Anyone can check it.

// canonical(v) — RFC 8785-equivalent, applied before every hash:
if v === null || typeof v !== "object":  return JSON.stringify(v)
if Array.isArray(v):                     return "[" + v.map(canonical).join(",") + "]"
else (object):
  keys = Object.keys(v).sort()           // native JS .sort() — UTF-16 code-unit order
  emit each "key":canonical(value) IN THAT SORTED ORDER, comma-joined, wrapped in { }
  — properties whose value is undefined are omitted (matches JSON.stringify)
  — keys are serialised straight from the sorted array, never rebuilt into a
    fresh {} — rebuilding re-triggers V8's own key order, which hoists
    integer-like keys ("0","1","42") first regardless of sort. That single
    line is the actual difference between this and a naive "sort + stringify".

// Numbers: ECMAScript Number::toString via JSON.stringify (RFC 8785 §3.2.2.3
// is defined against this). -0 serialises as 0.
// Strings: whatever JSON.stringify escapes — no extra escaping added.
// All hashes and signatures below are lowercase hex, never base64.

// Event chain — web/lib/audit.ts, packages/verify/index.jsh_0 = ""                                          // empty-string seed, not sha256("")h_i = SHA256_hex( h_{i-1} + canonical(event_i) )  // event_i with its own _hash field removed// events are hashed in array order (not re-sorted by seq for this chain)content_digest = h_n                              // the terminal hash; sha256("") if zero events

// Oracle-stream / cassette digest — packages/replay/src/{cassette,digest}.ts
// A SEPARATE chain from the event chain above — it's what makes a record
// re-executable, not just internally consistent. Events are sorted by seq
// first; "run" and "reasoning" events don't enter it.

oracleEntryOf(event):
  llm  → { kind: "llm",  key: sha256("llm:"  + model_id + ":" + canonical(request, projected)), output: error ? {error} : response }
  tool → { kind: "tool", key: sha256("tool:" + tool_name + ":" + canonical(input, projected)),  output: error ? {error} : output   }
  env  → { kind, key, output } directly (kind: now | date | random | uuid | fetch)

chainStep(prev, entry) = SHA256_hex( prev + canonical({ kind, key, output }) )
cassette_digest = final chainStep result, in seq order (sha256("") if no oracle entries)
entry_count     = number of oracle entries (usually < event_count — run/reasoning excluded)

// Optional per-event "key_projection: { keep?, drop? }" strips volatile fields
// (nonces, request IDs, timestamps) from the input before it's hashed into the
// key, so two semantically-identical calls key identically. Applied identically
// by the SDK, the server, and the verifier — same function, three call sites.

// Signing — web/lib/audit.ts. Preference order: Ed25519, then HMAC-SHA256, then unsigned.payload = content_digest + ":" + cassette_digest        // UTF-8, colon-joined hex digests Ed25519:      crypto.sign(null, payload, privateKey)     // null digest — Ed25519 doesn't pre-hash              signature hex-encoded; manifest.signature.pubkey carries the SPKI PEM              public key inline, so a record verifies fully offlineHMAC-SHA256:  createHmac("sha256", key).update(payload).digest("hex")              proves custody of a shared secret, not identity — no non-repudiation // A rotated-out key (*_PRIVATE_KEY_PREVIOUS) still verifies records it signed.// The published Ed25519 key: GET /.well-known/runback-audit-key.pem