MapleVault

Canada's procurement rules turn on whether a product is “Product of Canada” or “Made in Canada”, but across a multi-tier supply chain those claims rest on supplier self-reporting that nobody can verify or reconstruct afterwards.

The Ottawa Defence Hackathon's cryptographic-provenance challenge asked for a system in which every supplier contribution is a signed attestation, attestations hash-link across tiers into a tamper-evident chain, and an independent verifier computes the Canadian-content percentage while detecting forgery, tampering, replay and statistical anomalies. The worked example was a drone.

• Each supply-chain step is a JSON attestation (supplier, action, country, quantities, costs and the hashes of its parents) signed with Ed25519 over a byte-exact canonical serialization. Attestations form a directed acyclic graph that can arrive in any order and is re-indexed from its parent links.
• A stateless FastAPI service exposes one endpoint. The whole chain travels in the request, so there is no database: the service rebuilds the graph, sums costs by country, walks back from the product to the last substantial transformation, assigns the designation (98% Canadian content with a Canadian last step for Product of Canada, 51% for Made in Canada) and then runs every detector.
• Sixteen deterministic rules: invalid or unknown signatures, parent-hash mismatches, dangling parents, cycles, unit and mass-balance violations across diamond-shaped graphs, timestamp inversions, implausible labour rates, replay within and across chains, and anchor-registry mismatches. Four statistical detectors sit beside them, with baselines distilled offline from the 1,000-chain training corpus.
• Precision over recall, on purpose. The challenge scores an F1, so the statistical thresholds sit a margin above the genuine maximum (z-scores of 3.5 and 3.6), and the two families that give up recall are documented as a deliberate trade rather than tuned until they flag honest suppliers.
• A React 19 and Vite front end: a landing page plus Purchaser, Supplier and Playground routes. Purchasers scan a QR code (it carries only a link with the product id, never chain data) and get the verdict, the Canadian-content percentage, a cost-by-country table and an interactive graph of the chain. Suppliers sign attestations in the browser with the same canonical JSON and Ed25519, checked against the same golden vectors as the backend. The playground lets you edit one signed field and watch the hash links break downstream.

Against the labelled 1,000-chain corpus the verifier scored 98.3%, with 100% on every hard-rule attack family and zero false positives across the 705 clean chains; the gap is in two statistical families where the thresholds favour honest suppliers. Measured throughput was about 1,370 requests a second on eight workers of a 12-core host, roughly 4 ms a chain.

Fifty backend tests, five golden-vector tests and 114 front-end tests run on every change, and a corpus guard fails the build if clean-chain false positives ever rise above zero.

Jowi Aoun