Independent Verification
Verify AI execution without trusting NexArt
A NexArt record can be verified independently using only the record, a public key, and standard cryptography.
Core Properties
NexArt records are tamper-evident. Every record carries a SHA-256 hash of its canonical contents. Any change, however small, breaks the hash.
They are signed by the NexArt attestation node. Each attestation is an Ed25519 signature over a canonical payload. A successful signature check confirms that the displayed attestation-node key signed the record.
Verification is bounded. Verification confirms the integrity of certificate-bound fields and, where present, the validity of the signature and external timestamp evidence. It does not establish that the AI output was correct, fair, lawful or complete. Anyone can verify a public or exported record without an account; creating a node-attested record requires NexArt credentials.
Anyone can verify them locally. No NexArt account. No NexArt SDK. No infrastructure dependency. Just the record, the node's public key, and standard cryptography.
Live Example
Fetch a public record and verify it
Public records are available via the node API. You can retrieve one by certificate hash, save it as JSON, and verify it locally.
1. Fetch the record
curl "https://node.nexart.io/v1/cer/public?certificate_hash=<hash>" -H "Accept: application/json" > record.json2. Verify locally
npx @nexart/cli verify-bundle record.jsonThis verification runs entirely locally. No request is sent to NexArt during verification. The CLI recomputes the certificate hash from the record contents, checks it against the signed value, and validates the Ed25519 signature against the node's published public key.
What This Proves
Four verifiable properties
Integrity
The record has not changed since it was sealed. The recomputed SHA-256 matches the certificate hash exactly.
Authenticity
The record was signed by a NexArt node. The Ed25519 signature validates against the node's published public key.
Determinism
The hash can be recomputed exactly by anyone using the same canonicalisation rules recorded in the bundle.
Independence
Verification does not depend on NexArt systems, accounts, or runtime. It works offline with standard libraries.
Trust Boundaries
What this does NOT prove
Node ordering vs. independent time-of-existence
The node-issued timestamp provides ordering within the node's signing chain; it is not on its own an independent proof of existence at a given wall-clock time. Independent proof is provided by a separate RFC 3161 timestamp issued via DigiCert's public timestamp authority, applied to every Certified Execution Record by default and carried alongside the record without changing its format.
Completeness of execution
Verification proves that a specific record is intact and authentically signed. It does not prove that every relevant execution was submitted, or that nothing was omitted from the system being audited. Ensuring completeness is an integration-level responsibility.
Inclusion in a public transparency log
There is no public Merkle log or third-party inclusion proof today. The attestation is a direct signature from the node. A transparency layer can be added in the future without invalidating existing records.
These are not weaknesses. They are boundaries. Being precise about what is proven and what is not is what makes the system credible to auditors and regulators.
Interactive Verification
Explore a live record and verify it yourself
The Verification Terminal is an interactive tool for inspecting and validating NexArt records in your browser. No installation required.
Open Verification Terminal