Every exchange with the assistant on this site appends a hash-chained evidence record: agent identity, action, outcome, and SHA-256 digests of the input and reply — never the message text itself. Any tampering with history breaks the chain. This is the same attested-agent-evidence capability we build for clients (aligned with where IETF agent-audit-trail and SCITT work is heading, and with the EU AI Act's event-recording requirements for high-risk AI).
Open the chat on any page and ask a question — that exchange becomes a new record.
Public, read-only JSON: /attested-evidence.php — record count, chain head, and every record.
Recompute each record's hash and check the links. Change any byte of history and verification fails.
Each record's entry_hash = SHA-256(prev_hash +
canonical JSON of the record body, keys sorted, no whitespace). The first record chains from 64 zeros. In Python:
import hashlib, json, urllib.request
data = json.load(urllib.request.urlopen("https://nextgensec.io/attested-evidence.php"))
prev = "0" * 64
FIELDS = ["record_id","agent_id","agent_kind","session_id","action_type","outcome",
"trust_level","timestamp","sequence","tool_name","input_digest",
"output_digest","parent_record_id","extras"]
for i, r in enumerate(data["records"]):
body = {k: r.get(k) for k in FIELDS}
canonical = json.dumps(body, sort_keys=True, separators=(",", ":"))
assert r["prev_hash"] == prev, f"record {i}: broken link"
assert r["entry_hash"] == hashlib.sha256((prev + canonical).encode()).hexdigest(), f"record {i}: tampered"
prev = r["entry_hash"]
print(f"chain OK: {len(data['records'])} records, head {prev[:16]}…")Honest scope: the on-host chain is tamper-evident, not tamper-proof — a host compromise could rewrite a whole chain, which is why we also pull, verify, and cryptographically countersign the chain head off-host (post-quantum ML-DSA-65 signatures) on a schedule. Privacy: digests are one-way; your message content is not recoverable from this file and is never stored in it.
A signature is only evidence if you can tell ours from anyone else's. We countersign with one long-lived key and publish its fingerprint here so you can pin it. Check that any attestation you receive from us carries this exact fingerprint — if it does not, it did not come from us, whatever else it says.
| Algorithm | ML-DSA-65 (FIPS 204) |
| In use since | 23 September 2026 |
| Fingerprint | sha256:f536624c9cb2e66994c8d2ae3a34f99e90983155d45fec08c43ce8c1f74ff670 |
| Public key | attest-key.json — the fingerprint is SHA-256 over these public-key bytes |
The private half never leaves our operator device and is never published. If we ever rotate the key, the retired public key stays published alongside the new one, so attestations made before the rotation remain verifiable. What this does and does not prove: it proves the same key signed the heads you are comparing. It proves those heads are ours only if you obtained this fingerprint from a source you trust.