Cryptographic Tamper-Evident Action-Proof Chain Automation: From a Fake Hash Called "Proof" to a Real One

A feature can display a hash in a monospace font next to the word "Proof," show a screenshot thumbnail, and render a diff percentage — and every one of those visual signals can be completely disconnected from anything real underneath. Demo scaffolding is a normal, legitimate way to build a feature's UI before its real backend exists — the risk is entirely in what happens next: scaffolding doesn't announce itself when it quietly becomes the permanent implementation, and a feature whose entire job is to be shown to a skeptical person (a client disputing a bill, an auditor reviewing a decision) is exactly the worst place for that gap to go unnoticed.

Every visible signal a feature like this needs to display — a hash string, a screenshot thumbnail, a percentage — can be generated by a placeholder that produces plausible-looking output without doing any of the underlying work, and nothing about how the feature LOOKS while running distinguishes a placeholder from the real thing. The gap only becomes visible to code review specifically looking for it: checking whether the hash function is actually cryptographic, whether the storage path resolves to a file that exists, whether the "chain" genuinely references its predecessor. None of those checks happen by using the feature normally — they require deliberately trying to verify what it claims to prove, which is precisely the point of an audit built to find exactly this pattern.

An internal audit of Axiom found the identical failure pattern in nine independent places across the module — a feature not yet ready returned a plausible-looking number instead of admitting it didn't know. The Proof-of-Action feature was the single largest of the nine, and the audit's own account of it is specific: the hash was a 32-bit djb2 algorithm — the kind of hash designed for fast lookup tables, not tamper detection — with the code's own prior comment openly admitting it was a stand-in ("Simplified hash — in production use SHA-256"). It was rendered in a monospace font next to the word "Proof." The before/after screenshot and DOM-snapshot artifacts pointed to paths like `mock://proof/<id>/before-screen.png` — a protocol that doesn't exist, referencing a file that was never created. The visual diff shown to a user was computed as `Math.floor(Math.random() * 15) + 1` — a random number, not a measurement. And the "hash chain," the mechanism meant to make tampering detectable, only ever hashed a single proof's own identifiers — it never referenced the previous proof at all, so a chain of any length behaved identically to a chain of one link: incapable of detecting a deleted or reordered proof, the one thing a chain exists to do. Independently confirmed alongside the rewrite: these capture functions had never actually been called from anywhere in the real product, and the corresponding database table held zero rows in production.

The rewrite replaces every one of those pieces with something that can actually be checked. Hashing uses the browser's own WebCrypto SHA-256 implementation; if that's unavailable (WebCrypto requires a secure context), the code throws rather than silently falling back to a weaker algorithm — degrading quietly to a worse hash is exactly the failure mode this rewrite exists to eliminate. Capture reads the live DOM directly and uploads the actual content to a real, private storage bucket, with the returned artifact carrying the SHA-256 of exactly what was uploaded. The diff walks both DOM snapshots element by element, matching elements by their structural position in the tree and comparing tag, id, class and direct text content — additions, removals and changes are counted from an actual comparison, not generated at random. The chain link for each new proof incorporates the previous proof's own chain link (or a fixed genesis value for an organization's first proof) — so altering, deleting, or reordering any proof breaks the chain link of everything that came after it, which is the entire point of a chain existing at all. And a new verification function actually exercises all of this: it re-downloads every stored artifact, recomputes its hash and compares it to what was recorded, and recomputes the expected chain link to confirm the sequence hasn't been disturbed — a proof nobody can independently verify was, in the audit's own words, decoration, not evidence.

The rewrite's real-world wiring is directly confirmed in the product's current source, not just claimed in the historical commit: the action-execution flow calls the capture functions before and after every action Axiom takes on a person's behalf, with the code's own comment on that call site recording the same history this page describes — that until this fix, nothing in the app had ever called it.

Someone with direct database access edits an old proof record's stored diff summary after the fact, hoping nobody checks. Before the rewrite, nothing would ever notice — the "chain" never referenced that record's neighbors, so an edited proof looked exactly like an untouched one. After the rewrite, running verification on any proof created after the edited one fails: the expected chain link no longer matches, because it was computed from the tampered proof's original, now-altered content.

A record labeled "Proof" now actually withstands the kind of scrutiny the word implies — a hash that can't be trivially forged, an artifact that genuinely exists and can be re-downloaded, a diff computed from a real comparison, and a chain that genuinely breaks when tampered with rather than silently accepting any edit. Anyone relying on this feature to settle a dispute about what Axiom actually did is now relying on something that can be independently re-checked, not a plausible-looking number nobody could ever have verified in the first place.

This mechanism proves what changed in the DOM and that the recorded evidence hasn't been altered since capture — it is not a pixel-level visual screenshot diff (that field was deliberately left out of the rewrite rather than approximated from element counts, which is exactly the kind of substitute guess this fix exists to eliminate). A team specifically wanting a pixel-accurate visual regression tool will need a different, purpose-built mechanism for that.

A 32-bit checksum rendered in monospace font next to the word "Proof" carries every visual signal of cryptographic evidence without any of its actual guarantees — forging a collision takes seconds, not years. Centriu Axiom's rewrite closes that exact gap: the hash is genuinely cryptographic, the chain genuinely links to what came before it, and a dedicated function exists specifically to let anyone independently re-verify the whole thing rather than being asked to trust it on sight.