Core Laravel Package

Technical Evaluation

Architecture Fit

Chronicle is a cryptographically verifiable audit logging solution designed for Laravel, addressing critical use cases like security logging, financial compliance, and forensic analysis. Its append-only ledger with hash chaining ensures tamper-proof audit trails, making it ideal for systems requiring immutable, verifiable records (e.g., regulatory compliance, fraud detection, or operational observability).

Key architectural strengths:

• Immutable ledger: Prevents modification/deletion of past entries via cryptographic hashing.
• Hash chaining: Each entry’s validity depends on the previous one, ensuring end-to-end integrity.
• Signed checkpoints: Periodic cryptographic proofs of ledger state, enabling verifiable snapshots.
• External anchoring: Optional integration with third-party append-only sinks (e.g., RFC 3161 timestamps, S3 Object Lock) to prevent database-level tampering.
• Key rotation support: Securely transitions signing keys without breaking historical verifiability.

Fit for: ✅ High-assurance audit trails (e.g., financial systems, healthcare, legal compliance). ✅ Post-mortem forensics (e.g., security incidents, fraud investigations). ✅ Regulatory reporting (e.g., GDPR, SOX, PCI-DSS). ✅ Operational observability (e.g., tracking critical system changes).

Not ideal for: ❌ High-throughput, low-latency logging (hash chaining adds computational overhead per entry). ❌ Systems where audit logs are rarely queried (overkill for simple debugging logs). ❌ Environments without PHP 8.2+ or Laravel 12/13 (hard dependency on ext-sodium/ext-openssl).

Integration Feasibility

Chronicle integrates seamlessly into Laravel via:

1. Eloquent Trait (HasChronicle) for automatic model auditing.
2. Manual recording API for custom events.
3. Artisan commands for management (e.g., chronicle:checkpoint, chronicle:verify).
4. Query builder for filtering entries by actor, action, subject, or tags.

Database Schema:

• Adds two tables (chronicle_entries, chronicle_checkpoints) with indexes for performance.
• No schema migrations are required for existing apps (but chronicle:install handles setup).

Dependencies:

• Hard: PHP 8.2+, Laravel 12/13, ext-sodium, ext-openssl.
• Soft: Optional anchoring providers (e.g., AWS S3, RFC 3161 TSA).

Compatibility Risks:

• Legacy Laravel: Requires Laravel 12/13 (no support for older versions).
• Custom signing providers: May need adjustments for non-Ed25519/ECDSA setups (e.g., HSMs).
• Database changes: If using non-MySQL/PostgreSQL, may need custom migrations for ULID/JSON fields.

Technical Risk

Critical Path Risks:

1. Hash chain breaks: If an entry is accidentally modified (e.g., via raw SQL), the ledger becomes invalid until the next checkpoint.
2. Key loss: Irrecoverable if the active private key is lost (backup private_key securely).
3. Anchoring failures: If external sinks (e.g., TSA) are unavailable, checkpoints may fail to anchor.

Key Questions for TPM

1. Compliance Requirements:

   • Does the system require externally verifiable audit trails (e.g., for regulators)?
   • Are signed checkpoints and external anchoring mandatory, or is internal verification sufficient?

2. Performance Constraints:

   • What is the expected audit log volume (e.g., entries/sec)? Will hash chaining impact latency?
   • Can batch recording (e.g., queue workers) be used to reduce overhead?

3. Key Management:

   • Who controls the signing keys? Will HSM/KMS (e.g., AWS KMS) be used, or will keys reside in the app?
   • What is the key rotation policy (e.g., monthly, per-deployment)?

4. Operational Workflow:

   • How often will checkpoints be created? (Affects verification efficiency.)
   • Will automatic anchoring be enabled, or will it be manual?

5. Disaster Recovery:

   • How will the ledger be restored after a database failure?
   • Are verifiable exports needed for backup/archival?

6. Legacy Integration:

   • Are there existing audit logs that need to be migrated into Chronicle?
   • Will third-party systems need to query Chronicle directly?

7. Cost Implications:

   • Will external anchoring (e.g., TSA, S3 Object Lock) incur additional costs?
   • Are there storage costs for ledger exports/checkpoints?

Integration Approach

Stack Fit

Chronicle is optimized for Laravel but can be adapted for PHP-based monoliths with minor adjustments. Key compatibility factors:

Recommended Stack:

• Laravel 13 (latest LTS).
• PostgreSQL/MySQL (supports JSONB/ULID natively).
• Redis (for queue-backed recording if needed).
• AWS KMS/HSM (for secure key management).

Migration Path