I built Merkle-chain evidence verification for CMMC compliance — here's why and how

This started with a frustrating conversation. A defense contractor friend failed their CMMC Level 2 assessment. Not because they hadn't done the security work — but because when the assessor asked "who last updated this document and when," the answer was effectively "we don't know." Their evidence was a folder of Word docs labeled things like final_v3_REALLYFINAL.docx. Technically fine content. No way to prove authenticity. That's what I ended up building Solymus around. Here's the core pattern: Artifact gets uploaded SHA-256 hash computed server-side Hash digest signed with KMS — ECDSA_SHA_256, MessageType=DIGEST (important: if you sign the full payload you'll hit the 4KB limit fast) Record stored in DynamoDB with the digest and signature Every night at midnight UTC, an attestation job seals that day's events into a Merkle root Each artifact gets a public /verify/{id} endpoint — no auth — that returns the hash, signature, and Merkle linkage One thing that bit me: right after upload, m