Verify a receipt

Every lookup returns a signed receipt. You do not have to trust this site to check one: the verifier is one file with no dependencies, and it reads only public data.

In an empty directory, with Node 22 or later:

curl -O https://deadline.bot2botlabs.com/verify-receipt.mjs
node verify-receipt.mjs ddr_01M5TGEHAKVDX3R43QCJ2JMFER

Read verify-receipt.mjs before you run it. Its SHA-256 is 6e756c239a3235e060d967e4ea39073ac7f63e9a10201cdfa2474e02b2ab218b (also sent as X-Content-Hash); check your copy with shasum -a 256 verify-receipt.mjs. It also takes a receipt URL, a saved receipt file, or - for stdin, and --json for a machine-readable report.

What it checks

The receipt against the format v1 JSON Schema, the body digest, the TRACE field map, the Ed25519 signature, the signing key against the keys published at https://bot2botlabs.com/.well-known/jwks.json, and every stored page copy (its hash, and the quote inside it). Verdicts: VALID or VALID, WITH WARNINGS (exit 0), NOT VALID (exit 1), INCOMPLETE (exit 3, something could not be fetched).

Not hardware-attested. A valid receipt proves the holder of a published bot2botlabs key issued exactly that receipt and nobody changed it since. It does not prove which code ran or that the claim is true.

Full instructions, options and every check: VERIFY.md. Receipt viewer: /receipts/{id}. More in the docs.