Post Oak Labs · Interactive Tool

Touch the hash. Watch it break.

The explainer shows you how OpenChainGraph works. This sandbox lets you feel it. Edit any field in a live OCG v0.3 artifact and the execution_hash recomputes in your browser — using the real WebCrypto SHA-256 algorithm, the same way a conformant tool does it. Then deliberately tamper with data and see exactly how the fingerprint fails.

WebCrypto SHA-256 Zero server — fully client-side Real OCG v0.3 preimage construction No PII

New here? Start in 30 seconds

Three things to try in this sandbox

Artifact Editor — change any field on the left and watch the hash on the right recompute live. Start with var_10d_99.
Tamper controls — hit "Flip an output digit" to corrupt the artifact. The red verdict tells you exactly which characters broke.
Hash Playground (top tab) — type your own text and see SHA-256 recompute in real time. Change one character to trigger the avalanche effect.

Need more context? → Explainer

Artifact fields — edit any value

Identity

tool_id

mandate_type

policy_parameters (inputs — these get hashed)

confidence_level

holding_period_days

portfolio_id

output_payload (results — these get hashed too)

var_10d_99

es_97_5

breaches_250d

⚠ Tamper controls — introduce deliberate corruption

Verification result

✓

Hash verified

The stored execution_hash matches the freshly computed SHA-256 of the canonical preimage. This artifact has not been tampered with.

Stored execution_hash

—

Freshly computed hash (live)

—

Character-level diff — stored vs live

Extract fields for hashing

policy_parameters + output_payload selected

Sort keys recursively

Keys sorted: breaches_250d, confidence_level, es_97_5, holding_period_days, portfolio_id, var_10d_99

JSON.stringify + UTF-8 encode

— bytes

WebCrypto SHA-256

crypto.subtle.digest("SHA-256", bytes)

Compare to stored hash

—

Hash preimage (canonical JSON)

Why tool_id and mandate_type aren't hashed

Only policy_parameters and output_payload enter the preimage. Metadata like tool_id and chain describe the artifact but don't affect the decision's mathematical content — hashing them would make the hash change when you rename a tool without changing any computed values. The hash is a fingerprint of the decision, not the packaging.

Each case below presents a broken OCG artifact. One or more things are wrong. Read the artifact carefully, then diagnose what went wrong. This is how a real auditor encounters OCG failure modes — not in a tutorial, but in a field report.

Type anything and get a live SHA-256 hash. Then see the avalanche effect — how one character change scrambles the entire output. Finally, understand exactly what OCG puts through the hash function and why the preimage is constructed the way it is.

Type anything → live SHA-256

SHA-256

computing…

Avalanche Effect

Two inputs that differ by a single character. Watch how much of the hash changes — every character is affected.

Input A

$2,847,300

—

Input B — one digit changed

$2,847,400

—

How OCG builds its preimage — why it's not just hash(inputs)

A naive implementation might just hash the raw JSON string. OCG specifies a 4-step canonical construction so that the hash is identical regardless of which JSON library, programming language, or runtime produced the artifact:

Select only decision content: extract policy_parameters and output_payload into a new object — nothing else enters the hash
Sort all keys recursively: traverse the object tree and sort every key at every level alphabetically — this removes ambiguity from JSON libraries that don't guarantee key order
Stringify without whitespace: call JSON.stringify(sorted, null) — compact, no newlines, no trailing spaces — then encode to UTF-8 bytes
SHA-256 via WebCrypto: call crypto.subtle.digest("SHA-256", bytes) — the browser's built-in implementation, no library dependency — and hex-encode the 32-byte result with the prefix sha256:

Live OCG preimage for your playground input (if valid JSON)

—

OCG execution_hash

—