Every ingested file gets a chain-of-custody receipt.
"Did this data arrive intact, and can we prove it later?" at1 custody turns every ingested file into one hash-chained append in a per-site ledger — source, content SHA, row count, timestamp. Verification doesn't just detect tamper, it localizes it to the offending record, and an embeddable "Data custody: verified" badge lets anyone re-check the chain.
- one file → one receipt
- each ingested file is a single hash-chained ledger append
- tamper localized
- not just 'something changed' — exactly which record changed
- re-verifiable
- anyone with the ledger can re-check the whole chain
- embeddable badge
- a 'Data custody: verified' mark for your own UI or report
A receipt per ingest
Each file that lands records source, content hash, row count and timestamp as one append. The receipt is the proof that this exact file, with these exact rows, arrived when it says.
Hash-chained ledger
Every receipt links to the one before it. Altering, inserting or dropping a record breaks the chain — and verify points at the exact link that broke.
Verified badge
Render a 'Data custody: verified' badge backed by the live chain state. It flips the moment verification fails, so a stale or tampered ledger can't keep showing green.
The workflow
# record an ingested file: one hash-chained receipt in the site ledger at1 custody add incoming/cashup_2026-07-14.csv --site branch-07 # re-check the whole chain; on tamper it localizes the offending record at1 custody verify --site branch-07 # render the embeddable "Data custody: verified" badge at1 custody badge --site branch-07 -o custody-badge.svg
Honest scope
The receipt proves a file's content and arrival order haven't changed since it was recorded — it does not vouch for what happened upstream before ingest, or that the source itself was honest. Tamper-localization is designed to pinpoint the first broken link; the right check is your acceptance test on real data — edit a byte in an archived file and confirm verify names it. Validated on synthetic ingest streams; partner acceptance on live pipelines is pending.