Verify a release decision record
Every decision this platform countersigns can be checked against the published key, here or with any Ed25519 library. Paste a record below and the signature check runs in your browser with WebCrypto; the record never leaves the page.
The full release record, the API response around it, or just the countersignature object. All three shapes work.
Fetch the published key, or paste a copy you saved earlier. A saved copy is the stronger check: a forged record served next to a swapped key would pass a same-origin fetch.
How the check works
When the server accepts an evidence bundle or decides a release, it appends an entry to a per-tenant transparency log and signs the new root: Ed25519 over the UTF-8 bytes of the root string. Roots chain by SHA-256, so one valid signature commits to every entry before it.
This page imports the key with WebCrypto, derives its id (the first 16 hex characters of the SHA-256 of the SPKI DER), and verifies locally. The public-key endpoint documents the recipe, and any Ed25519 library reproduces the check in a few lines.
Where records come from
Signed-in customers copy records from the Release Record page. Evidence exports carry the same countersignature block, and the release-governor check on a pull request links straight to its record.