We show our receipts

The machinery that writes them: append-only hash-chained manifests, dual RFC 3161 time witnesses, pinned Ed25519 signatures, and one offline fail-closed command — receipt verify. An open-source package anyone can adopt; it has its own page.

What an offline check of agent-produced records establishes and refuses to establish, why trust anchors live in the verifier's own code, and the four evidence classes behind the package. Manuscript, PDF, and the code it describes.

Engine releases ship checksums and build attestations. Verify the binary you downloaded against the attestation log with commodity tools before you run it.

Every rule cites the provision of law it encodes, and modules carry companion tests. CI runs a module's tests unless it sits on a public waiver list: 1,940 rulespec-us modules carried an active validation waiver on October 2, 2026, and they hold 23,735 of our 34,810 US rules (rule counts as of September 28). The repositories are the receipt: the citations, the tests, the waiver list, and their history are public.

Encodings are compared with other calculators and datasets in the open, and the disagreements are recorded.

A program certifies only when axiom-oracles computes all four premises — conformant, exercised, closed, executable — true with zero open defects, and no flag is set by hand. None passes yet. The API serves a rule as certified only when it is in the certified ledger, where every entry names its claim — computed by a verifier, or attested by a human signature — and pins its evidence. That ledger is empty. The emptiness is the credibility.