Skip to content

Live · nothing pre-recorded

Seal a change. Then try to forge it.

Real cryptography, executing in this tab. No server, no account, nothing uploaded.

What is real hereRead the disclosure

The cryptography is real and runs on your machine: deterministic CBOR, SHA-256 commitments, ML-DSA-65 + Ed25519 hybrid signatures, an RFC 6962 transparency log, and the offline verifier. Stages that would need a server or a third-party API are labelled SIMULATED from the stage's own field rather than from copy, and the estate data is synthetic. Hardware attestation reports MOCK and public anchoring ABSENT because neither ships yet — the verifier will never mark them as passing, and nothing in this UI can reach that rule.

Full disclosure list

One AI change, sealed and verified live in this tab. Then try to forge it.

Pick a change
retail-lending / adverse-actionacme/credit-scorer@2026.07.1

−Score this applicant and return approve or decline.

+Score this applicant and return approve or decline, with the top three contributing factors.

Runs entirely in this tab. No server, no account, nothing uploaded.

The pipeline

0/8

  1. Capture the change

    SIMULATED

    The SDK hook fires the moment the prompt changes. Async, buffered, fail-open — it never adds latency and never breaks inference.

    cool-sdk · CI/CD · gateway hook

  2. Queue it out-of-band

    SIMULATED

    The event lands on a durable queue inside the customer's own network. Nothing sits in the critical path of the model call.

    Rust ingest → Redpanda / NATS

  3. Canonicalise to fixed bytes

    REAL

    The record is encoded as deterministic CBOR (RFC 8949 CDE), so the same logical change always produces the exact same bytes on every machine.

    Evidence engine (Rust in prod)

  4. Commit with a hash

    REAL

    SHA-256 over those bytes becomes the binding hash — a fingerprint of the whole change. Alter one character anywhere and it no longer matches.

    Evidence engine

  5. Seal it — post-quantum

    REAL

    Signed twice over: ML-DSA-65 (FIPS 204, quantum-resistant) and Ed25519 (classical). Both must verify, so the seal holds for the ten-year retention horizon.

    Hybrid signer · HSM / TEE-held keys

  6. Append to the log

    REAL

    The commitment is appended to a tamper-evident Merkle log (RFC 6962 — the mechanism behind Certificate Transparency) and a Signed Tree Head is issued.

    Transparency log · Trillian / Rekor

  7. Do the paperwork

    SIMULATED

    Policy decides what this change needs, then the workflow writes the change doc, records the approval, files the compliance entry and notifies security.

    OPA policy · Temporal · Jira / Slack

  8. Prove it, without us

    REAL

    The receipt is checked offline against the keys it carries. Anyone — an auditor, a regulator, a customer — can run this exact check without asking CooL for anything.

    cool-verifier (offline)

Evidence appears here

Press Ship this change and watch one prompt edit turn into a sealed, provable, fully documented record — with nobody doing the paperwork.

The seven-stop walkthroughOpen the consoleInstall the SDK

Source · cool-sdk · cool-verifier · cool-spec · Apache-2.0 · Northwind Cipher Pvt. Ltd.