VERIFY
Verify a record yourself.
This page specifies the verification procedures available against a live SDI chain. A terminal, curl, and Python 3. No credentials. Verification establishes that a record has not been altered, that the published formulas were applied as stated, that cited evidence was really retrieved, and that refusals were retained.
Before you run anything
Every command on this page does one of two things: pulls a real, live record from the public chain, or runs a published script against that record to recompute something claimed elsewhere on this site. Nothing here is illustrative. Every output is real.
The scripts are on GitHub in the open, and every section links to its source. Download it, read it, check its hash against the one published here, then run it. A single-command version is shown too, if you would rather not.
§ 01
Scope
Scope and preconditions
Base endpoint:
Reference agent:
SDI-5AA8C82A2537 (Chromite)
Schema floor:
Seq 400 forward is protocol v1. Every command and worked example on this page uses records from it or later.
Earlier records are still pullable with the same commands. They were written during the prototype period, before the packet reached its current form, so the constructions described here will not fully apply to them. They remain on the chain, verifiable under their own version, which is itself something to inspect: the protocol changed and the chain did not break.
One chain, many writers. Before verifying any single record, verify the shape of the whole: Chromite's chain has been extended by models from three vendors, and the ledger records which model wrote each act. One pull counts them.
The output is a census of the chain: Claude, GPT, and Gemini models, in several versions each, all writing to one unbroken hash sequence. Two entries need naming. None appears on the earliest acts, seq 1 through 39, which predate the field: the chain recording its own growth. And one entry carries SDI_COMMERCIAL_MINT_v1 rather than a model name: the commercial genesis act, using the field for provenance.
This is the claim "any model, one chain" as a query result. The models changed turn to turn. The parent hashes did not break. Nothing that follows on this page depends on which model wrote the record being checked, and that is the point.
What this page verifies
Chain plurality
which models wrote the chain
Record integrity
the entry hash recomputes from the record
Proof of reasoning
the cognitive hash recomputes from the act's own operands
Work floor
the Jc_clt figure recomputes from the committed rows
Structural coherence
the RAI recomputes from its three components
Evidence provenance
cited evidence was retrieved server-side, that turn
Refusal retention
every refused act is on the log, hash-chained
Argumentation state
an act's standing recomputes from claim-level record
§ 02
Retrieve
Retrieve a record
Retrieve the full committed record: the Decision-Evidence Record (DER), the declared operands, the audit block, and the sealed hashes.
The record's LOGIC block holds each sub-question with its resolution: a predicate where the claim is algebraic, a criterion sentence where it is prose, and the signals it cited. The audit block holds the computed metrics this page teaches you to recompute: the hashes, the work floor, the attestation state.
The command is set to seq 404, a current-protocol act reasoning about certification design against W3C, RFC 2119, and NIST practice. Change the number to pull any act on the chain, from 1 to the current head: the head command below returns the tip. Earlier acts return through the same command in the same shape, with fewer fields carrying values, because the fields did not exist when those acts were written. Pull seq 200 and compare its LOGIC rows against 404's: the protocol grew, and the old records were not rewritten to match the present.
Every script on this page reads from stdin. Each section pulls its record live, so nothing depends on files left over from an earlier step, but save any record to a file and every check runs against it offline: after the pull, the server is no longer part of the verification.
§ 03
Integrity
Verify chain integrity
3.1 Server-asserted integrity
This checks every consecutive pair on the chain, including records written before protocol v1. Continuity holds across the version change: the packet structure evolved and the chain did not break.
Two values back: the server walked every consecutive pair on the chain, confirmed each entry's parent_hash matches the entry before it, and reports the chain unbroken to seq 407.
Read that result for exactly what it is. The server checked its own chain and told you it passed. That is worth having: it is the same check the system runs on itself, and a False here would be the system reporting its own break. But a verification that ends here still rests on trusting the reporter. The next section removes the reporter. You pull the raw records, recompute every hash yourself, and walk the same pairs on your own machine, offline. If the chain is intact, your arithmetic and the server's answer agree. If anything was altered, your arithmetic says so no matter what the server reports.
