Evaluator walk

This is the forensic receipt walk for a source build of this checkout. It is not the path for the published GitHub release v0.4.0, which supplies the receipt checker as a sibling release asset. It does not embed a captured transcript: three attempts to keep a hand-maintained transcript honest on a moving branch already failed. Run the commands; read what they print.

The source-built installed store includes checker/seal-receipt-v2.mjs because seal verify uses that same v2 judge. The judge does not import the producer’s assembler or canonicaliser.

For the product’s named-set capability, protect both bundled demo tools in one declaration: seal protect db demo.mutate demo.erase. seal status reports that one server protection with demo.mutate and demo.erase on separate indented lines under Gated through this route:; use the operating guide for the setup and state details.

After seal demo

The demo prints demo directory: <path> (remains after the demo for the printed checker command). Keep that path. It holds the receipts and the demo’s public key.

$ read -r -p "Paste the demo directory: " SEAL_DEMO_DIR

Copy only the path after demo directory: from the demo output.

Name the blocked receipt from the demo directory, then check it against the demo’s key with the checkout checker in the current directory:

$ SEAL_BLOCK_RECEIPT="$(find "$SEAL_DEMO_DIR/receipts" -name '*-BLOCK.json' -print -quit)"
$ node checker/seal-receipt-v2.mjs "$SEAL_BLOCK_RECEIPT" --pubkey "$(cat "$SEAL_DEMO_DIR/receipt-signer.pub")"

A matching receipt prints the five rows described in Receipt operations, including Verifier-local verdict REPRODUCED, Event occurrence NOT ESTABLISHED, and VERIFY UNVERIFIED.

That key is the one this demo used to sign the receipt, so checking against it proves only self-consistency — a hostile sealer could sign its own. To prove anything, supply a key you obtained from a source you already trust.

Tamper the recorded arguments

$ sed 's/seal demo wrote this line/altered line/' "$SEAL_BLOCK_RECEIPT" > "$SEAL_DEMO_DIR/tampered.json"
$ node checker/seal-receipt-v2.mjs "$SEAL_DEMO_DIR/tampered.json" --pubkey "$(cat "$SEAL_DEMO_DIR/receipt-signer.pub")"
$ test "$?" -eq 1

The checker must refuse. The refusal names commitment_mismatch.

What this does not prove

The demo’s key is generated fresh for that run. The protected path creates or reuses a machine-local Ed25519 key. Both are demo-grade key custody: the thing that can sign is the same machine that made the decision. A production-grade check would verify against a key you obtained from a source you already trust, not a file written next to the receipt.

The separate browser product at https://velvetmonkey.github.io/seal-check/ does check this demo’s Protect v2 receipt — verified directly against a receipt from this checkout’s own seal demo: it reproduces the same READ/VALIDATE/REPLAY rows as the checkout checker above and leaves authority and event occurrence equally unverified. Open the page, choose the receipt JSON file, then choose the signer public key file printed above (or paste its 64 hex characters). File pickers drive the check itself, not a button click; the page’s only buttons are a dark-mode toggle and six informational tooltips, none of which take part in the verification. See seal-check’s README for the exact commit its checker follows. Use the checkout-root command above if you would rather stay in the terminal.

See DISTRIBUTION.md for what the payload contains, and LIMITATIONS.md for the family-level claims block.

On Linux x86-64, first build and install this checkout.

Previous: Install. Up: Start. Next: Guide.