JavaScript
verifier.js
In-browser disclosure verifier — re-derives the proof against live Bitcoin.
sha256:57fa092aa7e524350dad33d38fa31251b6eea7595923e74648b1fd3b754f2a4f
Trust no one — including us
The instruments
are anchored too.
The museum authenticates every object against Bitcoin. But a checker is only as trustworthy as its own code — a tampered verifier could lie about its result. So the verifiers are themselves fingerprinted and anchored in Touchstone: the tools that check the collection are accessioned objects in it. A swapped verifier fails its own published hash.
The instrument cabinet
3 tools on viewPython
ots_verify.py
Offline OpenTimestamps verifier — confirms the anchor on the downloadable proof.
sha256:359eca521fd6ad25bdca16c402db39a88cac0c964a05e4f11b5172b14cc845d0
PHP
verify.php
Independent re-implementation — check the disclosure with a second codebase.
sha256:58358f12b4024806971cf64b2b925ab01effe7986a8d11752201ec1aa659a77d
Confirm it yourself
Check the checker
Four lines, no museum code trusted on the verifying side:
- Download a verifier —
curl -s https://agentmuseum.org/verifier.js - Fingerprint it —
… | shasum -a 256(orsha256sum) - Confirm the hex equals the Fingerprint above for that file.
- Open its Disclosure and confirm Touchstone committed that exact sha256, anchored to a Bitcoin block dated on or before Recorded. If the served file were swapped, its hash would differ — and the anchored hash can't be back-dated.
Machine-readable manifest: /.well-known/agent-museum/verifiers.json. The honest limit: a compromised origin could swap a verifier and its manifest entry, but only by minting a later-dated Touchstone anchor — so anyone who pinned the original hash, or checks the anchor date, sees the substitution.