Verify a receipt
on your own machine.
Save ICA's public signing keys once and confirm their fingerprints. The first copy of the keys comes from ALEETH. From then on, the published verifier checks the Ed25519 signature of a receipt you hold, offline, against your saved copy. The live checks below run on ICA's servers. They show the same records from ICA's side, with no login and no account.
$ node verify.js receipt.json --pubkeys ica-trust-anchor.json
Without --pubkeys the verifier fetches ICA's keys each time it checks, and so trusts whoever serves them. Pinned to the copy you saved and confirmed, it trusts no server, ALEETH's included.
Holding a receipt hash from a release or a report? Paste it in the first check below and see what ICA decided.
The verifier writes each result in words. A colored mark only repeats that written result.
Check a receipt
Paste a receipt hash. Your browser asks ICA's public verifier and its transparency log about that exact receipt and shows what ICA signed: what the agent asked to do, the decision, and the reason. No login, no account.
From the October 21, 2026 release:
Verify a credential
A credential number proves a credential is real and its Ed25519 signature verifies against a published key. The organization name is a second factor, so a number alone never reveals who holds it.
Verify the ledger
ICA's audit chain is append-only: database triggers refuse updates and deletes. Ask ICA to recompute the entire audit root from the raw rows and check it against the sealed hash. This check runs on ICA's servers. To check a receipt without them, use the published verifier described at the top of this page.
Was the authority valid when it acted?
A signed receipt records a governed action. The question an auditor asks after the fact is not whether the authority is valid now, but whether it was valid at the moment the action executed. Paste a receipt hash. ICA recomputes its signature and reconstructs the authority state as of the execution timestamp, from its own timestamped records, using the same code that gates a live action.
Watch the door refuse
A vendor claiming it enforces governance is a claim. A door that refuses an anonymous caller is a demonstration. Call a governed endpoint with no credential and watch the call get denied before it runs. Then call the public one and watch it open.
Watch the kill switch
Refusing an anonymous caller is one thing. Stopping an agent that is already running is the harder one. ICA halts and quarantines a live agent, and seals the halt to the ledger before the action is stopped. Here is that state, live.
Every result here is live. One honest mechanic worth knowing: a freshly written seal is submitted to Bitcoin through OpenTimestamps and reads pending until a block confirms it, usually within hours. Once confirmed, its time stamp can be checked against Bitcoin with any OpenTimestamps client. Pending is what a real anchor looks like on the day it is written.
Public key, trust anchor, and the proofs: receipt public key · trust anchor · the TLA+ specifications · offline verifier