AIR BLACKBOX
The audit layer for AI transactions

Tamper with one record.
Watch the proof collapse.

Every AI decision below is sealed into a tamper-evident chain. Change a single value and the cryptography breaks, live, in your browser. This is not an animation. It is the real HMAC-SHA256 chain the shipped package writes.

Real Web Crypto, not faked Same algorithm as pip install air-blackbox Nothing leaves this page
audit_chain — hiring decision episode
· NOT YET VERIFIED
▼ prev_hash = "genesis"
signing key
Try it: edit the amount or flip a decision in any record, then hit Verify chain. The record you touched and every record after it turn red, because each hash is computed from the one before it. Change the signing key and verification fails too, just like an auditor with the wrong key.
⏻ Signature layer — Ed25519 (asymmetric, the part HMAC can't do) not signed
public key (the auditor gets this)
signature over the chain head
HMAC proves the chain wasn't altered, but anyone with the secret key could have produced it. An Ed25519 signature is different: it's verified with the public key, so an auditor confirms you signed this exact chain without ever holding your secret. Sign it, then tamper with a record above and verify again, the signature no longer matches, because the head it signed has changed.
Why this matters

Traceability is the legal requirement.
Proving it is the hard part.

The EU AI Act, Article 12, requires high-risk AI systems to automatically record events over the system's lifetime with traceability appropriate to their purpose. Tamper-evidence is not named in the text, it is how you prove that traceability and exceed the floor: it is not enough to have logs, you must be able to show no one changed them after the fact. For Annex III systems like hiring AI, the logs must also record who verified each result. The demo above is what that proof looks like when it is real.

01 / THE PROBLEM

A log file is not evidence

Anyone with write access can edit a plain log and no one can tell. To a regulator or a court, an editable record proves nothing about what the AI actually did.

02 / THE MECHANISM

Each record seals the last

Every record's hash is computed from the record before it. Alter one field and that record's hash no longer matches, and every record downstream breaks with it. You saw it happen above.

03 / THE HANDOFF

The auditor verifies offline

One command bundles the chain with a standalone verify.py. The auditor runs it on plain Python, with no install and no trust in you, and gets a single PASS or FAIL.

04 / THE POINT

Built for the moment you're asked

When a regulator, client, or board asks what your AI did and whether the record is trustworthy, the answer is a verifiable bundle, not a screenshot and a promise.

Technical proof

The code running above is the shipped algorithm.

No special demo path. The page computes each hash exactly the way the audit chain in the package does, verified byte-for-byte against the Python implementation.

chain_hash = HMAC-SHA256( key , prev_hash || json(record, sort_keys=true) )
prev_hash   = raw digest of the previous record  ·   first prev_hash = "genesis"
your terminal
# 1. scan your AI project for gaps (free, runs locally)
$ pip install air-blackbox
$ air-blackbox comply --scan . -v

# 2. export a self-verifying evidence bundle
$ air-blackbox export --format evidence --signing-key "$KEY"
 .air-evidence-20260601.zip  (audit_chain + scan_results + manifest + verify.py)

# 3. hand the zip to an auditor. they run, with no install:
$ python verify.py --key "$KEY"
✓ PASS - chain intact, 3 records verified
# ...tamper with any record and the same command prints:
✗ FAIL - chain broken at record 1
Where the keys come in. The chain above is HMAC-SHA256, which makes it tamper-evident. The shipped package also signs each receipt for third-party verification, with Ed25519 by default and ML-DSA-65 (FIPS 204, post-quantum) available as an option. The free, offline verify.py checks the HMAC chain you see here using only the Python standard library.
The threat model, stated plainly. The HMAC chain proves integrity: no record changed after it was written. The signing key proves authority: only the holder can produce a valid chain, and the auditor runs verification on their own machine with their own key, so editing the data in a browser proves nothing without it. HMAC gives tamper-evidence; the Ed25519 / ML-DSA-65 signature on top gives third-party non-repudiation, the holder cannot later deny they signed.
Don't take our word for it

Reproduce the demo's hashes in your own terminal.

Two snippets. The first reproduces the genesis record. The second reproduces a chained record, where the previous hash feeds in as raw bytes, exactly what the inspector shows. Paste either into any Python 3.

record 1 of 3 — genesis
$ python3 -c '
import hmac, hashlib, json
rec = {"action":"screen_resume","candidate":"Jos\u00e9 R\u00edos","decision":"advance",
       "model":"gpt-4o","req_id":"REQ-4471","run_id":"txn-001",
       "timestamp":"2026-06-01T09:14:02Z","version":"1.0.0"}
canon = json.dumps(rec, sort_keys=True).encode()  # ensure_ascii=True
print(hmac.new(b"demo-key-2026", b"genesis" + canon, hashlib.sha256).hexdigest())'
 3406857a358925c0c92df41800ba682e06ef16be1f0d395a5c59a3de82fe6abe
# = txn-001's chain_hash on the card above. note: json escapes the unicode name.
record 2 of 3 — chained (prev_hash as raw bytes)
$ python3 -c '
import hmac, hashlib, json
prev = bytes.fromhex(            # the hex from record 1, as RAW bytes
  "3406857a358925c0c92df41800ba682e06ef16be1f0d395a5c59a3de82fe6abe")
rec = {"action":"rank_candidates","candidate":"Jos\u00e9 R\u00edos","decision":"shortlist",
       "model":"gpt-4o","percentile":88,"run_id":"txn-002",
       "timestamp":"2026-06-01T09:14:05Z","version":"1.0.0"}
canon = json.dumps(rec, sort_keys=True).encode()
print(hmac.new(b"demo-key-2026", prev + canon, hashlib.sha256).hexdigest())'
 3475b0db67e73bec0929d9845521b78a5e063ade4b3a6d287e7cb2c5d70de5ab
# = txn-002's chain_hash. THIS is why editing record 1 also breaks record 2.
AIR Blackbox identifies potential compliance gaps and demonstrates tamper-evident logging.
This is not a certified compliance test. It is a starting point to identify potential gaps. It does not certify or guarantee regulatory compliance.