Field Note · Counterfoil

Verify It Yourself

Most evidence about an AI system asks you to trust whoever produced it. The log came from the vendor. The dashboard is the vendor's. The claim that a model behaved is the vendor's word, in the vendor's format, and you are told nothing was edited.

A Counterfoil receipt is built to be checked instead of trusted. It is a small, self contained record of one AI event: what model, what input fingerprint, what tools were called and what they returned, sealed into a hash chain and signed. The raw prompt and the raw output never enter it, only their fingerprints, so it is safe to hand to anyone.

Here is the part that matters. You do not have to take our word that a receipt is intact. You run one small program, and it tells you.

The check, in three steps

Take a receipt file and the verifier, a single file whose only dependency is one well known cryptography library. Then:

It re-computes the hash chain, confirms the sealed claim matches what was signed, and checks the signature. If everything holds, it prints a verdict of PASS.

Now change one thing in the receipt. Edit a number, swap a tool's recorded output, move a line. Run it again. It prints a verdict of FAIL, and it names the exact check that broke. There is no configuration that makes a tampered receipt pass, and there is no network call, so nothing we run can influence the answer. The verification happens entirely on your machine.

Why this is the whole point

The verifier holds no secret. It does not phone home. It does not need our servers, our code, or our permission. That is deliberate. If checking a receipt required trusting us, the receipt would prove nothing. Because checking it does not, the receipt proves what it says on its own.

That is the difference we care about. A system can watch an AI agent and stream what it saw. A receipt lets a stranger prove, later and alone, that a specific run happened the way the record says. One is a report. The other is something you can check.

Run it on a receipt we give you. Then tamper with it and watch it refuse. The refusal is the feature.