Design privacy-aware audit records

1. 01

   Concepts & system design

   60 min· read · map the mechanismtimer

   R38 — RFC 8785 JSON Canonicalization Scheme

   R27 — OpenTelemetry audit fields & privacy retention

   Read the assigned sections; map the mechanism, threat model and trade-offs.

2. 02

   Project implementation

   120 min· build · integrate · debugtimer

   Build the full tamper-evident trajectory-ledger (D11): canonicalize JSON event records using RFC 8785, compute sequential SHA-256 hash chains (H_n = SHA256(H_{n-1} || canonical_event_n)), enforce append-only access controls, and redact raw prompts in favor of hashes/vault references.

   Build, integrate, debug and improve the increment in the active project.

3. 03

   Security lab

   60 min· attack your own systemtimer

   Attempt to mutate, delete, or reorder an intermediate database audit record; prove the D11 chain verifier immediately pinpoints the tampered sequence number.

   Test the abuse case, failure path, authorization bypass or resource limit.

4. 04

   Verification & evidence

   30 min· test · record evidencetimer

   D11 hash-chain implementation + tamper-detection unit and integration tests.

   Add or run regression tests; record the 9-point evidence record.

5. 05

   Deliberate practice & Socratic review

   30 min· explain aloud · update gapstimer

   Answer the 8 Socratic questions without notes: What? Why? How? What if? Why not? How can I prove it? Where can it break? What have I learned?

   Re-explain the hardest concept aloud, inspect one edge case, update the gap log.

6. total5 h

• R27OpenTelemetry Documentation↗ opentelemetry.io

  Traces, spans, context propagation, semantic conventions, and redacting sensitive attributes.

• R38RFC 8785 (JCS)↗ rfc-editor.org

  JSON Canonicalization Scheme: deterministic key sorting and number formatting required before cryptographic hashing.

Read only the named sections needed for today's task. Reading sits inside the 60-minute concepts block; it is not extra time.

• docsIETF / RFC Editor
  RFC 8785: JSON Canonicalization Scheme (JCS)

  Specifies deterministic key ordering and number serialization, without which two encodings of the same event hash differently and the chain breaks.

  R38moved 2026-11-11
• videoKeytos Security
  How Do Certificate Transparency Logs Work?

  Explains append-only logs with signed checkpoints, the real-world model for making a trajectory ledger tamper-evident rather than just append-only by convention.

  R38checked 2026-11-11
• videoLightstep is now ServiceNow Cloud Observability
  Context Propagation makes OpenTelemetry awesome

  Covers trace and span context propagation, the identifier you bind each ledger event to so hash-chained records still join to distributed traces.

  R27checked 2026-11-11
• articledev.to
  The Architecture Behind Tamper-Proof Audit Logs

  Describes SHA-256 hash chaining where each record commits to its predecessor, plus anchoring and verification, matching the H_n = SHA256(H_{n-1} || event_n) design.

  R38checked 2026-11-11
• repoGitHub
  audit-log

  Python implementation of an append-only SHA-256 hash-chained log with offline integrity proof and tamper localisation, a working reference for D11.

  R38checked 2026-11-11

A lab is complete only when it produces evidence. Installing PyRIT, Garak, Presidio or TransformerLens is not completion. Saved on this device only.