Cryptographic Primitives Reference

Reference documentation for models, mixins, services, and CLI commands provided by Framework M's cryptographic immutability subsystem.

---

1. Domain Mixins & Meta Configuration

TamperProofMixin

Located in libs/framework-m-core/src/framework_m_core/domain/mixins.py.

Field	Type	Description
prev_hash	str | None	Hex-encoded SHA-256 digest of the predecessor record in the stream partition.
hash	str | None	Hex-encoded SHA-256 digest: sha256(prev_hash : JCS(payload)).

CryptoSignMixin

Located in libs/framework-m-core/src/framework_m_core/domain/mixins.py.

Field	Type	Description
payload_hash	str | None	SHA-256 digest of canonical JCS payload (hex).
node_signature	str | None	Ed25519 signature generated by node key provider.
operator_signature	str | None	Ed25519 signature generated by operator key/token.
operator_id	str | None	Identifier of the operator.
node_id	str | None	Unique node identifier.
stream_id	str | None	Partition/stream identifier.
sequence_no	int | None	Monotonically increasing sequence number.
prev_outbox_hash	str | None	Chained hash of the previous outbox entry.
signed_at	datetime | None	UTC timestamp of signature generation.

DocTypeMetaConfig Flag

Set inside class Meta on any BaseDocType:

class Meta:
    tamper_proof: bool = True

---

2. Core Cryptographic Classes

TamperManager[T: BaseDocType]

Located in libs/framework-m-standard/src/framework_m_standard/adapters/db/tamper_manager.py.

• check_mutation_allowed(operation: str) -> None: Raises TamperProofMutationError if is_tamper_proof is True and operation is "update" or "delete".
• get_previous_hash(session, stream_id) -> str: Queries the latest committed hash for the stream partition.
• calculate_hash(entity, prev_hash) -> str: Computes sha256(f"{prev_hash}:{canonicalize(data)}").

CryptoOutboxSealer

Located in libs/framework-m-standard/src/framework_m_standard/adapters/crypto/outbox_sealer.py.

• seal_pending_entries(session, batch_size=100) -> int: Fetches unsealed pending rows, computes canonical JCS hash, assigns sequence_no and prev_outbox_hash, and signs with node key.

IngressVerificationService

Located in libs/framework-m-standard/src/framework_m_standard/services/ingress_verification_service.py.

• verify_envelope(envelope, raw_payload=None) -> IngressVerificationResult: Evaluates active node status, sequence tracking, payload hash match, and Ed25519 signatures.

MerkleTree

Located in libs/framework-m-standard/src/framework_m_standard/adapters/crypto/merkle_tree.py.

• root: str: The root SHA-256 hash of the binary tree.
• get_inclusion_proof(leaf_index: int) -> list[dict[str, str]]: Returns the audit path for verifying leaf inclusion.
• verify_inclusion_proof(leaf_hash, leaf_index, total_leaves, proof, root_hash) -> bool: Verifies proof against the root hash.

---

3. CLI Commands

m crypto

• m crypto keygen [--path <file>]: Generates an Ed25519 node keypair.
• m crypto inspect-key [--path <file>]: Prints the hex-encoded 32-byte public key.

m audit

• m audit verify-chain [--doctype <name> | --all] [--stream <id>]: Validates chronological hash continuity.
• m audit forensic-trace --doctype <name>: Locates the first corrupted record in a broken chain.
• m audit rehydrate --doctype <name> [--stream <id>]: Replays immutable events via ProjectionRehydrationProtocol.

---

4. Healthcheck & Metrics

• GET /health/integrity: Returns HTTP 200 (healthy) or HTTP 503 (tampered) with details of registered tamper-proof DocTypes.
• GET /metrics: Exports Prometheus gauge chain_integrity_status{doctype="...", stream="..."} (1 = intact, 0 = broken).