Hash the submitted bytes
The verifier reads pasted or uploaded JSON as bytes and computes a SHA-256 digest in the browser.
Verifier auditor guide
Audit assurance
Canonical payload verifier auditor guide
Use original canonical bytes from an audit packet you legitimately hold. The public payload page supplies a registry-backed summary, not a canonical JSON export.
Verification protocol
The verifier separates hash integrity, expected-fingerprint comparison, fact extraction, and receipt creation so auditors can explain exactly what was checked.
Compare the expected fingerprint
When a 64-character certificate fingerprint is supplied, the computed digest is compared against that expected value.
Inspect canonical facts
Certificate ID, match ID, teams, score, archive status, evidence coverage, authority, and data-plane fields are parsed for review.
Preserve the verification receipt
Matched, mismatched, and unscoped checks can produce shareable receipts with the computed hash and audit context.
Trust model
The verifier does not prove who created the payload. It defines the trust boundary for a local integrity check and records only what was compared.
Submitted bytes were hashed locally
The browser computes SHA-256 from the exact pasted or uploaded payload bytes available during the review.
Authenticity evaluation is performed only when a trusted expected certificate fingerprint is supplied
This is where authenticity evaluation enters the workflow; without that trusted expected value, the result remains unscoped.
Comparison result was recorded
The receipt records the computed hash, expected fingerprint when present, source context, and result label for later review.
Audit runbook
Follow this sequence when reviewing a single exported canonical payload.
1
Collect the payload
Use original canonical bytes from an audit packet you legitimately hold. The public payload page supplies a registry-backed summary, not a canonical JSON export.
2
Collect the expected fingerprint
Copy the certificate SHA-256 from the trust receipt, registry lookup, technical certificate, or audit packet.
3
Run local verification
Paste the JSON or upload the file, then run the verifier. Do not edit whitespace, encoding, or payload fields before hashing.
4
Review the verdict
Treat a matched fingerprint as payload integrity confirmation. Treat a mismatch as unresolved until the expected fingerprint or export source is reconciled.
5
Preserve the receipt
Open, copy, download, or share the verification receipt so the audit file records both the expected and computed hashes.
Batch verification
Batch mode is intended for audit packets that contain multiple canonical payload exports.
Upload all JSON files together and provide expected fingerprints by filename or in file order.
Review the matched, mismatched, unscoped, and invalid JSON counts before accepting the batch.
Download or share the batch receipt as the audit-run summary.
Verdict interpretation
The verifier labels the result by fingerprint status. The label explains whether authenticity was confirmed or only a local hash was recomputed.
State
Payload verified
Meaning
Computed SHA-256 equals expected fingerprint.
Authenticity
ConfirmedState
Unverified payload
Meaning
Computed SHA-256 differs from expected fingerprint.
Authenticity
MismatchState
Fingerprint recomputed (no comparison)
Meaning
No expected fingerprint was supplied for comparison.
Authenticity
Not evaluatedState
Invalid JSON
Meaning
Payload could not be parsed as JSON.
Authenticity
Invalid input| State | Meaning | Authenticity |
|---|---|---|
| Payload verified | Computed SHA-256 equals expected fingerprint. | Confirmed |
| Unverified payload | Computed SHA-256 differs from expected fingerprint. | Mismatch |
| Fingerprint recomputed (no comparison) | No expected fingerprint was supplied for comparison. | Not evaluated |
| Invalid JSON | Payload could not be parsed as JSON. | Invalid input |
Evidence to retain
A complete audit file should retain the payload, expected fingerprint source, registry context, and verification receipt.
Canonical payload JSON
Store the exact file or pasted text that produced the computed SHA-256 digest.
Expected certificate fingerprint
Record where the expected SHA-256 came from, such as the public trust receipt or certificate registry.
Registry lookup context
Resolve the certificate ID or fingerprint when available to confirm archive standing and certification metadata.
Verifier receipt
Keep the receipt URL or downloaded text so another reviewer can replay the verification context.
Mismatch handling
A mismatch proves only that the submitted bytes did not equal the expected fingerprint. Reconcile inputs before drawing broader conclusions.
Confirm the expected fingerprint was copied from the right certificate version.
Confirm the JSON export was not reserialized, truncated, reformatted, or edited after certification.
Check whether a newer current archive superseded the export under review.
Preserve the mismatch report and escalate to the certificate operator or governing authority.