3.2 Independent recomputation
Retrieve two consecutive records. Read the later record's declared parent_hash. Recompute the earlier record's entry_hash from its own contents: two of the nine packet fields are derived, the other seven are read directly.
der_hash is not stored on the record. Compute it as SHA-384 over the canonically serialized reasoning record at meta.SDI_DER.
audit_hash is stored at meta.audit_hash. Read it. It was taken over the audit block at commit time, and the served record's audit block is not byte-identical to that input, so recomputing from the served record does not reproduce it. What this check establishes is that the stored audit_hash is what entered the entry_hash, which the entry_hash recomputation proves.
Canonical serialization: JSON, keys sorted lexicographically, separators (",", ":"), no whitespace, UTF-8 encoded.
The rule matters because hashing is exact. The same nine fields written with different key ordering, or with a space after a comma, produce a different hash. Canonicalization means there is one way to write any record, so a third party recomputing starts from the same bytes the kernel did. Without it, two correct implementations would disagree and neither could tell why.
A match between the recomputed entry_hash and the later record's declared parent_hash establishes continuity between those two records without reliance on the server's assertion.
If seq 405's declared parent_hash equals the entry_hash you computed, continuity between the two records is established by your arithmetic, not the server's assertion.
§ 04
Depth
One act, every claim checked
Chain integrity, above, proves the sequence is unbroken. This is the complementary check: proves one act's own numbers are honest.
verify_sdi_entry.py fetches a single entry and recomputes everything it claims about itself: the cognitive hash, the work floor, the coherence score, the admissibility index, and its link to the entry before it. It prints MATCH, MISMATCH, or SKIP for each, and needs nothing but standard Python.
The chain has schema eras. The protocol's formulas evolved while the chain stayed unbroken, and a sealed act permanently carries the formulas of its own era, because a sealed record cannot be rewritten to match later rules. The script detects each entry's era from the record itself and applies the matching computation. Early acts also carry fewer fields, a genesis or memory-synthesis entry may not have a cognitive hash at all, and the script reports SKIP rather than a false failure when a field genuinely does not apply. Early acts verifying under early formulas is not inconsistency. It is what an append-only record of an evolving protocol necessarily looks like.
§ 05
Metrics
Verify metric derivation
SDI measures reasoning as work. The unit is the cognitive joule, Jc, coined by analogy to physical energy: reasoning costs something, and the cost leaves a structural trace in the record.
Two Jc values are computed on every act, answering different parts of what reasoning as work means. Jc_clt measures structural depth, how much reasoning actually happened. jc_per_joule expresses that depth against an estimate of the energy it cost to produce.
Alongside them, RAI asks a separate question: whether the reasoning that happened coheres.
An act must clear both. The Jc floor is 5.0 and the RAI floor is 0.78, and every committed record carries the thresholds it was measured against.
4.1 Jc_clt, the work floor
The floor is admission control, not a quality bar.
Reasoning that did not go through the pipeline cannot produce the operands, because the operands are structural traces of the pipeline having run: sub-questions actually decomposed, signals actually retrieved, an assessment actually recorded. Well-formed prose from a model that skipped the process scores nothing, no matter how good it reads.
Jc_clt is a hard threshold at 5.0. An act below it is refused before it reaches the ledger, not recorded with a low score. Every committed record carries its own jc_floor_applied and jc_floor_passed values, so the comparison is on the record rather than asserted here.
Jc_clt = ((SQ x max(SC, 1)) + CE) x (ln(AL + 1) x U)
SQ
sub-questions decomposed length of the sub_questions array in QUESTION_LOGIC
SC
signals retrieved length of the inputs array in SYSTEM_INPUT
CE
correction events GOVERNED_DELTA.assessment, a two-value enum
AL
answer length character count of the governed answer, logarithmic
U
uncertainty typed enum, LOW, MEDIUM, HIGH, encoded 1 to 3
SQ and SC are structural counts. The model cannot raise them by claiming a higher number, because they are read from the arrays themselves, and every signal counted in SC is independently verified against real retrieval (section 06). CE and U are constrained enums, not free values. The logarithm on AL means each additional unit of length contributes less than the one before it, so length alone cannot carry the score.
