# HumanProof format and local verification kit

Preview package, 3 October 2026. This is a verification tool, not a Writer installer or an institutional approval.

Unzip the package. With Node.js 22.13 or later, run from its directory:

```sh
node verify.mjs examples/assurance-record.json examples/assurance-document.txt
node verify.mjs fixtures/synthetic-certificate.json fixtures/synthetic-document.txt
```

The first example is synthetic, requests L2 and achieves L1. Synthetic data does not establish a real writing process. All cryptographic checks are actually executed. To test a changed document, compare a copy with an extra byte; fileStatus must become mismatched. Never modify a real archived original.

Exit 0 means this operation passed its integrity and requested file checks. It does not establish signer identity. An independently confirmed SHA-256 fingerprint may be supplied as a third argument; a mismatch fails. Exit 1 means a verification finding failed. Exit 2 means the operation could not complete.

The report is unsigned. It keeps integrity, signer trust, file binding and assurance separate. It omits manuscript bytes, filenames, full records and key identifiers. Hashes may still identify files. Local time is not trusted time.

PDF input checks the embedded record only. It does not validate the whole PDF/CMS signature, visible pages, authorship, absence of AI or truth of recorder observations.

No server, account, npm install or network access is needed to run the supplied verifier. Archive this tool version with the record, original file and independent key association. No live key revocation is performed. Long-term verification also requires maintaining a suitable runtime and trust information.

Schemas specify structure; they do not replace signature, exact-byte, chain, binding or recomputed-assurance checks. Numeric L1–L3 are separate from the header observation class localObservation. L3 requires the strict native input contract; public native distribution remains experimental. L4/L5 are unavailable.

The source is supplied for local technical evaluation and inspection. Public redistribution and institutional licensing terms are not settled in this preview. Do not infer a broader licence grant, warranty, legal clearance or support SLA from this package.