# Verify ScoreIA Release Evidence Reference 001

This is an **internal synthetic technical reference**. It is not a client case,
did not call a real model, is not a benchmark and is not an independent audit.

The signed Receipt deliberately publishes twenty opaque `sia-…` identifiers
and their hashes as cryptographic commitments. They are not secrets or access
grants. No card payload is public through them, including when another private
Trial namespace is authenticated. The projection excludes card contents, raw
replays, journals, prompts, configurations, capabilities, access tokens and
the private namespace.

The browser page verifies locally:

- the exact public-only Ed25519 JWK contract (`OKP`, `Ed25519`, `EdDSA`,
  `use=sig`, `key_ops=[verify]`, 32-byte public key, no extra/private member);
- the 64-byte Ed25519 signature of the original Release Receipt;
- the 64-byte Ed25519 signature of the dossier attestation;
- the RFC 8785 / SHA-256 hash of the safe source report;
- the Receipt/report/attestation/campaign/configuration commitments;
- all twenty opaque evidence commitments, without fetching their payloads;
- the ten matrix rows, including case 10 where `not_measured` is the expected
  abstention rather than a generic pass;
- the frozen `HOLD` policy, coverage and critical finding.

The public key is fetched from `../trust-anchor.json`, outside the artifact
directory. This prevents the artifact set from supplying its own untrusted key,
but both are published by ScoreIA: this is **not an independent audit**.

With Node.js 20 or later:

```bash
curl -O https://scoreia.ai/private-trials/reference-hold-001/artifacts/verify-reference.mjs
node verify-reference.mjs
```

Expected output includes:

```json
{
  "ok": true,
  "integrity": "VALID",
  "status": "HOLD",
  "independent_audit": false,
  "client_case": false,
  "real_model_called": false,
  "model_benchmark": false
}
```

The check proves the integrity and internal consistency of what ScoreIA
signed. It does not expose or independently recompute the private execution
material, and it does not prove market demand, general model quality or the
absence of regressions outside the frozen ten-scenario contract.