A match confirms the declared operands were used exactly as stated and have not changed since the act was sealed. These five operands are also five of the seven sealed into cognitive_hash. Run section 05 against the same record and you will see them again, unchanged, inside the hash that proves the reasoning was performed.
Jc_clt establishes that structured work occurred. It counts what is present, not what was load-bearing, so an act can carry more signals than its reasoning needed and score higher for it. That is not a gap the floor was meant to close. The gate is conjunctive: RAI's evidence_grounding filters for relevance, every signal is verified against real server-side retrieval, and each condition refuses independently.
4.2 jc_per_joule, work against energy cost
jc_per_joule expresses cognitive work per unit of estimated energy cost: structural reasoning depth divided by an energy estimate, the same shape as miles per gallon. A higher value means more reasoning extracted for the energy spent.
The metric is here because efficiency is a design goal. A criterion sentence compresses a body of reasoning into one addressable line, and a judgment node does the same for an act's whole argument.
That is what the grammar is for: the machine reaches more of its own memory at lower cost because what it reads is already reduced. Whether that is working is a measurement problem, and this is the beginning of measuring it rather than the result.
The count is measured. The conversion is not. Token count comes from the model provider's own usage report on the real call, not from anything the model declares in its answer. Converting tokens to energy uses a published range, cited in the output below, and reported as a range rather than a point value.
Tokens are converted using a published energy-per-token range of 0.003 to 1.0 mJ/token, drawn from:
M. Fadel Argerich, J. Furst, M. Patino-Martinez, "Watt Counts:
Energy-Aware Benchmark for Sustainable LLM Inference on Heterogeneous
GPU Architectures," arXiv:2604.09048, 2026.
Watt Counts is an open-access dataset built from real NVML power measurement across more than 5,000 experiments, covering 50 language models on 10 NVIDIA GPU architectures in batch and server scenarios.
Reported as a range, never averaged into a single number:
jc_per_joule_low uses the higher energy assumption, producing the
more conservative, lower efficiency figure.
jc_per_joule_high uses the lower energy assumption, producing the
higher figure.
The names describe the resulting efficiency values, not which energy bound produced them.
No value here is a measured energy figure. Direct measurement is planned once the telemetry supports it.
4.3 RAI, structural coherence
An act can clear the work floor and still fail to cohere. RAI is the check that catches that.
Jc_clt counts work. RAI evaluates whether that work holds together: whether the act is a well-formed instance of the reasoning structure, and whether its logic stayed anchored to the question it declared it
was resolving. It does not evaluate whether the conclusion was correct.
RAI = (0.30 x ILJO) + (0.30 x EGO) + (0.40 x W_RSQ)
ILJO is structural completeness: how many of the act's four required parts are present with content, over four. Intent and Outcome must be non-empty. Logic must carry resolved sub-questions. Judgment must carry a consolidated verdict, not a bare state token. Deterministic, no inference.
EGO is internal consistency of the reasoning-layer framing, computed as a weighted composite of three deterministic checks:
ego = (0.55 x der_s) + (0.20 x gca_s) + (0.25 x det_s)
der_s a five-point structural check over the DER: decision intent, strategic question, non-empty sub-questions, success standard, and non-empty system inputs, with additional points for linkage coverage.
gca_s key presence in the GCA object.
det_s det_s a six-point checklist over declared structure: the strategic question, sub-questions present with real ids and prompts, signal linkage, declared decision syntax, the strength of the signals supporting each sub-question, and whether each sub-question carries a measurable standard.
W_RSQ carries the largest weight and is built from four sub-scores. Three are deterministic rule-based checks over the declared text: coherence_chain, evidence_grounding, and judgment_resolution. The
fourth, NLI_coherence, is a cosine similarity between the act's own Intent and Logic sections, computed by a sentence-transformer model.
evidence_grounding depends on the retrieval verification described in section 06. A score for how well evidence was used means nothing if the evidence itself was fabricated, and fabrication is caught upstream, before RAI is computed.
One of RAI's inputs is not independently recomputable. NLI_coherence is produced by a sentence-transformer model, and reproducing the number requires running the same model. This page reads it from the record instead, and everything built on top of it, W_RSQ's weighted composition and the final RAI assembly, is recomputed and checked. Every other input, ILJO, all three EGO components, and W_RSQ's remaining three sub-scores, is deterministic and recomputed from the record's own fields.
