att_c2f0825466c09e80

Tamper evidence

Signature algorithm

HMAC-SHA256

Signature (first 32 chars)

3a2eefe63bbe49816b7cd8b18a0cd08d…

Transcript hash

sha256:f0a51cc08bd0e52d5be356aba9091a2e47d804f64373b03628c1f1164f457cb6

Recompute the HMAC-SHA256 of the canonicalized bundle with the signing key to verify. The transcript hash binds the signature to the full deliberation log; tampering with any sentence in the transcript changes the hash and invalidates the signature.

Verify this attestation locally

Don't trust delimit.ai — verify it yourself. The bundle is JSON-signed with HMAC-SHA256; you can recompute the signature in any language with a crypto library.

# 1. Download the signed bundle
curl -O https://delimit.ai/attestations/att_c2f0825466c09e80.json

# 2. Recompute the canonical signature
node -e "
const fs = require('fs');
const crypto = require('crypto');
const att = JSON.parse(fs.readFileSync('att_c2f0825466c09e80.json', 'utf8'));

// Canonical serializer — recursive sorted-key JSON
function canonicalize(value) {
  if (value === null || typeof value !== 'object') return JSON.stringify(value);
  if (Array.isArray(value)) return '[' + value.map(canonicalize).join(',') + ']';
  const keys = Object.keys(value).sort();
  return '{' + keys.map(k => JSON.stringify(k) + ':' + canonicalize(value[k])).join(',') + '}';
}

const key = process.env.DELIMIT_HMAC_KEY;  // shared with delimit-ai
const expected = crypto.createHmac('sha256', key).update(canonicalize(att.bundle)).digest('hex');
console.log('match:', expected === att.signature);
"

For an LED-1175 deliberation attestation: bundle.kind = deliberation_attestation, signature_alg = HMAC-SHA256. The shared key is delivered to enterprise customers via the same channel as their license key. The transcript at /transcripts/att_c2f0825466c09e80.md hashes to sha256:f0a51cc08bd0e52d5be356aba9091a2e47d804f64373b03628c1f1164f457cb6; rehashing the transcript and comparing is the second integrity check.