Suppliers have every incentive to send the cleanest version of reality. Hardseal tells you whether the packet you received still matches the hashes recorded when it was produced.
The demo is intentionally narrow: run the verifier on the public proof pack, then simulate a supplier or intermediary replacing an Incident Response evidence record after the packet was produced. The clean packet passes. The changed packet fails and names the file that changed.
A supplier submits an Incident Response packet. Later, the packet changes: a byte drifts, an evidence record is swapped, or a POA&M section is rewritten after submission. The verifier does not debate intent. It names what broke and refuses the packet.
evidence/INDEX.csv.
evidence/INDEX.csv.
assessment/POAM.csv no longer matches its recorded hash.
assessment/POAM.csv.
tar -xzf proof_IR_2026-05-21.tar.gz cd proof_IR_2026-05-21 python3 verify/verify_standalone.py .
[*] Verifying: . [*] Verifying manifest checksums... OK (10/10 files) [*] Verifying hash chain... OK (6 links) [*] No integrity tag present on bundle. [+] VERIFICATION PASSED -- bundle integrity confirmed.
[*] Verifying: /tmp/hardseal_attack_demo
[*] Verifying manifest checksums... FAILED
- Hash mismatch: evidence/evidence-bundle.json (expected 9a47bb626d5c5534..., got 221665722dbdf978...)
[*] Verifying hash chain... FAILED
- Link 0: artifact_hash mismatch (expected 003b63cd49500152..., got 073275914e9b07b1...)
[*] No integrity tag present on bundle.
[!] VERIFICATION FAILED -- packet mismatch detected.
The public IR pack checks local consistency for the packet you received. In customer delivery, the next layer is source context: reviewer-held delivery records and customer-specific handoff evidence that connect the packet to the delivery workflow, not only whether this copy still matches its recorded hashes.
This demo checks a smaller, useful thing: whether the packet still matches the recorded hashes. It does not certify compliance, replace a C3PAO, or decide whether a control is satisfied.
Absolutely - here is the 30-second version. Clean packet: manifest checksums: OK hash chain: OK result: VERIFICATION PASSED After replacing an Incident Response evidence record: manifest checksums: FAILED changed file: evidence/evidence-bundle.json artifact chain: FAILED result: VERIFICATION FAILED The point is narrow: a reviewer can confirm whether this copy still matches its recorded hashes. It does not certify compliance or replace assessor judgment. The value is not the PASS. The value is the named failure before deeper review time gets spent on the wrong packet. Demo page: [insert published 30-second demo URL] If useful, I can run the same one-control-family workflow against a redacted sample from your environment. No CUI needed.