Verify an evidence bundle

in your browser

Check a record's evidence bundle you downloaded, in your own browser. A copy of the command-line verifier, generated from its source and tested to give the same result, opens the evidence bundle here, checks its files against each other and against the rules history this page was released with, and says what the evidence bundle establishes, what it does not, and why.

Drop an evidence bundle here, or tap to choose one

a .tar.gz from a record's EVIDENCE button, or the Readout's Export evidence; on a computer, its unpacked folder can be dragged in too

Your evidence bundle is not uploaded: the check runs in this page, which makes no request while checking. Once the page and its rules history have loaded, you can disconnect and check offline.

No evidence bundle yet? Download a sample, the Oct 11 reference record, then drop it here.

This page's verifier

verifier: aeiiea-verify 0.2.0 a copy generated from the command-line verifier's source, tested to give the same result
code: commit 6befe0ac the commit promoted to this release, 2026-10-28
history: sha256:47059026…0a4b 2,907 commits, 824 with an instrument snapshot, from heads 6befe0ac and a4fbaa1d; generated at the release and carried by its deploy commit, not by the code commit above

The check does not depend on asking the live archive or the Readout whether an evidence bundle passes. It does depend on the code this site serves: AEIIEA supplies the verifier copy and its rules history, so this site stays part of what you trust. The code can be compared with the repository at the commit named above. The rules history is not in that commit: it is generated at the release and carried by the deploy branch's promotion commit, and anyone can regenerate it from the repository's history with scripts/assurance-history.js map. Someone who trusts nothing of ours runs the command line from a deploy commit, as VERIFY.md inside every evidence bundle says.