Chain Verification
Verify the cryptographic integrity of a strand and detect tampering.
What you'll learn
- ✓GET /v1/agents/:id/verify — checks content_hash, parent_hash chain, signatures
- ✓Response: records_verified, chain_intact, broken_at_hash
- ✓What 'chain_intact: false' means and what to do
- ✓Scripting chain verification in a health check
- ✓When to run verification: after restore, before audit, in CI
Run chain verification on all agents. Add 5 records. Re-run — confirm records_verified increased and chain_intact is still true.
Interactive Walkthrough
What you'll learn
Verify the cryptographic integrity of a strand — detect tampering, verify signatures.
What chain verification checks
- For each record:
BLAKE3(parent_hash ‖ ts_hlc ‖ flags ‖ payload) == content_hash record[n].parent_hash == record[n-1].content_hash- Ed25519 signature on each
content_hashis valid against the agent's public key
If any record has been modified on disk, step 1 fails for that record and every subsequent one.
Verify the chain
curl -s http://localhost:7475/v1/agents/users/verify \
-H "Authorization: Bearer spx_root_YOUR_ROOT_KEY" \
| python3 -m json.toolResponse (healthy):
`json
{
"agent_id": "users",
"records_verified": 247,
"chain_intact": true,
"signature_valid": true,
"first_hash": "000...000",
"chain_head": "b3a7c2..."
}
`
Response (tampered):
`json
{
"agent_id": "users",
"records_verified": 51,
"chain_intact": false,
"broken_at_hash": "a3f8c2...",
"broken_at_sequence": 51,
"error": "content_hash mismatch at sequence 51 — data may have been altered"
}
`
Automate in a health check script
#!/bin/bash
RESULT=$(curl -s http://localhost:7475/v1/agents/users/verify \
-H "Authorization: Bearer $SAPIX_ROOT_KEY")
INTACT=$(echo $RESULT | python3 -c "import sys,json; print(json.load(sys.stdin)['chain_intact'])")
if [ "$INTACT" != "True" ]; then
echo "ALERT: Chain integrity violation detected"
exit 1
fi
echo "Chain OK"Challenge
Run a chain verification on all your agents. Note the records_verified count. Add 5 more records. Run verification again — confirm the count increased and chain_intact is still true.
---