Module proof 

lean-ctx value: every number the value surface shows, re-derived from the two tamper-evident chains instead of the display counters.

• Tokens come from the savings ledger (SHA-256 chain, session_id committed since canonical v7).
• Security events come from the audit trail (SHA-256 chain, Ed25519 signed; kind, count and session committed in the hashed action).

Both chains are re-walked from genesis first. A broken chain makes the report tampered: the numbers are still printed, but flagged as not proof, and the CLI exits non-zero.

Structs

ChainCheck

Evidence

First and last entry_hash of the chain entries a claim rests on — anyone can look them up in the JSONL file.

Proof

Functions

build

The proof over the local chains. session = None and lifetime = false picks the most recently active session (from value/current.json).

build_from

Builds the proof for session (or lifetime) from the chains at the given paths. A missing file is an empty, intact chain.

build_lifetime_for

The lifetime proof over the local chains for one project.

build_scoped

build_from narrowed to one project’s ledger events and audit entries (None: every project). An audit entry without a session belongs to no one project, so a project’s proof leaves it out.

render

Human report. Every value line carries its label and source.

verified_security_evidence

✓ measured lifetime security events together with the audit-trail entry hashes they rest on, for a signed savings-batch tally: only the kinds that tally carries (see SecurityCounts::signed_tally_projection), so the evidence names exactly the entries the counts rest on. None when there is no trail or it fails verification.

verified_security_since

✓ measured security events since cutoff (lifetime when None), from the local audit trail. None when the trail fails verification, so a tampered chain never reaches a report or share card.