LOCAL RECEIPT + ARTIFACT INTEGRITY
Receipt Verifier
Recompute the receipt core, compare exact artifact bytes and export a reviewable verification record—without uploading the evidence packet.
Public protocol utility · locally reviewed · 2026-07-13
Verify bytes, not promises
PUBLIC METHOD
Deterministic verification with a bounded claim
Canonical core
The verifier removes only receipt_core_sha256, deterministically sorts object keys and hashes the resulting UTF-8 JSON bytes with Web Crypto SHA-256.
Local artifacts
Selected files are read as local Blob bytes. Nothing is uploaded; normal static page asset requests may still occur.
Worked sample
The sample is explicitly synthetic and includes one generated local artifact so PASS can be independently reproduced.
Sources
LIMITS AND PRIVACY
What this verifier can and cannot prove
- A PASS means the recomputed receipt core and all artifacts supplied in this run match the declared byte identities. It does not prove that the underlying claims are true.
- Executable engine files are never accepted or executed. A declared engine_sha256 is displayed as a statement, not independently verified engine code.
- Supplied parent receipt documents are verified recursively within the declared bounds. A missing parent stays INDETERMINATE and a mismatch BLOCKS; parent artifact bytes are outside the chain result.
- Receipt JSON and each parent receipt are limited to 2 MiB; the parent chain is limited to 100 documents, 20 MiB total and depth 32. Artifacts are limited to 100 files, 25 MiB per file and 100 MiB total. Excess input fails closed.
- Receipt and artifact bytes remain inside this browser tab. FastTool does not upload them; ordinary static asset and consented analytics requests are outside the evidence payload.
VERIFY A REAL RELEASE
Verify FastTool's exact direct-download bytes
FastTool Evidence v0.3.0 ships GitHub Actions privilege, OpenAPI, SARIF and LLM regression gates as a local CLI and self-contained CI Action archive. Compare the SHA-256 manifest, then load the Receipt v1 and exact downloaded artifacts above.
Exact bytes are published directly by FastTool. Public GitHub, npm and Marketplace availability is not claimed unless the channel-status attestation says PASS. SHA-256 proves byte integrity, not security, authorship or legal admissibility.
REPEATABLE WORKFLOWS
Create an evidence packet, then verify the bytes
The verifier does not decide whether a claim is true. It proves whether the supplied receipt core and artifact bytes still match the packet produced by a FastTool workflow.