Audit Proof Format

The audit service returns inclusion proofs that bind one canonical audit event to a signed batch root. The native verifier CLI can also emit a JSON proof bundle from an archive directory.

Fields

• event: canonical audit event as defined by the Audit Event Contract.
• batch: signed batch metadata, including batch_id, tenant_id, sequence range, Merkle root, signer_key_id, and signature.
• meta_root: archive anchor metadata when the batch has been anchored.
• event_to_batch: ordered Merkle sibling list from the event leaf to the batch root.
• batch_to_meta_root: ordered Merkle sibling list from the batch envelope leaf to the meta-root when present.

Verification

1. Encode event with vortex_audit_core::encode_event.
2. Compute leaf = BLAKE3(0x00 || encoded_event).
3. Apply event_to_batch in order using the shared node hash helper.
4. Compare the result with batch.merkle_root.
5. Verify the batch signature using the public key identified by batch.signer_key_id.
6. When a meta-root is present, verify the batch envelope path and meta-root signature.

The archive verifier performs these checks offline from the archive objects and public keys available in the archive.

If nexus-audit-verify reports a missing artifact, signature failure, ordering inconsistency, or Merkle mismatch, see Runbook: Audit Verifier Failure.

For copying archive objects to customer-controlled storage, see Audit Archive Export.