How to verify anything here

And, more importantly, what verification does not prove.

Record identity

Each claim version has a digest over a canonical serialization of the record with the digest field removed. The rules are deliberately small enough to re-implement from this description alone:

Object keys sorted by UTF-16 code unit; no insignificant whitespace.
Array order is preserved, because order is meaning.
Non-finite and non-integer numbers are rejected rather than coerced — a quantity belongs in a string with its units, not in a float whose formatting could vary between implementations.
SHA-256 over the UTF-8 bytes of the result.

Two people who have never met should compute the same digest for the same record. If they do not, the identity scheme is broken and we would rather you found out.

Checking an artifact

curl -sO https://tiffany.systems/demo/artifacts/demo-a-input.csv
shasum -a 256 demo-a-input.csv
# compare against the sha256 published on the claim version page

Checking a whole claim version offline

Each version has a portable bundle: one JSON file carrying the record, its digest, its citation, the artifact manifest and the verification recipe. It is designed to remain intelligible if this site, its database and its search disappear entirely.

curl -sO https://tiffany.systems/demo/bundles/demo-0001-v2.json
node -e "const b=require('./demo-0001-v2.json');console.log(b.record.statement,b.identity.digest)"

Re-deriving the digest yourself

The verifier used in the build is tools/verify.mjs in the site repository. It has no dependencies, so you can read all of it. Run it against a downloaded bundle:

node tools/verify.mjs demo-0001-v2.json

It re-canonicalizes the record, recomputes the digest, compares it to the published value, and checks every artifact digest in the manifest. It prints what it checked and what it did not.

What we cannot offer yet

There is no transparency log and no signing key hierarchy on this site today. Both were designed and deliberately deferred: with a single publisher and no external replications, a transparency log would add operational failure modes without making anything detectable that the published digest lock does not already detect. That reasoning is written down, with the conditions that would change it, in the deferred-systems ledger. When one of those conditions is met, the log gets built and this page will say so.