[Feature Request]: Cryptographic Hash Chaining for Immutable Audit Trails

[Moresh-Mishra]

Problem

Currently, Evidence Protector Pro detects anomalies within a single log file session, but there is no mechanism to prove that the analysis itself was not tampered with between sessions. In a legal context, this is a critical gap — a defense attorney could argue that the analyst modified findings after the fact, or that two sessions analyzing the same file produced different results without explanation.

Proposed Solution

Implement SHA-256 cryptographic hash chaining across analysis sessions, similar in concept to how blockchain links blocks. Each session would:

1. Hash the input file — Compute a SHA-256 digest of the uploaded log file at ingestion time
2. Hash the analysis output — Compute a digest of the findings (anomalies, timestamps, scores)
3. Chain to the previous session — Include the previous session's hash in the current session's hash computation
4. Store a session manifest — Save a lightweight JSON ledger locally (in the existing session persistence layer) recording the chain

Example Session Manifest Entry

{
  "session_id": "a3f9...",
  "timestamp": "2025-05-02T10:34:00Z",
  "file_hash": "sha256:e3b0c44...",
  "findings_hash": "sha256:d4a1f2...",
  "previous_session_hash": "sha256:8c7b3e...",
  "chain_hash": "sha256:91ac77..."
}

Why This Matters

• Legal admissibility — Proves the evidence and analysis are untouched from collection to court
• Analyst accountability — Any retroactive modification of findings breaks the chain visibly
• Zero external dependency — Entirely local, consistent with the project's privacy-first architecture
• Exportable proof — The chain manifest can be included in PDF/JSON exports as a verification artifact

Acceptance Criteria

• SHA-256 hash computed for every uploaded file at ingestion
• SHA-256 hash computed for every analysis output
• Sessions linked via previous-session hash inclusion
• Local chain manifest stored and readable across sessions
• UI indicator shows whether the chain is intact
• Chain manifest included in PDF and JSON exports
• Broken chain triggers a visible warning to the analyst

[Moresh-Mishra]

I would like to work on this as a NSOC'26 contributor

[sutanjoyb]

Proceed!

[Praptii21]

@sutanjoyb hey can u add nsoc and level lablels to my PR #115