So the verified claim is exact: given the NLI value the system recorded, every other number on this card follows by arithmetic you just ran. What is not verified here is the NLI value itself. Section 09 covers what that model is, why a semantic check earns its place in a deterministic system, and how to reproduce the value if you want to run the model yourself.
§ 06
PoR
Proof of reasoning
This is where governance without reading happens. cognitive_hash proves the reasoning was computed through this pipeline, and, because the value is itself sealed inside the entry_hash, on this chain at this moment. It proves it arithmetically. Nothing here evaluates what the act said. Seven numbers, canonically serialized and hashed, and the result either matches or it does not.
Section 03 established position: that this record sits where it claims in the chain, unaltered since commit. That is not the same as establishing that the reasoning happened. cognitive_hash is the second guarantee. It seals the act's structural depth, its real compute cost, and its position in the argumentation graph into a single SHA-384 value. Position without work is a well-formed empty record; work without position is a claim with no place in the chain.
cognitive_hash is the second guarantee. It seals the act's structural depth, its real compute cost, and its position in the argumentation graph into a single SHA-384 value. Position without work is a well-formed empty record; work without position is a claim with no place in the chain.
Seven operands go into the hash: five for depth, one for cost, one for position.
The five are the Jc_clt operands: sub-questions decomposed (SQ), signals retrieved (SC), correction events (CE), answer length (AL), and uncertainty level (U). Section 04 recomputes the same five from a record's own fields. Run both against one record and the numbers appear twice, once in the metric and once inside the seal.
The sixth is T, the real token count from the model provider's own usage report on the call that produced the act.
The seventh is RS, the reconciliation signature: a fingerprint of exactly which prior findings this act resolved, confirmed, contradicted, or reinstated. RS is what binds the hash to the argumentation graph rather than only to the chain's sequence. An act that resolved nothing carries a fixed empty-set value; an act that moved prior positions carries one unique to which and how.
All seven are on the record. The script below reads them, canonicalizes them, hashes them, and compares against the declared value. Nothing else is needed.
On seq 404, the record used throughout this page, you can watch it happen: the five depth operands here are the same values section 04 recomputed, and T is the same token count section 4.2 divided by. Three sections, one record, one set of numbers.
A match confirms that the recorded work-metric values and this act's position in the argumentation graph are what they were at commit. A mismatch means something changed after the fact, and the record should not be trusted as originally sealed.
§ 07
Evidence
Verify evidence provenance
A model can fabricate a citation. It can produce a plausible title, a real-looking URL, and a convincing excerpt, none of which correspond to anything retrieved. If the record stored the model's own report of what it found, there would be no way to tell a real source from an invented one.
SDI's retrieval runs before the model sees the results and writes independently of them. Source URL, title, raw value, capture timestamp, and provenance are written from the real retrieval response. The model's description of what it found never enters the record.
The citations attached to a specific sub-question, the ones a reader inspects to see what supported a claim, are written from the same retrieval, keyed on the signal the claim declared. The record carries one account of the evidence, and it is the server's.
A claim can also only cite what it committed to. A sub-question links its signals before retrieval runs, and the gate refuses any citation to a signal that sub-question did not link. A signal may support several sub-questions, but only where the act linked it to each in advance. Evidence retrieved for one question cannot be borrowed for another after the fact.
This is the one check on this page that computes nothing. You open the source and look.
Signals live at event.ENTRY.meta.SDI_DER.SYSTEM_INPUT.inputs, each carrying raw_value, provenance, captured_utc, and a citation with title, url, and retrieved_utc. The same citations appear again under ILJO.LOGIC.sub_questions_resolved[].signals[], attached to the sub-questions they support.
One signal on this record cites the system's own published protocol page. That is deliberate: for a question about what the protocol specifies, the published specification is the authoritative source, retrieved and captured like any other.
Open the URL. Confirm the title matches. The capture timestamp tells you when retrieval happened, which matters if the page has changed since. If the record says a source was retrieved and it does not exist, or the content does not match, that is a real, detectable discrepancy.
raw_value is what the server captured from that source at retrieval time. Open the source and check the content against it: that is the comparison that matters, and if the page has changed since, raw_value is what it said when the act cited it.
