Auditor Recognition Kit

What RAIC asserts, and what that assertion is worth

Files are unchanged since export

Every pack manifest lists the SHA-256 digest and byte count of every file in the pack. Recomputing those digests proves the contents match what was exported. This check needs nothing but a browser.

The pack was issued by RAIC

The manifest hash is recorded in RAIC's sealed ledger and is returned by the open verification endpoint. A hash the endpoint does not recognize was not produced by RAIC, or was altered after export.

The underlying history was not rewritten

Ledger entries are SHA-256 chained per organization and sealed into a day root each night. Altering an old entry breaks every later digest and contradicts a day root that was already published.

What RAIC does not assert

RAIC attests to the integrity and timing of records, not to the truth of what a person entered. A sealed record of an incorrect control assessment is a reliable record of an incorrect assessment.

Verifying a pack in five minutes

• Extract the ZIP. Do not open the CSVs in a spreadsheet application first — saving rewrites the bytes and will fail the digest check for benign reasons.
• Open verify.html from the extracted folder. It is self-contained: no network calls, no external scripts, nothing is transmitted.
• Drop the extracted files onto the page. Each file is hashed locally and compared with the digest recorded at export.
• Read manifest.json for the manifest hash, organization, job ID, export timestamp, and the exporting user's email address.
• Optionally confirm issuance: GET https://app.rhindoncyber.com/api/public/verify-evidence?manifest_hash=<64-hex>. No account or key is required.

Verifying without a browser: the command-line verifier

For batches of packs, air-gapped review, or a build that should fail when evidence stops verifying, use the standalone verifier. It is an independent implementation written from the published specification using only the Node standard library — not a repackaging of RAIC code, because a verifier built from our implementation could not reveal a divergence between our implementation and the published spec. It has no dependencies to install, makes no network calls, and transmits nothing.

• Download: https://app.rhindoncyber.com/RhindonCyber_VerifyPack.mjs — the same file also travels inside every signed pack as verify-pack.mjs.
• Run: node RhindonCyber_VerifyPack.mjs signed-pack.json
• Supply your own copy of the public key rather than trusting the one embedded in the script: node RhindonCyber_VerifyPack.mjs signed-pack.json --jwk key.json
• Use --json for machine-readable output. Exit codes are 0 when every check passes, 1 when any check fails, and 2 when the pack cannot be read — so CI can gate on the exit code alone.
• It reports what it could not check as well as what it did: day roots whose entry hashes the pack does not disclose are stated as out of scope rather than counted as passes.

Reproducing the checks yourself

Nothing in the verification path is proprietary. Digests are SHA-256, lowercase hex. Canonicalization is UTF-8 with object keys sorted lexicographically and no insignificant whitespace. Signatures are ECDSA over NIST P-256 with SHA-256, detached, base64-encoded, computed over the manifest or certificate hash rather than the whole document. On any Unix host, shasum -a 256 <file> reproduces the per-file digests in the manifest without running our code at all.

Evidence you can request from the audited organization

Signed audit pack

Sealed day roots, artifact fingerprints, lineage hops, manifest hash, detached signature. Use it to test that the evidence history is continuous across the period under review.

Continuity certificate

A signed statement of unbroken sealed history through a 30, 90, 180 day or 1, 3, 5 year milestone. Useful for establishing that governance operated continuously, not just on the day the auditor arrived.

AI oversight record

For organizations using RAIC's agent recommendations: who reviewed each proposal, what precedent and predicted priority were shown to them at the time, and what they decided. Reversals are appended, never overwritten.

Chain-verify sweep result

RAIC's own periodic re-verification of the hash chain and day seals. Ask for the most recent result; a break or a missed seal is recorded rather than suppressed.

Interpreting a failed check

• Digest mismatch on one CSV, others fine: almost always a re-saved file. Re-extract from the original ZIP and repeat.
• Digest mismatch across every file: the pack was rebuilt or repackaged. Request a fresh export directly from the platform.
• Manifest hash not found by the endpoint: the pack did not come from RAIC, or the manifest was edited. Treat the artifact as unverified.
• Endpoint reports a chain break for the period: escalate. RAIC records breaks rather than hiding them, so a recorded break is a finding, not a verification failure.

Scope and privacy of the public endpoint

The verification endpoint is open, unauthenticated, permissively CORS-enabled, and deliberately non-identifying. It answers whether a hash is known to RAIC and what kind of artifact it belongs to. It never returns organization names, user identities, artifact contents, or any personal data, so an auditor can use it freely without creating a data-sharing question for the audited organization.