Technical proof: a tampering in the trail that the hash chain exposed

This case starts from a controlled technical proof: it demonstrates what happens when someone tries to rewrite the past in a TriageShield audit trail.

The reproducible scenario

A sequence of events was recorded — three triages, one human approval and a reclassification —, each chained by SHA-256 to the previous event. Then, an intermediate event was deliberately edited to simulate an attempt to cover up a decision.

What the verification found

When the chain was recomputed, the hash of the altered event changed. Because the following event incorporated the original hash of what was tampered with, it stopped matching — and the break propagated to all subsequent links. The verification pinpointed exactly the first point where the chain broke.

Why this matters in an audit

In a common log, the edit would go unnoticed. Here, integrity does not depend on the good faith of whoever keeps the record: it depends on the structure. Proving the trail is intact is recomputing the chain; proving it was tampered with is finding where it breaks.

The evidence that remains

The human approval remained as a verifiable link, and the AI stayed in its role of explaining and proposing, never deciding on its own. The case shows that auditable rigor is a property of the design — not a report assembled afterward.