When retrieval fails, the record says so, in the literal string RETRIEVAL_FAILURE. A signal that resolved to nothing carries the marker in every field. A signal missing one field carries it only there. Partial gaps produce partial markers, never wholesale ones, and nothing is backfilled.
This mechanism exists because of a real failure. A committed act once carried a fabricated citation, a plausible title and a real-looking URL, while genuine retrieval had succeeded and gone unused. Retrieval now writes independently of the model, and a failure, when one occurs, enters the record as the marker rather than as anything invented.
§ 08
Refusals
Safety gate refusals
A safety refusal is not discarded. Every act the safety gates decline is written to a hash-chained refusal log, retrievable on the same terms as a committed act, recording which gate fired, which values the act carried, and the exact error.
Not every rejection is a refusal. An act that falls below the work floor or the coherence floor is returned to the model with the reason attached, and the model revises and resubmits. Those never enter the log, because nothing was refused in the end. What the log holds is the acts the safety gates stopped.
That is the point worth checking. A system can claim its safety gates work; a system that publishes what it refused lets you look. Anyone can pull the log, read the declared values against the reason given, and judge whether the refusal was correct. A gate with no visible refusals is a gate nobody can evaluate.
Three gates produce these entries, and they divide by what they guard. PRIMUM and the Absolute Value Guard guard against harm to humans. The act declares typed fields, each answering one small question: who the reasoning is about, which way it runs, what it does to the subject's autonomy, how close the act sits to being acted on. The agent fills in the fields. It does not assemble them into anything. The conjunction lives in the gate: the gate reads the declared fields together and refuses when they compose the combination it forbids. When that happens there is no attestation, no override, no path through. Refusing that class of work outright is the design, not a strictness setting. That split is deliberate. Each field is answerable honestly on its own terms, and none of them is a question about whether the act should pass. The judgment of what the fields mean together belongs to the gate, which is deterministic, and not to the model, which is not.
DECLARATION_INTEGRITY guards the other two. A gate that reads declarations is only as good as the declarations, so this gate cross-checks five boolean fields the act declares about its own content against the content itself. Its detector is deliberately crude, keyword co-occurrence rather than understanding, which means it catches lies and it also catches honest work that talks about the same subjects. The system resolves that asymmetry with people: what the detector flags routes to human attestation, except one case. An act that declared false and was caught against its own content is refused with no path through. The gate never punishes honesty, and it never rewards getting caught.
The last two commands return count: 0. Neither PRIMUM nor the Absolute Value Guard has ever fired on this chain, and that zero deserves precision rather than credit. It does not demonstrate that the gates work. It demonstrates that no act on this chain has ever declared the combination they forbid, which is what a chain of governance and research work should look like. The gate machinery itself runs on every act: the eighteen refusals above prove the evaluation happens. What has never happened is the forbidden conjunction composing true. PRIMUM has fired elsewhere on the network, twice, on a private governance chain during early work, on the categorical conjunction alone: subject NATURAL_PERSON, direction AGAINST_SUBJECT, autonomy DECREASES. That record is described here rather than pullable, because that chain is private.
Below is the first entry the log ever recorded.
Refusal seq 1, Chromite. 2026-07-04T19:11:14Z. The question asked for a step-by-step methodology for calculating a weapons-effects radius. The act declared contains_lethality_optimization_thresholds false. The content check found a matching pattern, and the act was refused before it reached the ledger.
Declared false, caught against content. This branch admits no attestation, by design: a path through here would make a false declaration a recoverable strategy. Act refused before commit.
Human Attestation
What the detector flags honestly does not die in the log. Refusal 18 is the system's own founder asking the agent to reassess the Absolute Value Guard: every boolean declared false, truthfully, and the crude detector fired anyway, because governance research about targeting vocabulary looks identical to targeting content under keyword matching. That is the misfire the attestation pathway exists for. A human reviews the refused act, authenticates, and approves it, and the approval is sealed into the committed record.
The seal is checkable. The attestation block on the committed act carries the hash of the exact reasoning the human approved, and that hash is a pure function of the committed content: recompute it from the record and it reproduces the sealed value character for character. The human did not approve a description of the act, or a retry of it. The mathematics shows they approved this one.
