Locked & verifiable.
A pre-registered claim, anchored to a SHA-256 hash before the run. Anyone can re-derive it from the canonical bytes below.
SHA-256
132437f156e81d7c16822847a3c101b146b2a846828f0ddeb933efcf464667f5Registered2026-08-25T08:22:37.275Z
Independent timestampRFC 3161 · 2026-08-25T08:22:37Z · timestamp.sigstore.dev · token
Transparency logRekor v2 · log2025-1.rekor.sigstore.dev · index 80289086 · inclusion proof
KindPRML manifest — conformed to the published v0.1 schema at commit time
Submitted by@Falsify OU (worked example)
Manifest
version: prml/0.1 claim_id: 01997a2c-0000-7000-8000-000000000001 created_at: '2026-08-25T08:22:01Z' metric: impact_ratio metric_args: protected_attribute: sex protected_group: female reference_group: male group_definition: 'attribute 9 (personal status and sex): A92 is female; A91, A93, A94 are male' favourable_outcome: predicted class 1 (good credit) split: stratified 70/30 train/test at the manifest seed features: all 20 attributes; categorical one-hot encoded; numeric standardised model_config: scikit-learn LogisticRegression, L2 penalty, C=1.0, max_iter=2000 definition: female selection rate divided by male selection rate on the held-out test split comparator: '>=' threshold: 0.8 dataset: id: uci-statlog-german-credit hash: b21f3d81db8071257d5ff1deaeba1fd4303b62712e6fcc9715c7a86202cb5871 uri: https://archive.ics.uci.edu/dataset/144/statlog+german+credit+data seed: 42 producer: id: worked-example.falsify model: id: sklearn-logistic-regression-l2-C1.0 notes: Worked example produced by Falsify OU; not a client engagement. 0.80 is the EEOC four-fifths benchmark, a rule of thumb applied by bias-audit practice and not a legal standard; no statute fixes it. It is used because it is the convention an assurance reader recognises. The outcome was not known to the author when this manifest was sealed.raw bytes →
README badge
[](https://registry.falsify.dev/132437f156e81d7c16822847a3c101b146b2a846828f0ddeb933efcf464667f5)Verify in CI
- uses: studio-11-co/prml-verify-action@v2
with:
mode: verdict
expected-hash: 132437f156e81d7c16822847a3c101b146b2a846828f0ddeb933efcf464667f5github.com/studio-11-co/prml-verify-action →Verify this hash yourself
Paste your manifest YAML. The canonical hash must match 132437f156e8…. This runs the registry's own canonicalization module (canonical.js) in your browser; for verification that does not trust this registry at all, use any of the four reference implementations offline.
Verify the independent timestamp (RFC 3161, offline)
The token countersigns this manifest hash with the timestamp authority's key, so the time claim no longer rests on this registry. Verify with OpenSSL 3 (LibreSSL, the macOS default, cannot check the ESS extension):
curl -sO https://registry.falsify.dev/132437f156e81d7c16822847a3c101b146b2a846828f0ddeb933efcf464667f5.tsr
curl -s https://timestamp.sigstore.dev/api/v1/timestamp/certchain -o chain.pem
awk 'split_after==1{n++;split_after=0} /END CERTIFICATE/{split_after=1} {print > ("tsa-" n ".pem")}' n=0 chain.pem
openssl ts -verify -digest 132437f156e81d7c16822847a3c101b146b2a846828f0ddeb933efcf464667f5 \
-in 132437f156e81d7c16822847a3c101b146b2a846828f0ddeb933efcf464667f5.tsr -CAfile tsa-1.pem -untrusted tsa-0.pem
Expected output: Verification: OK.
What this receipt proves — and what it does not
- Proves: these manifest bytes hashed to this SHA-256, and the registry attests (Ed25519 signature over hash + timestamp, key at /pubkey) that it saw the hash at the recorded time.
- Timestamp: where an RFC 3161 token is present (the "Independent timestamp" row above), the time claim is countersigned by a public timestamp authority and verifiable offline; backdating it would require compromising that authority, not just this registry. Records without a token rest on the registry's clock alone until anchored. Where a "Transparency log" row is present, the hash is additionally mirrored to the public Sigstore Rekor log with a verifiable inclusion proof.
- Does not prove: the claimed result. A PRML receipt proves the bar was locked before the run — never that the result is good.
- The signature covers hash + timestamp only, not the submitted handle. There is no key-rotation story yet; the current key id is served at /pubkey.
- Limitations: the registry itself is a signed key-value store, not an append-only log — per-record non-equivocation comes from the Rekor entry, and records committed before full-manifest storage (2026-07-11) carry their RFC 3161 token only. No long-term storage guarantee: mirror your hashes in your own infrastructure.
PRML v0.2 is a frozen RFC (comment window closed 2026-05-22) — spec.falsify.dev/v0.2-rfc. Editor: spec.falsify.dev/editor.