Every AI answer — with a receipt.

Example receipt.json

{
 "body": {
  "spec": "sapir-receipt/1",
  "kind": "citation-check",
  "ts": "2026-10-28T20:51:04.775Z",
  "input_sha256": "e8115555b9505b63…d061b211c69",
  "checker": "CourtListener citation resolver (courtlistener.com/c/), name-token match >= 0.5",
  "results": [
   { "cite": "410 U.S. 113", "name": "Roe v. Wade", "verdict": "verified",
     "source": "https://www.courtlistener.com/opinion/108713/roe-v-wade/" },
   { "cite": "925 F.3d 1339", "name": "Varghese v. China Southern Airlines Co.", "verdict": "not_found",
     "note": "No case at this citation in CourtListener. Likely fabricated." }
  ],
  "summary": { "total": 2, "verified": 1, "flagged": 1 },
  "key": { "alg": "Ed25519", "x": "RMJOfCYzDOsYHFAMA5W5VPmnYN51jh7_sgDPzijAzu0" }
 },
 "sig": "gN-7XztHZP4GRO5MZ0zZTKAuat8V…JAegI0In4lE3gGpEDA",
 "digest": "64997144dd1234f4…2e987fdc24",
 "log": { "n": 33, "hash": "d23cc14ceead753a…52e95f85e55e" }
}

Shortened for display. Real receipts include full hashes and every note.

Verify offline in ~10 lines

import { readFileSync } from "node:fs";   // node verify.mjs receipt.json  (Node 20+)
const r = JSON.parse(readFileSync(process.argv[2] || "receipt.json", "utf8"));
const canon = o => o === null || typeof o !== "object" ? JSON.stringify(o) : Array.isArray(o) ? "[" + o.map(canon).join(",") + "]"
  : "{" + Object.keys(o).sort().filter(k => o[k] !== undefined).map(k => JSON.stringify(k) + ":" + canon(o[k])).join(",") + "}";
const msg = new TextEncoder().encode(canon(r.body));
const hex = Buffer.from(await crypto.subtle.digest("SHA-256", msg)).toString("hex");
const pub = (await (await fetch("https://proof.sapir861.com/.well-known/proofkit-pubkey")).json()).jwk;
const key = await crypto.subtle.importKey("jwk", pub, { name: "Ed25519" }, false, ["verify"]);
const ok = await crypto.subtle.verify({ name: "Ed25519" }, key, Buffer.from(r.sig, "base64url"), msg);
console.log(ok && hex === r.digest && pub.x === r.body.key.x ? "VALID" : "INVALID");

# pip install cryptography ; python verify.py receipt.json
import json, sys, base64, hashlib, urllib.request
from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PublicKey
r = json.load(open(sys.argv[1] if len(sys.argv) > 1 else "receipt.json", encoding="utf-8"))
b64 = lambda s: base64.urlsafe_b64decode(s + "=" * (-len(s) % 4))
msg = json.dumps(r["body"], sort_keys=True, separators=(",", ":"), ensure_ascii=False).encode()
pub = json.load(urllib.request.urlopen("https://proof.sapir861.com/.well-known/proofkit-pubkey"))["jwk"]
try:
    Ed25519PublicKey.from_public_bytes(b64(pub["x"])).verify(b64(r["sig"]), msg)
    ok = hashlib.sha256(msg).hexdigest() == r["digest"] and pub["x"] == r["body"]["key"]["x"]
except Exception: ok = False
print("VALID" if ok else "INVALID")

No install: open https://proof.sapir861.com/verify and paste receipt.json.
Verification runs locally in your browser (WebCrypto Ed25519). Nothing is uploaded.

Public key: /.well-known/proofkit-pubkey