Independent Verification Attestation
RAIC asks auditors not to trust its integrity claims. That obligation runs both ways, so the results of RAIC's own independent verification exercise are published here on a fixed quarterly cadence rather than described in marketing copy. This page states what is checked, what each check would catch, the honest limits of the exercise, and where the current quarter's result stands.
Cadence and scope
The attestation is refreshed once per calendar quarter, and additionally whenever the verifier specification text version changes. Each refresh restates the checks below against the current specification text and the current signing key fingerprint. A quarter in which a check fails is published as a failed quarter with the defect recorded — the point of the exercise is to surface interpretation drift, so a suppressed failure would defeat it.
- Cadence: quarterly, plus on every verifier specification text-version bump.
- Subject: the published Evidence Verifier Specification and the artifacts it governs.
- Publication: this page, with the prior quarter retained for comparison.
What is checked each quarter
- Differential agreement
- A second verifier, written in Python from the published specification text alone and sharing no RAIC code, verifies a real signed audit pack and must agree with the verifier bundled inside every pack. Disagreement means the implementation and the published text have diverged.
- Merkle vectors
- Leaf and node construction, odd-level promotion, leaf-count binding and inclusion-proof recomputation are checked against independently computed vectors. A duplicated trailing node — the construction the specification forbids — must be rejected.
- Domain-separation negatives
- Digests computed without the RAIC-MERKLE-1 leaf and node prefixes must fail. This is the check that catches a second implementation that hashes the right bytes in the wrong domain and appears to succeed.
- Tamper localization
- Tampered twins of a valid pack — altered entry digest, altered day root, altered manifest, altered signature — must each fail, and must fail naming the specific artifact that broke rather than failing generically.
- Offline execution
- The independent verifier runs with networking disabled, so no check can silently depend on reaching RAIC. External timestamp validation is exercised separately against examiner-supplied trust anchors.
- Specification sufficiency
- Every point at which the published text was insufficient to write the second verifier is recorded as a specification defect and corrected additively with a text-version bump. Recorded defects are disclosed, not withheld.
Reproducing it yourself
None of this requires RAIC's cooperation. The independent verifier and its fixture generator ship in the repository, and the specification it was written from is the same public page an auditor reads. Obtain a signed pack, run the bundled verifier and the independent verifier against it, and compare the two results. Agreement on a valid pack and localized disagreement on a tampered pack are the outcomes to expect.
- Read the specification: /support/verifier-spec
- Run the verifier bundled inside the pack, then the independent one, and compare.
- Confirm both fail — naming the same artifact — on a deliberately altered copy.
Honest limitations
The independent verifier was written inside RAIC's engineering context by an author who has read the implementation. That is a weaker guarantee than a genuinely blind third party, and it is mitigated rather than eliminated: the author worked strictly from the published page, and every insufficiency in that page is recorded. Until an outside party repeats the exercise, RAIC copy says "published specification and a bundled offline verifier" and never "independently verified". This page exists so that distinction is stated where the claim is made, not buried.