Auditor preview for world-model-mcp (OSS core)

This is a read-only page. Nothing on it can be changed by you or by the operator without breaking cryptographic verification.

Verify chain integrity in your browser

Every entry in the audit chain commits to the previous entry's hash. If any entry has been rewritten, inserted, or removed the chain breaks. The check below downloads the last 100 chain entries (hash fields only, no event content) and recomputes each entry's hash in your browser using WebCrypto SHA-256. Nothing runs on Etch's servers. Nothing is uploaded.

Row-quality ratio

The chain-integrity check above proves nothing has been rewritten after the fact. This separate metric answers a different question: how many of these rows carry at least one field the writer could not have produced alone. Options that qualify: a server-computed digest of the downstream response, a delegation from a distinct identity acting on behalf of another, or a chain kind that is inherently cross-actor (dissent, authority receipt, cross-chain reference, HSM attestation, delegation grant / revoke, key rotation). A chain of only self-reported rows scores zero here; a chain that also carries these shapes scores higher. Definition frozen at spec version 1.0.

Full cryptographic verification (CLI)

The browser check above proves the SHA-256 hash chain is consistent. To also verify the Ed25519 + SLH-DSA-SHA2-128f post-quantum signatures over every epoch, install the reference verifier (which ships as part of the open-source world-model-mcp package on PyPI), download this project's OSS-format manifest, and run:

pip install world-model-mcp
curl -sSL https://etch.systems/auditor/d0460669709831ede34cf8d44cea9d80/oss-manifest.json -o manifest.json
etch-verify manifest.json

The manifest URL is unauthenticated. Its embedded Ed25519 + SLH-DSA signatures are what the verifier checks, not the transport. Optional pin: fetch the pinnable public keys endpoint below out of band and confirm the fingerprints match the ones inside the manifest.

Endpoints

OSS etch-verify manifest (JSON, unauth): /auditor/d0460669709831ede34cf8d44cea9d80/oss-manifest.json
Pinnable public keys (unauth): /projects/world-model-mcp/audit-log/public-keys
Signed transparency-log head (unauth): /projects/world-model-mcp/transparency-log/head
Full audit-log dump (SQLite bundle, unauth): /projects/world-model-mcp/audit-log/dump

What each signed artifact carries

Ed25519 + SLH-DSA-SHA2-128f hybrid signature envelope
Key generation id binding the artifact to the exact key material
Public key fingerprints matching the pinnable public keys endpoint above
Merkle root committing to the events included in the artifact

Preview URL for world-model-mcp. Verifier is open-source: pip install world-model-mcp (ships the etch-verify CLI).