Anyone holding a receipt can re-derive the decision it records — here, in this page, without an account and without contacting whoever issued it. That is the entire point of the format: evidence you can check yourself is the only kind worth having.
● Runs entirely in your browser. Open your network tab — this page makes zero requests.
Five checks per receipt and three over the log itself, all performed locally. Per receipt: the Ed25519 signature over the signed verdict; the SHA-256 receipt hash re-derived from the pinned inputs; the hash-chain link to the receipt before it; the recorded outcome re-derived by re-applying the pinned thresholds to the pinned score; and a Merkle inclusion proof placing the receipt in the published log. Over the log: that it only ever grew, that its head is signed, and how many independent parties have endorsed that head. Flip a single byte and three of the five fail on that receipt: its hash no longer re-derives, its outcome no longer follows from the inputs pinned beside it, and it is no longer the receipt the log committed to at that position. The link into the next receipt is severed at the same time, which cuts everything after it off from the genesis record. The signature stays valid, and that is itself worth seeing — it covers the signed verdict, so an edit to the recorded inputs is caught by the hash and the log rather than by the signature. No single check is sufficient alone.
The inclusion proof is what makes disclosure possible without exposure: it proves one decision belongs to the log using only the sibling hashes on its path, revealing nothing about any other customer. The consistency proof above is the other half — it demonstrates the log was only ever appended to, so a publisher cannot quietly rewrite history and re-anchor. Both follow RFC 6962, the construction behind Certificate Transparency. Neither, on its own, shows that everyone was shown the same log: an operator holding one key can sign one root for the auditor and another for the regulator, and every proof above verifies against both. That is why the head is countersigned. Each witness endorses a head only after checking it extends the last one it endorsed, so serving two versions of history requires every witness to sign twice — and the attempt is what gets caught, producing two conflicting heads under the operator's own signature. Trust would then rest on the witnesses not all colluding rather than on the operator being honest, which is the only arrangement that scales past the people you already know. That substitution is not yet earned here: every cosignature on this page was produced by a key Arbiter holds, so what is demonstrated is the mechanism, not the independence. The row above reports zero independent witnesses for exactly that reason. Getting the first key into somebody else's hands is the work, and no amount of cryptography substitutes for it.
This verifier is the reference implementation of an open specification, published under Apache-2.0 with its patent grant. Anyone may implement it, including competitors — an evidence format only one vendor can produce is not evidence. Conformance is decided by 205 published assertions, 16 of which are cases a conforming verifier must reject — including a tree head that is correctly signed and correctly proved against, but carries no independent endorsement. A fork that ships no witnesses fails the suite, which is the only part of an Apache-2.0 format anyone can own.