Download the pack. Run the verifier. Check the key.
This is a demonstration evidence pack produced by the IntelXview AI Control Plane: six chained decision records covering one governed change, each carrying an Ed25519 signature, with a recomputable hash chain and an Ed25519-signed chain head that detects truncation. It is published in full, together with the public key and the verifier script.
You do not need an account, a form, a sales call or an NDA. You need a Python interpreter and about two minutes.
Read the boundaries before you rely on this. A pass authenticates the records against the key supplied with the pack; comparing that key’s fingerprint with our public trust anchor is the step that ties it to the demonstration key, and skipping it would let a pack re-signed under a substituted key pass unnoticed. A pass does not establish who we are, and it does not demonstrate custody of our production evidence key. The full statements are further down this page, and the verifier prints them too.
What this is, precisely
- Generated
- 7 August 2026
- Tenant
acp-public-demonstration— synthetic data, not a customer namespace- Signing key
ev-demo-k1, Ed25519 — a demonstration key, scoped to public sample packs only- Last reviewed
- 8 August 2026
- evidence-bundle.jsonSix chained decision records from one governed change, each Ed25519-signed, with a signed chain head.
- verification-key.jsonThe demonstration public key, its key id, algorithm, scope and not-production flag.
- verify.pyThe verifier itself. Plain Python; it makes 21 checks and prints each one.
How to verify it
Download the three files and run the verifier from the same directory. It prints all 21 checks: the key file’s declared identity, every record’s Ed25519 signature, the hash chain recomputed from the payloads, the signed chain head, and the record counts. Any unexpected value is a hard failure.
pip install cryptography
curl -sO https://www.intelxview.com/evidence/acp-ed25519-pack/evidence-bundle.json
curl -sO https://www.intelxview.com/evidence/acp-ed25519-pack/verification-key.json
curl -sO https://www.intelxview.com/evidence/acp-ed25519-pack/verify.py
python3 verify.pyThe verifier prints the key’s SPKI SHA-256 fingerprint. Compare it with the “Demonstration keys” section of our public trust anchor — a separate surface, retrievable with no credentials:
github.com/intelxview/acp-trust-anchor
The fingerprint published there, and expected here, is:
8ccc4ca9d0b7be1a436f344df80e011a2b14bb81cfef9e400e3855ee5fda3a2dWe test rejection rather than assert it. Our CI builds ten deliberately corrupted variants of this pack — an altered record, a broken chain, two tail truncations, a swapped key, an edited record count, and four re-signed packs with a wrong identity — and requires this same verifier to reject every one. A pack fully re-signed under a cloned identity is the one case the script alone cannot catch; the fingerprint comparison above is what catches it.
What a pass does not establish
- It does not prove who we are. Matching a fingerprint shows control of a key, not legal identity. The anchor is published from an account we control, so until contractual attribution completes it is self-attested, and the anchor says so itself.
- It does not demonstrate production-key custody. This pack is signed with a demonstration key whose only scope is public sample packs. It says nothing about our production evidence key, which is a different key with a different fingerprint.
- The export envelope is not third-party verifiable. The bundle’s outer envelope is HMAC-SHA256 — symmetric — so a reader cannot check it. The verifier prints this plainly rather than hiding it.
- IntelXview is participating in FCA AI Supercharged Sandbox Cohort 2. Participation supports testing and does not imply FCA approval, endorsement, authorisation, certification or product validation.