Field note · Counterfoil

Verify it yourself.

Most evidence about an AI system asks you to trust whoever produced it. A Counterfoil receipt is built to be checked instead: you run one small program on your own machine, and it tells you whether the record is intact.

A receipt is a small record of one event: which model, a fingerprint of the input, the result, sealed into a hash chain and signed. The raw prompt and output never enter it, only their fingerprints, so it is safe to hand to anyone.

Try it

Four steps, on your own machine.

The checker is one Python file. Its only dependency is the widely used cryptography library, and it makes no network call, so nothing we run can influence the answer. It recomputes the hash chain, confirms the claim matches what was sealed, checks the signature, and checks that the signing key is ours. Pick your system, copy each command, and tick it off.

0 of 4 done

1Install the one dependency
```
python3 -m venv counterfoil-check
. counterfoil-check/bin/activate
pip install cryptography
```
The checker needs Python 3 and one widely used package, cryptography. It never connects to the network.
2Download the checker and the sample
```
curl -L -o verify_counterfoil.py https://www.matrixcr.ai/counterfoil/verify_counterfoil.py.txt
curl -LO https://www.matrixcr.ai/counterfoil/sample-receipt.json
```
Two files. The checker is served as .txt so a browser shows it instead of running it; the command saves it as verify_counterfoil.py.
3Run it
```
python verify_counterfoil.py sample-receipt.json
```
You should see PASS: intact, and sealed by key be19cba981ce0e02, followed by the full report. The key must match the fingerprint published on this page.
4Break it on purpose, then run it again
Open sample-receipt.json in any text editor. Find "confidence": 0.91 and change it to a different value, for example 0.99. Save. Then run the same command again.
Every edit fails, and the report names the check that broke.

Or download them one at a time: verify_counterfoil.py · sample-receipt.json

What a PASS means

IT PROVES

The receipt has not been changed since it was sealed. Any edit, deletion or reordering fails.

The claim you are shown is the one that was sealed.

It was sealed by our published key, fingerprint be19cba981ce0e02.

IT DOES NOT PROVE

That what was recorded was true. A receipt proves the record is unchanged, not that the event behind it was honest.

That the key is ours, unless you take the fingerprint from a source you trust. This page is one such source; ask us to confirm it another way.

Anything about the raw input or output. Only their fingerprints are in the receipt.

Declare it, if you want it counted

How often does anyone actually check?

A receipt whose authority comes from being checkable is worth what people actually check. So we count it, and the count is 0 of 1 published receipt recomputed by someone outside the studio, as of 2026-09-24. Our own recomputations never count towards it.

The checker can sign what it computed, with a key that is yours, so a recomputation can be declared rather than claimed:

python verify_counterfoil.py sample-receipt.json --attest "Your name or org"

That writes attestation.json: the verdict this run produced, signed by a key it creates for you and keeps on your machine. The verdict is never something you type in, so nobody can declare a check they did not run without signing a false statement with their own key.

Nothing is sent anywhere, before or after. Mail the file to [email protected] if you want it counted, or publish it yourself and leave us out of it. If you find the receipt is not what we say it is, that is worth more to us than a pass, and the procedure for overturning a claim is already published. How to overturn a claim

The number above is a floor, not an estimate: the checker never reports back, so a recomputation nobody tells us about is invisible here. That is the trade we chose, and it is why the figure can only be moved by someone deciding to send one. It also counts keys rather than people, and anyone can make a key, so read it as declarations received and not as a headcount of auditors.

Why it is built this way

The checker holds no secret.

It does not need our servers, our code beyond this one file, or our permission. If checking a receipt required trusting us, the receipt would prove nothing.

About Counterfoil