diff --git a/README.md b/README.md index ea35439..35b79cf 100644 --- a/README.md +++ b/README.md @@ -7,7 +7,13 @@ > Verify CertifiedData.io certificates from the command line. Audit-friendly, zero crypto dependencies. -## Verify something real, right now +## Verify real production evidence yourself + + +![Verifying a real CertifiedData payment receipt with the public npm verifier: the command runs, prints VALID, and lists the policy hash, authorization, decision record, artifact hash, certificate and Stripe settlement bound by the signature](https://raw.githubusercontent.com/certifieddata/verify/main/docs/media/verify-demo.gif) No install, no account, nothing of ours on your machine: @@ -25,6 +31,19 @@ Both ids are real production artifacts, and both verdicts are computed locally against the issuer's published key — not read back from our API. If our servers disagreed with the maths, this tool would side with the maths. +The receipt above carries signed bindings for the policy snapshot that +authorized the spend, the authorization and decision records, the live Stripe +settlement, the artifact hash and the certificate issued for it. The recording +uses the short `npx @certifieddata/verify …` form; the longer form above is the +one that also works on Windows, where `verify` is a cmd.exe built-in. + +What that signature establishes is narrow and worth stating exactly: that +CertifiedData issued the record, that its bytes have not changed since, and +which policy, authorization, decision, artifact and settlement were bound +together at the moment of signing. It does **not** establish that the policy was +a good one, that any control was effective, or that anyone is compliant with any +regulation. + ## Install ```bash diff --git a/docs/media/verify-demo.gif b/docs/media/verify-demo.gif new file mode 100644 index 0000000..bd4df8d Binary files /dev/null and b/docs/media/verify-demo.gif differ