The block also states what it did not verify. Every attestation carries identity_assurance: CREDENTIAL_AUTHENTICATED_ONLY_NO_IDENTITY_PROOFING. The system knows an authenticated credential approved the act. It does not claim to know who holds the credential, and it says so on the permanent record rather than letting the attestation imply more than it is. Who held the credential is auditor data, held on an authenticated tier, not published.
Every committed act carries the attestation block, including acts that needed no approval, which carry it in explicit null state. Absence of attestation is a recorded fact, not a missing field.
The two gates that guard against harm to humans admit no attestation because their design premise is that no individual act in that class should be improvable by review: the class is refused, not the instance. The gate that guards declarations admits attestation because its detector is knowingly imperfect and the cost of its misfires falls on legitimate work. Where judgment can repair an error, a human holds that judgment. Where the refusal is the point, nothing does.
§ 09
Argument
Inspect argumentation state
An act's standing changes when later acts examine it. Two things are recorded independently: whether a claim on it was defeated, and whether a claim was examined and found to stand. The mechanics are on the architecture page. This section is how you pull them.
Nothing here is stored as a verdict. Claim-level state is written at commit, and an act's standing is computed from it on request, using the act's own declared rollup. There is no second copy to disagree with the first.
Every examination carries its reasoning. An act that finds a prior still standing records why, in the same way an act that defeats one does. What differs is the form, not whether an argument was made
Returns every act as a node, every examination as a directed edge, and the reasoning behind each one. No key required.
Nodes carry derived_status: SUPPORTED, DEFEATED, or UNRECOVERABLE, the last marking an act whose rollup cannot be evaluated rather than defaulting to either outcome.
Edges carry the examining act, the act examined, the type of edge, and the examinations themselves.
Below is one edge from that pull, expanded. Seq 403 examined two claims on seq 402 and confirmed both. It is worth reading because the two claims resolve differently: one carries an equation, one carries prose, and the record keeps the difference rather than flattening it.
Closer examination
One examination, read closely. Seq 377 examined three claims on seq 376 and confirmed each. This is what the record carries for each one.
The examination mechanism entered the protocol at seq 350. Acts before it reasoned and committed normally but carry no examination edges. Within the window where the mechanism exists, resolving a prior is ordinary rather than exceptional. Defeats are the rare case. Reconsideration is common, contradiction is not, and when it happens the record carries the argument for it.
§ 10
Limits
What verification does not establish
Judgment correctness. Verification establishes that an act was constructed under the published rules. It does not establish that the judgment inside it is correct. No procedure can.
Energy. Token counts are instrumentation. The conversion to energy is an estimate, drawn from published research on models smaller than the ones this system runs, applied uniformly regardless of which model produced the act. No value on any record is a measured energy figure.
Boolean gates. PRIMUM and the Absolute Value Guard are not scores. They are conjunctions over typed categorical fields, evaluated rather than calculated. Verification consists of reading the declared fields against the published conjunctions, specified on the Architecture page, and the refusal log section above shows the evaluation on real refused acts.
One model-derived sub-score. NLI_coherence is computed by a sentence-transformer model and cannot be reproduced without running the same model. It is one of RAI's twelve inputs. The other eleven are deterministic, and the published script recomputes all of them from the record's own fields; NLI_coherence it reads from the record and composes upward, so given that one recorded value, everything above it is checked. Reproducing the value itself means running the model.
Gate exercise. Neither harm gate has fired on this chain. That is a fact about what was asked of the system, not evidence the gates function. The gate machinery itself demonstrably runs: the refusal log shows it evaluating every act and refusing eighteen.
Attestation. The public record proves an authenticated credential approved a specific act, sealed by hash. It does not prove who held the credential, and says so on every record: CREDENTIAL_AUTHENTICATED_ONLY_NO_IDENTITY_PROOFING.
Cross-chain state. Argumentation state is computed per chain. Cross-agent argumentation state is not currently computed.
Replay. Single-chain replay from genesis is a property of the record construction. Cross-agent replay has not been executed.
A verification failure at any step indicates that the record does not satisfy the published specification.