Manifest receipt

Locked & verifiable.

A pre-registered claim, anchored to a SHA-256 hash before the run. Anyone can re-derive it from the canonical bytes below.

SHA-2561a3466cc08ee7fb60a726ea1c4db6ecf48a9f847b9b7523bfb54b2ffaefee546

Registered2026-05-15T16:45:37.763Z

Independent timestampRFC 3161 · 2026-07-11T22:19:07Z · timestamp.sigstore.dev (anchored after commit; earlier existence rests on the registry signature alone) · token

Transparency lognot yet in a public log (record predates full-manifest storage; RFC 3161 token only)

Kindcommitted before 2026-07-11 — not validated at commit time; re-verify offline with a reference implementation

Manifest preview

version: prml/0.1
claim_id: 01900000-0000-7000-8000-000000000000
created_at: '2026-05-01T12:00:00Z'
metric: accuracy
comparator: '>='
threshold: 0.85
dataset:
  id: imagenet-val-2012
  hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
seed: 42
producer:
  id: studio-11.co

Note (2026-07-11): records committed before this date stored only a 500-byte preview, so this page cannot prove the full manifest. Re-verify offline against the original file.

README badge

[![PRML locked](https://registry.falsify.dev/badge/1a3466cc08ee7fb60a726ea1c4db6ecf48a9f847b9b7523bfb54b2ffaefee546.svg)](https://registry.falsify.dev/1a3466cc08ee7fb60a726ea1c4db6ecf48a9f847b9b7523bfb54b2ffaefee546)

Verify in CI

- uses: studio-11-co/prml-verify-action@v2
  with:
    mode: verdict
    expected-hash: 1a3466cc08ee7fb60a726ea1c4db6ecf48a9f847b9b7523bfb54b2ffaefee546

github.com/studio-11-co/prml-verify-action →

share on x →

Verify this hash yourself

Paste your manifest YAML. The canonical hash must match 1a3466cc08ee…. This runs the registry's own canonicalization module (canonical.js) in your browser; for verification that does not trust this registry at all, use any of the four reference implementations offline.

Verify the independent timestamp (RFC 3161, offline)

The token countersigns this manifest hash with the timestamp authority's key, so the time claim no longer rests on this registry. Verify with OpenSSL 3 (LibreSSL, the macOS default, cannot check the ESS extension):

curl -sO https://registry.falsify.dev/1a3466cc08ee7fb60a726ea1c4db6ecf48a9f847b9b7523bfb54b2ffaefee546.tsr
curl -s https://timestamp.sigstore.dev/api/v1/timestamp/certchain -o chain.pem
awk 'split_after==1{n++;split_after=0} /END CERTIFICATE/{split_after=1} {print > ("tsa-" n ".pem")}' n=0 chain.pem
openssl ts -verify -digest 1a3466cc08ee7fb60a726ea1c4db6ecf48a9f847b9b7523bfb54b2ffaefee546 \
  -in 1a3466cc08ee.tsr -CAfile tsa-1.pem -untrusted tsa-0.pem

Expected output: Verification: OK.

What this receipt proves — and what it does not

Proves: these manifest bytes hashed to this SHA-256, and the registry attests (Ed25519 signature over hash + timestamp, key at /pubkey) that it saw the hash at the recorded time.
Timestamp: where an RFC 3161 token is present (the "Independent timestamp" row above), the time claim is countersigned by a public timestamp authority and verifiable offline; backdating it would require compromising that authority, not just this registry. Records without a token rest on the registry's clock alone until anchored. Transparency-log (Rekor) inclusion is still planned — see registry limitations.
Does not prove: the claimed result. A PRML receipt proves the bar was locked before the run — never that the result is good.
The signature covers hash + timestamp only, not the submitted handle. There is no key-rotation story yet; the current key id is served at /pubkey.

PRML v0.2 is a frozen RFC (comment window closed 2026-05-22) — spec.falsify.dev/v0.2-rfc. Editor: spec.falsify.dev/editor.