Tamper-evident vector writes — a Merkle / hash-chain write-ahead log that gives every write to a vector store cryptographic evidence of what was stored, when, and by whom. Part of the ruvector ecosystem.
Every major vector DB (Qdrant, Milvus, Weaviate, LanceDB, FAISS) accepts writes with zero integrity evidence. This crate closes that gap — the defense against silent memory poisoning (the MemoryGraft attack, arxiv 2512.16962).
Admit a WritePayload, get a WriteReceipt you can store alongside the index entry and verify
offline. The gate's chain root is a cryptographic commitment to the entire ordered write log: any
mutation, insertion, deletion, or reorder of writes produces a different root.
use ruvector_proof_gate::{HashChainGate, WriteGate, WritePayload};
let mut gate = HashChainGate::new();
let receipt = gate.admit(&WritePayload::new(id, vector).with_agent(agent_id))?;
// store `receipt` with the index entry; later:
assert!(gate.verify_receipt(&receipt)); // ~6 ns
assert!(gate.verify_integrity()); // full cryptographic re-derivation of the chain
let root = gate.chain_root(); // publish/anchor this commitmentMeasured (DIM=128): HashChainGate.admit ≈ 700 ns/write (~1.4 M/s), verify_receipt ≈ 6 ns
(157 M/s). The integrity tax is ~675 ns/write — negligible next to the HNSW insertion a real write
already performs.
- Any mutation / insertion / deletion / reorder changes the root.
- Forged commitments, out-of-range receipts, and foreign-chain receipts are rejected (no panic).
verify_integrity()re-derives every commitment from genesis + stored payload hashes — it catches a tamper that mutates a commitment, a payload hash, the order, or desyncs lengths.
serde— derive serialization for receipts (off by default).
MIT OR Apache-2.0 © Ruvector Team. See ADR-194 for design notes.