Verify a record
A registry record carries a signature over a fixed, canonical payload. Anyone can reconstruct that payload and check the signature against the committed public key, without trusting this site. This page shows the mechanism on an example record.
The record
A certificate restates a computed position. These are the fields the signature covers — nothing here is set by hand.
Step 1 — the canonical payload
The record is reduced to one, and only one, byte encoding: keys sorted, numbers rounded, compact separators (engine/canonical.py). This is what is signed, so the same record yields the same bytes on any machine.
{"category":"SNB","dataset_tag":"snapshot/2026-Q2","firm":"ostler-architecture-office","firm_name":"Ostler Architecture Office","geo":"IN","milestone":null,"period":"2026-Q2","rank":1,"registry_id":"CNST-2026-Q2-IN-SNB-SMB-R01-3F9A","rules_version":"1.1","score":74.2,"tier":"smb"}Step 2 — the signature and public key
The key signs the canonical payload with Ed25519; the signature and the public half of the key travel with the record. Only the public key is committed — private keys never enter the repository.
Step 3 — check it offline
With the record, the signature, and the committed public key, verification needs no network and no trust in this site. Reconstruct the payload with the engine and check the signature:
python -c "import json,sign; from schemas import AwardRecord; \
r=AwardRecord.model_validate(json.load(open('record.json'))); \
print(sign.verify_award(r))"
# → True (or False)A passing check confirms the record was signed by the committed key and has not been altered by a single byte. The signature authenticates the record; it is not part of the computation, so determinism holds with or without it.