Verify a record
Recompute a sealed record's digest in your browser.
Where a record's bytes are published, they ship as its canonical bytes — the exact bytes its digest was computed over, with the digest field set to sixty-four zeros — beside the digest the record states. Hash the bytes; compare. Nothing leaves your browser.
A sealed record carries an excerpt of what each rollout submitted. On an exam whose graded output is an ANSWER, that excerpt is the answer key, so those records' canonical bytes are withheld and the exam page states the digest and the reason instead. The rule is the exam's disclosure class, printed on every exam page and in every report; it is not decided per document. Records for exams whose graded artefact is public upstream source are published as bytes and can be checked here.
SHA-256 over the record's canonical JSON: keys sorted, separators , and : with no spaces, non-ASCII escaped, and recordDigest.sha256 set to sixty-four 0 characters. The published *.canonical.json file is that serialization, byte for byte.
—
shasum -a 256 <evalId>.canonical.json
The engine's own check, on a full record: vvdex-env records verify --report <evalId>.md.