Defense Pack · Zero-trust verification

Verify the signoff hash yourself. In your browser.

This page is a vanilla-JavaScript implementation of OilFlow's canonical-JSON + SHA-256 algorithm. Paste the JSON response from /api/v1/defense/{request_id}/raw below and the page recomputes the digest locally using the browser's built-in SubtleCrypto. No OilFlow code runs in the verification path. Source: View Source on this page to read the algorithm verbatim.

The computation runs entirely in your browser viawindow.crypto.subtle.digest. Nothing is sent to OilFlow.

Reference algorithm (verbatim — feel free to lift this into your own audit tool)

function canonicalize(value) {
  if (value === null || typeof value !== "object") return JSON.stringify(value);
  if (Array.isArray(value)) return "[" + value.map(canonicalize).join(",") + "]";
  const keys = Object.keys(value).sort();
  return "{" +
    keys.map(k => JSON.stringify(k) + ":" + canonicalize(value[k])).join(",") +
  "}";
}

async function sha256Hex(text) {
  const buf = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(text));
  return [...new Uint8Array(buf)].map(b => b.toString(16).padStart(2, "0")).join("");
}

// Usage: sha256Hex(canonicalize(payload_fields)) === signoff_hash

How to use this page from a regulator perspective

  1. Obtain the raw payload via GET /api/v1/defense/{request_id}/raw. The bank's MLRO has DEFENSE-scope API access to make this call on your behalf. The response contains the canonical payload bytes + the stored signoff_hash.
  2. Copy the JSON response and paste it into the box below.
  3. The verifier extracts canonical_payload_bytes, computes SHA-256 in the browser, and compares to the row's signoff_hash. Match = pack integrity intact since signing. Mismatch = post-sign tampering on one of the hashed fields.
  4. For full audit-trail review, the verifier additionally recomputes the canonical JSON from payload_fields using the published algorithm and compares to canonical_payload_bytes. Match here = OilFlow's server-side canonicalization implementation agrees with the browser-side reference.

Trust model: this page is served from oilflow.us. If you don't trust OilFlow to serve a valid implementation, View Source and read the JavaScript yourself — the algorithm is small enough to audit by eye. Or copy the algorithm into your own static page on your own infrastructure and run it from there. The reference algorithm (~20 lines) is also embedded in the page output below for reproducibility.