How to Implement Sequential Document Signing with SHA-256 Audit Records

The Engineering Anatomy of a Legally Sound E-Signature

In software development, it is surprisingly easy to create an illusory e-signature: render a canvas element, capture a mouse drag as an image, and overlay that image onto a PDF. However, in enterprise litigation, contract law, or regulatory audits, such an implementation fails basic admissibility checks.

To achieve legal enforceability under electronic signature frameworks (such as the Indian Information Technology Act and US ESIGN Act), the signing system must provide mathematical proof of integrity: who signed, when did they sign, what exact document version did they inspect, and has the document changed by even a single byte since that moment?

“Cryptographic non-repudiation transforms an electronic agreement from a fragile image into an unforgeable mathematical proof.”

Sequential vs Parallel Recipient State Orchestration

A robust signing workflow models signers as a deterministic finite-state machine (FSM). In a sequential flow (Signer 1 -> Signer 2 -> Approver), Signer 2 must not be issued a signing token until Signer 1 has successfully executed and verified their commitment.

When Signer 1 signs, the platform computes the interim hash, binds their IP address, timestamp, and signature vector, and registers the transition in an append-only audit ledger before notifying the next recipient.

import crypto from 'crypto';

interface AuditEvent {
  recipientId: string;
  action: 'VIEWED' | 'SIGNED' | 'DECLINED';
  ipAddress: string;
  timestampUtc: string;
  previousHash: string;
}

export function generateAuditEntry(
  docBuffer: Buffer,
  event: Omit<AuditEvent, 'previousHash'>,
  previousHash: string
): { eventHash: string; auditRecord: AuditEvent } {
  // 1. Compute exact byte hash of current document snapshot
  const docHash = crypto.createHash('sha256').update(docBuffer).digest('hex');
  
  // 2. Cryptographically chain previous state to current action
  const payload = `${docHash}:${event.recipientId}:${event.action}:${event.timestampUtc}:${previousHash}`;
  const eventHash = crypto.createHash('sha256').update(payload).digest('hex');

  return {
    eventHash,
    auditRecord: { ...event, previousHash }
  };
}

Finalizing the Certificate of Completion

Once all designated parties complete their roles, Meteor Sign compiles an immutable Certificate of Completion. This certificate records the full hash chain, the SHA-256 fingerprint of the final executed PDF, participant email verifications, and RFC 3161 compliant server timestamps.

Because the hash chain is embedded into the document metadata, any external party can independently verify the agreement using standard cryptographic utilities without relying on our servers.