
EDUCATIONAL DEMO — NOT REAL EVIDENCE
------------------------------------
This package demonstrates, using your real SQL schema and county names, how
a hypothetical tamper (+600,000 for Candidate 2 / `pres_2022_ruto`) *could*
be reflected in data and logs. All modifications are synthetic and clearly
labeled as DEMO. Do not present these files as real evidence.

Files
-----
- before_real_schema.csv  : Snapshot from your SQL file (parsed)
- after_demo_tamper.csv   : Same data with +200,000 per county for NANDI, UASIN GISHU, KERICHO
- audit_log_demo.jsonl    : Hash-chained "forensic-style" log of the DEMO edits
- demo_tamper_patch.sql   : Example SQL of the DEMO edits (do not run on real systems)
- cli_report_real.py      : CLI tool to verify the log chain and echo anomalies

Quick start
-----------
python3 cli_report_real.py --log audit_log_demo.jsonl --before before_real_schema.csv --after after_demo_tamper.csv --echo

Notes
-----
- Target field is `pres_2022_ruto` (candidate 2 for this demo). You can change it via --target.
- County focus defaults to "NANDI,UASIN GISHU,KERICHO". Change with --counties.
- The log is hash-chained for integrity demonstration.
