Verify a bundle
Choose a bundle zip. Your browser opens it, recalculates the sha256 of every file and compares it with manifest.json, adds up the playbacks in timeline.json and compares them with its totals, checks the human axis against the log, and checks the proof of when the run was played against the Archive's key. Nothing leaves your browser: there is no upload.
If the bundle contains a signature.json, the signature over manifest.json is verified as well, and so are the Archive's own signatures in proof.json. Both need a browser that supports Ed25519.
What is checked
- Hashes: every file listed in
manifest.jsonhas the listed size and sha256; every file in the zip is listed, exceptmanifest.jsonitself and the private part of an upload. - Timeline: the segments' seconds add up to the real time; the playbacks' in-game time adds up to the in-game total; their wall time to the playback total; thinking equals real time minus playback time; every section's in-game time is the sum of the playbacks inside it; the summary's own figures match.
- Human axis: a run declared
human: nonehas norun.humanrecord in the published run. Arun.humanrecord aftercompleted_atthat is followed by agame.goalbelongs to a goal extension that is not published yet, and does not count (SPEC §8.3). - Proof: every ticket and receipt in
proof.jsonis signed by the Archive's proof key, each head follows the one before it, and each receipt is for its head. When the zip holds the private part of an upload, every head is computed again from those logs, in your browser.
This is the same verification anyone can run with the tooling's aas check, except for the timeline format checks. Making the public log again from the private logs is done by aas check and by the Archive when a run is submitted, not here.