Skip to content
Briefcase AI

briefcase.integrity

Chain and canonicalization APIs ship in the base install. Signing requires pip install "briefcase-ai[integrity]==4.4.0".

Canonical JSON

from briefcase.integrity import canonical_json, sha256_hex


encoded = canonical_json({"b": 2, "a": 1})
print(encoded, sha256_hex(encoded))
  • canonical_json(value) -> bytes uses the strict v1 profile.
  • canonical_json_compat(value) -> bytes preserves historical SDK hashes.
  • compute_payload_hash(payload) and compute_entry_hash(...) return SHA-256 hex.

Hash chains

HashChainAppender(store).append_row(
    table, row_id, observed_at, recorded_at, payload,
    entity_id=None, supersedes=None, max_attempts=32,
) -> HashChainEntry


verify_chain_segment(entries, expected_prior=GENESIS_PRIOR_HASH)

HashChainStore is the port. InMemoryHashChainStore and JsonlHashChainStore are bundled implementations. A stale append raises ChainConflictError; the appender refreshes the tail and retries. A malformed final JSONL line raises TruncatedChainFileError.

Signing

  • sign_json, verify_json_signature
  • sign_digest, verify_digest
  • public_key_jwk, jwk_thumbprint

The signing functions accept Ed25519 keys and use RFC 8037 JWKs. See Integrity and Signing for anchoring and storage limits.