Verify the journal

The check runs on your machine, against a file you exported, and it needs nothing from us to reach its answer.

Run it

sp verify chain export.jsonl --checkpoint checkpoint.json

What it checks

• Every row hashes over the row before it, from the first row of the segment.
• The sequence has no gaps. Numbers come from a counter row rather than a database sequence, so a gap is a real gap and never a rolled-back transaction.
• The checkpoint signature verifies against the public key in the export.
• The Merkle root over the segment matches the one the checkpoint carries.

When it fails

It names the first sequence number where the chain stops closing. Take the checkpoints either side of it and compare them with the copy in your own SIEM, which holds the row hashes independently. That comparison is the reason the SIEM export carries them.

A corrupted row inside a golden export is part of our own test suite. A verifier that has never been shown a broken chain has not been tested.