Check a sealed record yourself.
Download a sample record from Coriqo’s demo tenant and check it two ways: in this page, or with the open-source verifier on your own machine. It’s free and you don’t need an account. Once you have the file, the check never contacts Coriqo.
Check the sample in your browser.
The button downloads the sample record and checks it here, with the same code that runs on the homepage. The code is verify.js and verify-ui.js. They make no network request while checking, and your own files are never uploaded.
The sample comes from Coriqo’s public demo tenant, never from a customer. The bank and people in it are invented. The file carries the public key that signed it, so a pass shows the record hasn’t changed since it was signed under that key. It doesn’t show who holds the key: for a real record, get the key from the bank. When a file carries an agent’s decisions and the mandate they ran under, the result also says how many recorded tool calls fell outside that mandate. The count covers the calls the agent recorded, not calls it may have left out.
You followed a “Verified by Coriqo” link for checkpoint . Drop the file you were sent below. The result lists the checkpoints the file is sealed under, so you can see this one among them.
This browser doesn’t support Ed25519, so the signature check can’t run here. The other checks still run, and the result names the one that was skipped. For the full check, use the commands below.
Three commands, then try to break it.
You need Python 3.10 or newer and git. After the second command you can disconnect from the network.
Get the verifier and its one dependency.
git clone https://github.com/coriqo/coriqo-seal-verifier cd coriqo-seal-verifier && pip install cryptography
Download the sample record.
curl -fsSLo sample-proof.json https://coriqo.onrender.com/api/v1/public/sample-proof.json
Check it. The last line should read
RESULT: VERIFIED.python verify_proof.py sample-proof.json
Now change one character of the sealed event hash and check again. The output shows [FAIL] Merkle inclusion proof and the command exits 1. Edit a different signed value and a different check fails, by name.
python -c "import json;d=json.load(open('sample-proof.json'));h=d['leaf_input'];d['leaf_input']=('1' if h[0]=='0' else '0')+h[1:];json.dump(d,open('edited.json','w'))" python verify_proof.py edited.json
What each check means.
| Proof fields match the signed checkpoint body | The tree root and size the file quotes are the ones the signature covers, not values added later. |
|---|---|
| Merkle inclusion proof | This event’s hash is one of the events the checkpoint sealed. |
| Ed25519 checkpoint signature | The checkpoint was signed by the key the file names, and none of its bytes have changed since. |
| Timestamp consistency | The time the file states matches the time inside the signed checkpoint. |
| Spec version | The file names the version of the format it was written to. A verifier refuses a major version it doesn’t implement instead of giving a verdict. |
The full rules, written so anyone can build their own verifier, are in SPEC.md. The verifier also reports whether the record was published to Sigstore’s Rekor log, time-stamped by an outside authority, or signed by a second party, and says so when it wasn’t.
Coriqo’s signing key fingerprints
A pass shows the file wasn’t changed. To confirm Coriqo signed it, compare the key fingerprint the result shows with the one below. This list is read from Coriqo’s published keyring when the page loads; the check itself still runs offline.
- Loading the published keyring…