Check an AI agent's audit certificate

Drop an .elc file below. It is checked here, in your browser, by the same code as the verify-cert command. Nothing is uploaded.

Verify

Choose a certificate, or drop it here Any .elc file. It never leaves this page.

Or try a sample

Requirements

Require a signature Require a Bitcoin anchor

Upgraded timestamp (.ots, optional)

Expected signing key (hex, optional)

Checking: nothing yet

What a pass means, and what it does not

Valid

Nothing the signature covers has changed since signing: the event hashes, their order, the findings and the goal.

Who signed it

A key read from the file only proves the file signed itself. Paste a key you got from the issuer to check who.

Unsigned

Consistent but unsigned means anyone could have built it. Tick "Require a signature" to treat that as a fail.

What it cannot see

An event that was never recorded. The certificate proves what is in the ledger, not that everything the agent did went into it.

Break the ledger

Five ledgers and one certificate. Three ledgers were tampered with by someone who could write to the database but did not have the signing key. The certificate is a fourth tamper. Find the clean ones and name the rest.

The certificate is the "Forged" sample above. The ledgers are SQLite files: get them from examples/challenge and check them with:

for f in ledger-*.sqlite; do
  DATABASE_URL="sqlite:$f" OBSERVER_TOKEN=x ironvise verify-ledger
done

Check your answer here. One line per file, in this order:

ledger-1.sqlite:<kind>
ledger-2.sqlite:<kind>
ledger-3.sqlite:<kind>
ledger-4.sqlite:<kind>
ledger-5.sqlite:<kind>
ledger-5-certificate.elc:merkle-root-mismatch

kinds: verified, payload-hash-mismatch, altered-after-signing, truncated-since-sealing, bad-signature, unauthorised-key

Your answer

This only compares a SHA-256 hash. It is a self-check, not a secret: the answer can be brute-forced, and the generator script states it. Found a tamper the tools miss? That is the real prize. Open an issue.

Check this page

Do not take the page's word for it either.

Built from
Compiler
Module SHA-256
Module size

The page's Content-Security-Policy forbids network requests after it loads. Save it, go offline, and it still works. To get the same verdict without a browser:

verify-cert --expected-key <issuer key> audit.elc

To rebuild the module: make wasm-verifier. The format is specified in docs/reference/elc-spec.md, and a second verifier written from that spec alone, in Python, is in examples/verified-session.