frank_verify
Verifies the integrity of the FRANK governance chain by checking every hash link and comparing the chain head against an external anchor, detecting tampering, edits, or gaps.
Instructions
Re-hash the entire FRANK governance chain and verify every prev_hash → hash link, detecting tampering, edits, or gaps. Returns the verification verdict, including where the chain breaks if it does.
Also checks the chain's head against the externally-held anchor at
$WILLOW_HOME/constitutional/frank_head_anchor.json when one exists
(#280): a chain can be internally consistent (every link valid) and
still not be the same chain it was yesterday — that's what an
edit-then-rechain() relink looks like from outside the database.
anchor_status reports which case applied: "anchored" (compared;
valid reflects both internal consistency AND the head match),
"unanchored" (no anchor file — most installs, opted out), "untrusted"
(anchor file failed the ownership/permission trust check), or
"unreadable" (missing/malformed). Only "anchored" means the head was
actually compared; the other three are reported explicitly rather than
silently treated as a pass. Use willow-mcp frank-anchor (CLI-only —
never an MCP tool, so an agent cannot mint its own anchor) to create or
refresh one.
On a head mismatch, anchor_in_chain says which of the two causes it is.
True means the anchored head is still in the chain at anchor_index, so
the anchored entries are untouched and entries_since_anchor rows were
simply appended after them — an anchor that has gone stale, not a
tampered chain. False means the anchored head is nowhere in this chain,
which is what an edit-then-rechain() relink looks like; investigate
before re-anchoring, because refreshing the anchor would erase the only
external record that the chain ever differed. anchor_count is the row
count recorded when the anchor was taken. A broken LINK (broken_at set)
also carries reason: "prev_hash linkage" (rows reordered, inserted or
deleted) or "entry_hash mismatch" (a row's own content edited), plus the
last good head reached before the break. Read-only; may take a moment
on a long ledger.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| app_id | Yes |