Check a reference AuditProof

By default this page checks integrity against supplied material: the hash chain reproduces and the signature verifies against the key the artifact itself carries. You may also supply a trust-chain manifest and fingerprint obtained through a channel you independently trust. The page checks consistency with that supplied pin; it does not establish that the pin is an official Nanorix root. The production Nanorix root is published at /.well-known/trust-chain.json on this host (and at nanorix.io/trust-chain.json) with its fingerprint at /.well-known/identity.txt. This page never fetches them for you, because it runs with the network disabled, so obtain them through a channel you trust and attach them here. The published manifest names a single authority — Nanorix’s own signing authority for the hosted evaluation sandbox; customer-held keys are deliberately never in it, so a customer-signed proof (like the customer-signed sample above) verifies against the key the proof itself carries and anchors with the manifest its own authority publishes, not this one. That sample is served verbatim beside this page at samples/customer-signed-sample.auditproof.json for checking with the offline nanorix-verify CLI.

A capsule created with declare_activity carries one signed field, customer_declared_activity_root — a SHA-512 Merkle root over the raw bytes of the activity file the customer's own code wrote (activity_events.jsonl). The events themselves are not in the proof; the customer keeps the file. Attach that file here and this page recomputes the root from its bytes and compares. Without the file, a declared root is reported as declared, not checked. The file is read locally and never uploaded; its contents are hashed, not interpreted.