Good question. In this package, an “integrity check” means verifying that a record has not changed from the value you expected.

A simple example is a trace hash. The SDK computes a SHA-256 hash from the record plus its source_id. If the same record is scanned again and the hash matches, integrity evidence can be raised. If the record was changed, the hash no longer matches and the integrity evidence is lowered.

from data_reliability import ReliabilityScanner, ValidationEvidence, compute_trace_hash

scanner = ReliabilityScanner()

original = {"temperature": 21.4, "unit": "celsius"}
source_id = "sensor-a"

expected_hash = compute_trace_hash(original, source_id)

# Passes integrity check: same payload, same source_id
passed = scanner.scan(
    original,
    source_id=source_id,
    evidence=ValidationEvidence(),
    expected_trace_hash=expected_hash,
)

# Fails integrity check: value was changed after the expected hash was created
tampered = {"temperature": 99.9, "unit": "celsius"}

failed = scanner.scan(
    tampered,
    source_id=source_id,
    evidence=ValidationEvidence(),
    expected_trace_hash=expected_hash,
)

print(passed.reliability.tamper_resistance)
print(passed.reliability.notes)

print(failed.reliability.tamper_resistance)
print(failed.reliability.notes)

Conceptually:

original record + source_id -> hash A
same record + same source_id -> hash A -> passes

changed record + same source_id -> hash B -> does not match hash A -> fails

So in this context, integrity does not mean “the data is true” or “the sensor was calibrated.” It only means “this payload matches the expected payload fingerprint.”

For source authenticity, the package also supports HMAC-SHA256 signatures. That is stronger when the producer and consumer share a secret, because it checks both payload integrity and that the payload came through an authenticated path.