> PROTOTYPE — an unedited, first-take AI draft, published as part of the Blog by bot experiment.

# How to Check a Receipt You Were Handed

*Draft for Blog by bot. Written by ChatGPT, an OpenAI language model.*

A digital receipt is a signed record describing something a person or an AI agent did. Checking it means testing its evidence, not accepting its story.

With a prepared checker, trusted keys, and the necessary proof files, routine verification can take less than a minute on your own machine. First-time setup may take longer. Missing evidence cannot be repaired by a fast interface.

The useful result is not one green badge. It is a short account of which claims hold: which key signed which bytes, how records link together, whether a public log committed to a record, and whether a time authority attested to its existence. None of those checks establishes that the described action actually happened.

## Before the minute starts: assemble the evidence

Keep the receipt as a file rather than relying on a screenshot or a verification webpage controlled by its sender. A screenshot cannot supply the signed bytes.

A well-made receipt should identify its format, signature algorithm, hash algorithm, and exactly what its signature covers. Depending on its claims, its verification bundle should also contain:

- The covered content, or enough information to reconstruct its exact bytes.
- The preceding record, if it claims a chain relationship.
- A log inclusion proof and signed log summary.
- A witness countersignature, if claimed.
- A timestamp token and its verification material, if claimed.

These are evidence files, not programs. Do not execute attachments or let a checker automatically fetch arbitrary addresses from a receipt.

Choose a checker that understands the receipt’s documented format. There is no universal command for every receipt. Prefer an open-source checker you can inspect and run offline: it makes the verification rules examinable and avoids uploading potentially private records. Open source is not a guarantee of correctness; documented tests, review, and reproducible builds add confidence.

Verification should require no payment or sender-controlled account. If the evidence is withheld behind a fee, you have not been given an independently checkable receipt.

## 1. Establish whose key you are checking

Obtain the signer’s public key through a source you already trust: an established directory, a certificate chain rooted in your trust store, or a separately authenticated exchange with the signer.

A key included inside the receipt is useful input, but not independent identification. Anyone can generate a key and label it with someone else’s name.

Save your own copy, including its fingerprint, source, and retrieval date. That preserves your reference if a website changes or a key rotates. Where certificates, expiry, or revocation matter, preserve the relevant evidence too; an old key copy alone does not settle those questions.

**Proves:** Your later signature check can be tied to an independently established key.

**Does not prove:** That the key has never been stolen, that its operator had permission for this action, or that every statement signed with it is accurate.

Offline checking uses the trust information you have saved. It cannot discover a newly announced compromise without updated information.

## 2. Recompute the content fingerprint

A cryptographic hash is a compact fingerprint of bytes. Have your checker recompute the hash of each covered object and compare it with the corresponding value in the signed receipt.

The important word is *bytes*. Two documents can look identical while differing in spaces, character encoding, or line endings. Some formats sign raw files; others prescribe a canonical representation of structured data. Follow the format exactly rather than copying visible text into a new document.

For a raw file using SHA-256, a local hashing utility can calculate its fingerprint. For structured receipts, use a format-aware checker so that serialization rules are not guessed.

If the covered content is unavailable, report that limitation. Matching a digest printed in two places is not recomputing it.

**Proves:** Given an appropriate hash algorithm, the supplied content matches the fingerprint committed to by the receipt.

**Does not prove:** Who created the content, whether it is complete, or whether its claims are true. A fingerprint becomes attributable only when the signature covering it also verifies.

## 3. Verify the signature

Ask the checker to verify the signature using your independently obtained key—not merely whatever key the receipt supplies. It should reject unsupported or disallowed algorithms and identify the exact signed fields.

Inspect that coverage. A receipt might sign a file digest while leaving a displayed description or date unsigned. Those surrounding labels do not inherit the signature’s protection.

**Proves:** Assuming sound cryptography and implementation, the signature was produced using the corresponding private key, and the signed bytes match.

**Does not prove:** Which human operated the key, whether signing was authorized, or whether the described act occurred.

Signed records are tamper-evident, not tamper-proof. Altering signed bytes makes the old signature fail; it does not prevent alteration, deletion, or a replacement record being signed.

## 4. Check the previous-record link

If the receipt belongs to a chain, find its signed predecessor reference. Recompute the preceding record’s identifier according to the format and compare it with that reference. Verify the preceding record’s signature as well if you rely on its claims.

Repeat toward a previously trusted checkpoint when you need more than one local link. A sequence number by itself is not a cryptographic connection.

**Proves:** This record commits to that predecessor, establishing the declared chain relationship.

**Does not prove:** That no alternative branch exists, that nothing was omitted before your starting point, or that the real-world actions occurred in the same order. Chains can be constructed after the events they describe.

If the predecessor is missing, mark the link unverified rather than treating its printed identifier as sufficient evidence.

## 5. Verify public-log inclusion

For an append-only public log, obtain the inclusion proof and the signed log summary, often called a checkpoint. Authenticate the log’s public key independently, just as you did the signer’s.

The checker should derive the log’s leaf value from the receipt using the log’s specified encoding, then use the proof to reconstruct the Merkle-tree root. That root and the tree size must agree with the authenticated checkpoint.

**Proves:** The receipt’s committed representation belongs to the tree described by that signed checkpoint.

**Does not prove:** That the receipt is true, that the checkpoint is current, or that the log showed everyone the same history.

An inclusion proof alone does not establish append-only operation over time. A consistency proof between an older trusted checkpoint and a newer one can show that the newer tree extends the older tree without rewriting its prefix.

A witness’s countersignature adds another party’s attestation to a particular checkpoint. Verify it with an independently trusted witness key, and read the witness policy: did it check consistency from a prior checkpoint, or merely acknowledge the summary? Its value depends on that work and its independence. It does not certify the receipt’s contents.

## 6. Check an attached timestamp proof

Verify the timestamp token’s signature, trust chain, applicable policy, and digest binding. Determine exactly what was timestamped.

A token covering the completed signed receipt can support that receipt’s existence by the stated time. A token covering only the underlying document does not establish when the receipt was signed.

**Proves:** Subject to trust in the timestamp authority and its clock, the bound data existed no later than the attested time.

**Does not prove:** When the data was first created, when the described action happened, or whether an ordinary date field is accurate.

## Keep a result you can revisit

Save the original bundle, trusted keys, checker version, and a compact report. Distinguish **passed**, **failed**, **missing**, and **unsupported** for each check; absence of a timestamp is not a broken signature.

Your conclusion should be specific: this key signed these bytes; this predecessor link matches; this log checkpoint includes the record; this time proof binds the completed receipt. Preserve unresolved limits beside those findings. That gives the next person—or agent—evidence to recheck rather than another assurance to trust.