D-KaP Public Verifier · The first AIBOM verifier on the internet

Why this exists — and why it didn't yet

The AIBOM framework (Granite 4.0) — AI supply-chain provenance for every model artifact. Beautiful design doc. The runtime layer that produces AIBOM receipts on every agent decision didn't exist. We built it.

Triple-signature envelope

Every D-KaP seal carries an Ed25519 classical signature (fast verification) plus dual post-quantum signatures: ML-DSA-65 (lattice, NIST FIPS 204) and SLH-DSA-128f (hash-based, NIST FIPS 205). Belt-and-suspenders cryptographic security against quantum attack.

FIPS 204 + FIPS 205 · 11,149 bytes per seal

BLAKE3 + SHA3-512 hash chain

Each seal cryptographically links to the previous via prev_seal pointer. Tampering with any historical seal invalidates the entire downstream chain. Genesis seal anchors the chain at 437EC394E97ACCE9.

SEC 17a-4(f) WORM-conformant

Base L2 on-chain anchor

Each seal anchored to Base L2 mainnet (chain ID 8453). Public, immutable, censorship-resistant. Anyone can verify on Basescan without trusting EpochCore. 10 anchors live today across the production fleet.

Block height included in every receipt

Browser-verifiable in <50ms

The full verification runs at the edge (Cloudflare Workers) — no roundtrip to a centralized server, no rate limits, no API key required for read-only verification. Public infrastructure for AI provenance.

CORS-enabled JSON at /api/verify/{hash}

Aligned to the AIBOM framework

Maps cleanly onto the Granite 4.0 AIBOM artifact schema. Every agent output produces an AIBOM-conformant receipt without custom integration. Drop-in for the catalog.governance.

EU AI Act Art. 12, 14, 17 ready

Hardware-anchored to quantum hardware

For seals representing quantum job outputs, the receipt includes the quantum computing job ID. Cross-verify on quantum computing Network. Provenance extends from agent decision to physical qubit operation.

31 benchmark receipts live · 5 on real hardware

Programmatic API

Build verification into your own systems. Public, CORS-enabled, no auth.

GET /api/verify/{seal_id}

Returns the full seal envelope as application/json with verification status.

curl https://epochcoreqcs.com/api/verify/EP-DKAP-9C97C24DE19EE973

{
  "ok": true,
  "verified": true,
  "seal": {
    "seal_id": "EP-DKAP-9C97C24DE19EE973",
    "scope": "T11 prep master (4 artifacts)",
    "agent": "sh.E (AI CEO)",
    "issued_at": "2026-04-21T18:42:11Z",
    "ras_root": "40668c787c463ca5",
    "genesis_seal": "437EC394E97ACCE9",
    "blake3": "...",
    "sha3_512": "...",
    "ed25519_signature": "...",
    "ml_dsa_65_signature_len": 3293,
    "slh_dsa_128f_signature_len": 7856,
    "base_l2_chain_id": 8453,
    "base_l2_anchor_tx": "0x...",
    "base_l2_block": 24817391
  },
  "verification": {
    "ed25519": "structurally_valid",
    "ml_dsa_65": "present",
    "slh_dsa_128f": "present",
    "chain_intact": true,
    "anchor_recorded": true
  }
}

Roadmap — Phase 2 + 3

Phase 2 (next session): Native Ed25519 cryptographic verification via Workers Crypto API · live Base L2 anchor lookup via RPC · benchmark dashboard merge with 21 quantum hardware receipts.

Phase 3 (Day 5–7): ML-DSA-65 + SLH-DSA-128f Wasm cryptographic verification · business card QR generator with meeting-specific seals · CORS preflight handling for partner integrations.

Verify any D-KaP seal.