Don't trust us. Check it.

The 90-Second Proof

Real output from the one-command demo: an $89 refund is allowed, a $250 refund is blocked at the gate, the downstream tool's own log shows the blocked call never arrived, the evidence verifies, and tampering with one byte makes verification fail.

Verify It Yourself

The committed sample bundle holds two receipts and a signed tree of size two. A standalone verifier — importing nothing from the server — returns ORIGIN AND INTEGRITY VERIFIED for the valid bundle and VERIFICATION FAILED for the tampered negative-control bundle. Verification uses two separate anchors with different provenance, and the strongest evaluator posture pins both. --expected-witness-key pins who witnessed the log; --expected-issuer-key pins who signed each receipt. Pinning the witness key ALONE is fail-open on receipt provenance: a bundle carrying no issuer material and no reveals still reports ORIGIN AND INTEGRITY VERIFIED, and the verifier names that gap in its own [SKIP] lines. The issuer anchor makes that case fail closed. The anchors are not interchangeable: the issuer anchor is ceremony-sourced, captured before any receipt existed, whereas in the local demo and the evaluator packet the witness key is read from the bundle itself — pinning it there proves coherence, not independent witness origin. For a provisioned deployment both keys must be obtained out-of-band.

What Else Is Executable On Main

Beyond the allow/block/verify loop, three mechanisms exist today and are worth an evaluator's attention — each stated with the boundary that actually bounds it.

Bounded assignment enforcement. The stdio gateway enforces a bounded assignment when one is configured: the assignment becomes the whole authority for a single governed run, flat capability strings are ignored, and the decision runs through the grant envelope and a restricting operator-policy overlay. Operator policies may only restrict — they never widen a grant. A require-review decision is refused rather than allowed, because no human-approval path is wired. Without an assignment the gateway still gates, but on flat capability strings with no expiry, revocation, or run binding. The HTTP transport does not implement assignment mode and refuses to start if one is configured, rather than silently running on flat capabilities.

External STH mirror. An append-only, hash-chained mirror records signed tree heads outside the Magenta runtime, and the evaluator packet runs it as an optional leg including the negative case. The mirror mechanism is implemented and proven: once a signed tree head has been mirrored, a history rewrite, an equivocation (two different roots at the same tree size), a rollback, or an edit to the mirror file itself is detected and fails closed. Its value against a dishonest operator depends entirely on independent custody — a mirror the operator also controls establishes nothing. It proves nothing about history before the first mirrored tree head, cannot recover a tree head lost before it was mirrored, and detects edits to the mirror rather than deletion of the only copy. What does not exist is a hosted, managed, independently operated third-party mirror service.

Identity seam. The HTTP evaluator's identity seam proves that an asserted principal label resolves against a static configured policy, that the call is gated against that principal's grant, and that the principal, grant, and decision are committed into the signed receipt — with an unknown or (in strict mode) missing principal failing closed before the gate. It is not identity verification: there is no token authentication, no SSO, and no mTLS, so it establishes which configured principal a call claims to be, not who actually sent it. Separately, a grant id is an unsigned canonical hash of the grant body — it detects an edited or stale grant, but it is not issuer authenticity and does not prevent forgery by anyone who can edit the envelope.

Verification anchors. Verification uses two separate anchors with different provenance, and the strongest evaluator posture pins both. --expected-witness-key pins who witnessed the log; --expected-issuer-key pins who signed each receipt. Pinning the witness key ALONE is fail-open on receipt provenance: a bundle carrying no issuer material and no reveals still reports ORIGIN AND INTEGRITY VERIFIED, and the verifier names that gap in its own [SKIP] lines. The issuer anchor makes that case fail closed. The anchors are not interchangeable: the issuer anchor is ceremony-sourced, captured before any receipt existed, whereas in the local demo and the evaluator packet the witness key is read from the bundle itself — pinning it there proves coherence, not independent witness origin. For a provisioned deployment both keys must be obtained out-of-band.

Honest Scope

The sample is a local demo artifact, not production evidence. The hosted evidence surface is ephemeral unless a durable ledger selector is set, and the demo witness key is not the pinned production key. The recorded development runs and CI proofs are labeled as such. Active-development and roadmap work is listed separately from executable proof, so future work never borrows credibility from what runs today.