Source: nono (nolabs-ai) — Aug-2026 landscape pass (research/sandbox-landscape-synthesis-2026-08.md §4, top tier).
What
Extend SANDY_TOOL_AUDIT's flat JSONL tool-use log with a rolling hash-chain head (each line's hash includes the prior line's hash) and a session-end Merkle root printed/persisted by cleanup(). Optionally DSSE-signable later.
Why
Today the audit answers "what did this session do" but not "prove this log wasn't edited after the run." A prompt-injected/compromised agent (or anyone with write access to the sandbox) could tamper the flat log. nono ships exactly this (hash-chain + Merkle root + optional DSSE + executable-hash binding); it's a rigorous, on-brand strengthening of the HF-incident audit story already in CLAUDE.md — turns the log from a trail into an attestation.
Sketch
- Append a rolling
SHA-256(prev_head || line) to each JSONL write in the PreToolUse hook (sandy-tool-audit); store the running head.
- At
cleanup(), compute/print the Merkle root (or final chain head) alongside the existing "tool-audit.jsonl" pointer.
- No new subsystem; pure append + one hash per write.
Effort: S–M. Claude-Code-only today (same seam as SANDY_TOOL_AUDIT).
Source: nono (nolabs-ai) — Aug-2026 landscape pass (
research/sandbox-landscape-synthesis-2026-08.md§4, top tier).What
Extend
SANDY_TOOL_AUDIT's flat JSONL tool-use log with a rolling hash-chain head (each line's hash includes the prior line's hash) and a session-end Merkle root printed/persisted bycleanup(). Optionally DSSE-signable later.Why
Today the audit answers "what did this session do" but not "prove this log wasn't edited after the run." A prompt-injected/compromised agent (or anyone with write access to the sandbox) could tamper the flat log. nono ships exactly this (hash-chain + Merkle root + optional DSSE + executable-hash binding); it's a rigorous, on-brand strengthening of the HF-incident audit story already in CLAUDE.md — turns the log from a trail into an attestation.
Sketch
SHA-256(prev_head || line)to each JSONL write in the PreToolUse hook (sandy-tool-audit); store the running head.cleanup(), compute/print the Merkle root (or final chain head) alongside the existing "tool-audit.jsonl" pointer.Effort: S–M. Claude-Code-only today (same seam as SANDY_TOOL_AUDIT).