Public evidence artefact · No login required

Don’t take our word for it. Recompute it.

Below is a real decision-evidence bundle produced by the IntelXview AI Control Plane: six chained records covering one governed change, from request through approval and deployment to verification. It is published in full, exactly as it was exported, together with the rule needed to recompute its hash chain.

You do not need an account, a form, a sales call or an NDA. You need about a minute and a Python interpreter.

Read the boundaries before you rely on this. The chain is unkeyed, so recomputing it shows the bundle is internally consistent — not who produced it, and not that it was never rewritten. Anyone can construct a chain that passes. We would rather say so here than let you discover it later.

Download the bundle (JSON)How to verify it

What this is, precisely

Generated: 7 August 2026
Tenant: demo-tenant — a demonstration tenant, synthetic data
Records: 6 chained decision records
Schema: export bundle 1.1; records carry regulator schema 1.0
Page reviewed: 7 August 2026
Chain status: 6/6 records recompute

The bundle is published byte-for-byte as the Control Plane exported it. Nothing has been redacted, because redaction would change the hashed bytes and break the chain. That is why every free-text and provenance value in the scenario is cleared against an allowlist before a record is written: once a value is hashed, the only way to remove it is to generate the whole bundle again. This bundle is the result of doing exactly that.

The six records, in the order they were captured

Each record’s hash covers the previous record’s hash, so the order is part of what is protected.

#	Decision	Captured at (UTC)	Recorded hash	Recomputed
1	`CHANGE_REQUEST_CREATE`	2026-08-07 18:27:54	`8e263459be5d752f7144…`	`8e263459be5d752f7144…`matches
2	`APPROVAL_DECIDE`	2026-08-07 18:27:54	`1e4c76bd9ec2db346d78…`	`1e4c76bd9ec2db346d78…`matches
3	`CHANGE_DEPLOYED`	2026-08-07 18:27:54	`7194d4f2f80cac25eba4…`	`7194d4f2f80cac25eba4…`matches
4	`EVIDENCE_WINDOW_OPENED`	2026-08-07 18:27:54	`9cde78c2d518d27caab4…`	`9cde78c2d518d27caab4…`matches
5	`EVIDENCE_WINDOW_CLOSED`	2026-08-07 18:27:54	`1a6c2c8c035e88640081…`	`1a6c2c8c035e88640081…`matches
6	`CHANGE_VERIFIED`	2026-08-07 18:27:54	`b3e5130509a1cb5c3a47…`	`b3e5130509a1cb5c3a47…`matches

Verify it yourself

Each record stores a hash computed as SHA256(previous_hash + canonical_json(payload)), where the canonical form is JSON with sorted keys and no whitespace, and the first record’s previous hash is sixty-four zeroes. Standard library only — nothing to install.

import json, hashlib, urllib.request

URL = "https://www.intelxview.com/evidence/acp-decision-evidence-sample.json"
bundle = json.load(urllib.request.urlopen(URL))

# The export lists rows newest-first; the chain is built oldest-first.
rows = sorted(bundle["rows"], key=lambda r: r["captured_at"])

# A dropped record leaves a chain that still links perfectly, so check the
# declared count too. The hashes alone will not tell you something is missing.
assert len(rows) == bundle["row_count"], "record count does not match"

parent = "0" * 64                      # GENESIS_PARENT_HASH
for row in rows:
    canonical = json.dumps(row["payload"], sort_keys=True, separators=(",", ":"))
    digest = hashlib.sha256(parent.encode() + canonical.encode()).hexdigest()
    print(("OK  " if digest == row["payload_hash"] else "FAIL"), row["action"])
    # Carry the RECOMPUTED digest forward, not the stored one. Chaining from
    # the stored hash checks each record in isolation, so one edited payload
    # would break a single line and the rest would still say OK.
    parent = digest

Then change one character inside any payload and run it again. That record and every record after it stop matching, because each digest is carried forward into the next. That is the property you can check for yourself — and the limit of it is that a chain recomputed from end to end by someone else would also pass, which is why the boundaries below matter.

What this proves

Each published payload canonicalises to exactly the bytes its recorded hash covers — the hash is taken over the sorted, whitespace-free form, not over the file’s own key order — and the records form an unbroken chain from the genesis value in capture order.
Given this file, editing one payload invalidates that record and every record after it, and removing a record from the start or the middle breaks the chain. Someone who alters a record without recomputing the whole chain is caught.
The Control Plane records governed changes as structured decision records — actor, reason code, timestamps, lifecycle state — rather than as free-text logs.

What this does not prove

Not who produced it. The signature fields are HMAC-SHA256, a symmetric code that requires the shared key to check, and that key is not published. You cannot confirm from this file that IntelXview created it.
Not that it was never rewritten. The chain is unkeyed, so anyone can invent a set of payloads and compute a chain over them that passes this check. A pass means the file is internally consistent, which is a narrower claim than a proof of integrity, and it is not evidence of authorship.
Not completeness — and the tail is the weak end. Deleting the most recent records and lowering row_count to match leaves a shorter chain that still verifies perfectly, with no hash recomputed. Nothing in this file shows where the chain was meant to stop, or that no record was omitted before export.
Not a customer deployment. This is a demonstration tenant with synthetic data, captured in a controlled sandbox environment.
Not regulatory approval. IntelXview is participating in FCA AI Supercharged Sandbox Cohort 2. Participation supports testing and does not imply FCA approval, endorsement, authorisation, certification or product validation.

What this artefact demonstrates is a hash chain and its internal consistency — nothing stronger. Third-party verifiable signatures, where a reader checks a signature against a published key rather than recomputing hashes, are a separate piece of work and are not demonstrated here. This bundle was produced with a demonstration signing key, not a production one.