N° 0026 · Trust Architecture

How verification works.

KairoNull evidence records are verifiable without access to KairoNull systems. This page documents the exact methodology. Every step can be reproduced independently using standard cryptographic tools available on any operating system.

What a KairoNull record contains

Record IDUnique identifier for this decision event. Assigned at capture, never reused.

TimestampISO 8601 UTC timestamp at point of generation. Contemporaneous, not reconstructed.

AI InputThe prompt, parameters, and model selection that produced the decision.

AI OutputThe model response, decision result, and confidence score where applicable.

Policy IDThe named, versioned governance invariant evaluated against this decision.

Policy resultPASS, FAIL, FLAG, HOLD, or BLOCK with documented rationale.

Prev hashSHA-256 hash of the immediately preceding record. Links the chain.

Record hashSHA-256 hash of this record's canonical JSON representation. The verification target.

RFC3161 tokenCryptographic timestamp from FreeTSA, an independent trusted timestamp authority. Proves the record existed at a specific point in time, independently of KairoNull.

Verification methodology

Complete

Obtain the evidence record

Every KairoNull audit export includes a JSON file containing the ledger entry for each decision event. Download the sample evidence package to follow along with a real record.

Active

Recompute the SHA-256 hash

Extract the record payload and compute its SHA-256 hash. If the record has not been altered, the result matches exactly.

# Using OpenSSL on any Unix system
echo -n '{"id":"...","timestamp":"...","policy":"..."}' | \
  openssl dgst -sha256

# Expected output matches entry_hash field:
SHA2-256(stdin)= 7fa93d8c4a1b2e5f9c3d7a8b1e4f6a2d...

Pending

Verify the chain link

Each record's prev_hash must match the entry_hash of the preceding record. Any mismatch indicates insertion, deletion, or modification.

# record[n].prev_hash must equal record[n-1].entry_hash
Chain height 1,284,942: INTACT
All 45 records verified. No gaps detected.

Pending

Verify the RFC3161 timestamp

The RFC3161 token proves the record existed at a specific point in time. Issued by FreeTSA, independent of KairoNull. Cannot be backdated.

openssl ts -verify \
  -in timestamp.tsr \
  -data record_payload.json \
  -CAfile freetsa-cacert.pem

Verification: OK
Time stamp: Jun 22 05:35:39 2026 GMT

Pending

What tamper detection looks like

Any modification to any record produces a different SHA-256 hash. This breaks every subsequent chain link. Tampering is mathematically impossible to conceal.

# Modified record produces different hash:
SHA2-256(stdin)= a1b2c3d4... (does not match stored hash)
ERROR: prev_hash mismatch at record 1,284,943
Chain integrity: FAILED

Live verification available

Try the verification tool with real records from the KairoNull sample evidence package. No account required. Runs entirely in your browser.

Open verification tool →

See verification applied to your AI systems.

Book a technical briefing. We walk through the architecture with your specific governance context, regulatory obligations, and existing AI stack.

Book a technical briefing →