Independent verification

Recompute a baseline fingerprint

Every ReqPub baseline carries a SHA-256 fingerprint computed from the stored snapshot. Paste or upload an exported baseline bundle below. Your browser recomputes it with the exact code the app uses, then compares the result to the fingerprint the bundle carries. Everything runs on this page: no upload, no account, no network call, and this page's security policy forbids one.

The recipe, restated: SHA-256 over the canonical JSON, object keys sorted, arrays in order, UTF-8, of the bundle's label, seq, and snapshot. The full specification is docs/VERIFY.md in the repository, precise enough to reimplement from the document alone. Beside it sits tools/reqpub-verify.mjs, a standalone checker that runs offline with Node and imports nothing from ReqPub. CI asserts on every push that the specification, this page, and that tool agree byte for byte.

What a match proves: this file's snapshot is exactly the baseline the fingerprint was recorded for. What it does not prove: who produced it or when. A fingerprint on its own is not a signature and not a timestamp. That is what sealing adds. When a client signs a baseline, the receipt is signed with Ed25519 under a published key and timestamped by two independent RFC 3161 authorities. A third party can then establish who signed, and that the record existed at that moment, without asking us.