Proof that incidents became controls.
SOC 2 asks how incidents feed back into change management (CC7.4, CC8.1). The EU’s Digital Operational Resilience Act asks financial firms to learn from incidents (Article 13). Aftershock produces the evidence as a side effect of doing the work.
One signed bundle per incident
Download it from the incident page or the API. The payload is canonical JSON (RFC 8785), signed with Ed25519.
- The incident
- What happened, what should have happened, its source and severity.
- The fix
- The fix commit, the commit before it, and the pull request.
- Every proof attempt
- Outcomes before and on the fix, the runner, and SHA-256 hashes of the test and its log.
- The tests in memory
- Each proven test by hash, its nightly health, quarantine and the latest still-guarding re-proof.
- Every pull request it guarded
- The commit tested, the verdict, and any override with the reason a person gave.
import { readFileSync } from "node:fs";import { createPublicKey, verify } from "node:crypto";import canonicalize from "canonicalize"; // any RFC 8785 implementation const bundle = JSON.parse(readFileSync("INC-12.json", "utf8"));const { keys } = await (await fetch("https://aftershock-mk.vercel.app/.well-known/aftershock-jwks.json")).json();const jwk = keys.find((k) => k.kid === bundle.signature.kid);const ok = verify(null, Buffer.from(canonicalize(bundle.payload)), createPublicKey({ key: jwk, format: "jwk" }), Buffer.from(bundle.signature.value, "base64url"));Keys you can check
Public keys are published at /.well-known/aftershock-jwks.json. Retired keys stay listed, so bundles from before a rotation still verify. Self-hosted installations sign with their own key.