from(p4, 'hex'), Buffer.from(canon(m.envelope), 'utf8')])));
  p4 = m.hash;
}
const r4 = structuredClone(record);
r4.statement.headHash = p4;
r4.statementHash = hex(H(Buffer.from(canon(r4.statement), 'utf8')));
console.log('\nTamper 4 - recompute every hash around a forged acceptance, keep old signatures');
console.log(verifyRecord(r4, t4, platform.publicKey, agentPubs));