Trust, demonstrated

The open verifier.

“Anyone can verify, with no contact with us” is an assertion. This page is the demonstration.

The answer first: the verifier at /verify is a single static page. It runs a vendored copy of noble-ed25519 (MIT, Paul Miller) entirely in your browser and makes zero network requests. Open your browser’s DevTools, watch the Network tab, and verify a receipt: nothing moves. Below: what a receipt contains, and how to check one with tools that are not ours.

As of 4 August 2026.

What the verifier is

One page, no server, nothing sent.

The verifier is a single static HTML page. The cryptography is a vendored copy of noble-ed25519, MIT-licensed, written by Paul Miller, audited in public, embedded in the page itself. There is no framework, no CDN, no analytics, no call home. The whole check, parse the receipt, reconstruct the signed bytes, verify the Ed25519 signature, happens in your browser’s memory.

Do not take that on faith. Open DevTools, switch to the Network tab, then drop a receipt on /verify. You will watch the check complete with the request count at zero. That is what “nothing is uploaded” looks like when it is true.

The receipt format, in plain language

What a receipt contains.

Every field below travels inside the signed record, except the last three, which ride alongside it. Nothing is hidden, and nothing is in any format you cannot read.

record_type

Always ai_work_receipt, so any verifier knows what it is looking at.

format

The receipt-format version, 1 today. It rides inside the signed record, so it cannot be changed without breaking the signature.

receipt_id

A unique name for the receipt (awr_…).

file_sha256

A SHA-256 fingerprint of the sealed document. Two algorithms are used…

file_sha3_256

…and a SHA3-256 fingerprint of the same document. A collision in one algorithm is not a collision in the other.

size_bytes

The sealed document’s size when it was sealed.

declared_ai_use

The tools and the use the reviewer declared, in the reviewer’s words.

ai_role

The role AI played, draft, research, and so on.

reviewer_name

The person certifying, over their own name.

review_attestation

Exactly what the reviewer attests to, in their words. The statement is theirs; the seal is ours.

review_checks

The checks performed, sorted, so the canonical form is stable.

evidence_level

declared, today: the record is an attestation, not a detection. We attest; we never detect.

timestamp_utc

When the record was sealed, in UTC.

time_basis

Who says so: witnessed (an independent RFC 3161 timestamp authority, online) or self-asserted (offline). The receipt says which, on its face.

tier

What made it: the plan, or free-demonstration for specimens like the one below.

seq

This receipt’s position in the local ledger.

prev_receipt_sha256

The fingerprint of the receipt before it, the hash chain. A missing or altered entry breaks the chain, and the break shows.

filename_sha256

A fingerprint of the filename, not the filename itself.

signing_public_key_b64

The public half of the key that signed. It travels inside the wrapper, so verification never needs us.

record_signature_b64

The Ed25519 signature over the canonical receipt bytes.

alg

Ed25519.

Without our code

Verify it yourself, with your own tools.

Three steps. The first two replace our verifier entirely; the third replaces our file check. We ran this exact recipe against the specimen below before publishing this page. It passes.

01Reconstruct the canonical receipt. Take the receipt object and serialize it as JSON with the keys sorted alphabetically and compact separators, no spaces, UTF-8. Those exact bytes are what was signed. The key order in the file does not matter; the canonical form sorts them.

02Verify the Ed25519 signature over those bytes, using the public key embedded in the wrapper and any standard tool. Five statements in Python’s cryptography library:

import json, base64
from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PublicKey
w = json.load(open("specimen.receipt.json"))
msg = json.dumps(w["receipt"], sort_keys=True, separators=(",", ":")).encode()
Ed25519PublicKey.from_public_bytes(base64.b64decode(w["signing_public_key_b64"])).verify(
    base64.b64decode(w["record_signature_b64"]), msg) # silence = intact; InvalidSignature = changed

OpenSSL’s pkeyutl -verify -rawin does the same once the raw key is wrapped as PEM. Any correct Ed25519 implementation reaches the same answer, because the answer is a property of the math.

03Check the document yourself. shasum -a 256 yourfile and compare with file_sha256. A match means the document in front of you is the document that was sealed, byte for byte.

A specimen to test against

Try the recipe on this.

Demonstration specimen, a public sample published on this page. Not a customer record; it carries no standing.

{"receipt":{"record_type":"ai_work_receipt","format":1,"receipt_id":"awr_e2573ba220ae","file_sha256":"e9a5f3d55b3c74aa312a62731ebf2dd1e46fb96cd618ff1a486588d203e18928","file_sha3_256":"5573f0e748eb06a1595a8c429fe8ae850c50aff631a1c75de574e403300a3821","size_bytes":69,"declared_ai_use":"Claude Opus 4.5 for drafting; ChatGPT for research","ai_role":"draft","reviewer_name":"M. Hale, Attorney","review_attestation":"All citations independently checked against the reporters; quotations compared to their sources; the argument is mine.","review_checks":["citations_verified","facts_checked"],"evidence_level":"declared","timestamp_utc":"2026-08-03T23:00:58Z","time_basis":"self-asserted","tier":"free-demonstration","seq":3,"prev_receipt_sha256":"ae1c15c8d8c5346267ca6c638a828c9ec03885dae9db8638355adc7f00fac9d2","filename_sha256":"0fd5a80fc5909aa82d350416ad8b5be3502680d19fa6976f1e404acfca17d108"},"signing_public_key_b64":"gmhPzxF2Hr5BFr/5DM/NvYRTAiIh8hoMtGDo1NvzizE=","record_signature_b64":"1y62OMvsqlMSAuyLJ73UTb6fW+/Gt0zi4ukHCSoGpuIvu/a1BbmV7Vs8qC5Rk+3/FF2ILWHJCFMz3J9iewhNBA==","alg":"Ed25519"}

Feed it to the recipe above, or drop it on /verify. Then change one character and watch the seal break. The specimen’s time basis is self-asserted and its tier is free-demonstration; a receipt from the plan reads differently, and says so.

Independence

Verification outlives us.

The verifier is open; the engine that signs is not. We sell the sealing, not the checking, verification is a property of the cryptography, not a service we sell, and it is free forever, with no account.

And it outlives us. Save the verifier page, File, Save, and it keeps working, offline, forever. If Regulayer, LLC disappeared tomorrow, every receipt we ever sealed would still verify, because the check never needed us. That is the point of building it this way, and it is why cancelling costs your receipts nothing: support answers for that, same day, from a person.

Verify a receipt now Support