H33
h33-attestation · v0.1.0 · released 2026-06-04

Bundle + attestation + verifier — three artifacts agree without contacting H33.

"Portable Object → Independent Verifier → Independent Reproduction. You have that for bundles. Now you have it for attestations." — Eric, June 4 2026

The v0.1 verifier release proved a third party could independently reproduce a SACRED state_id from an enterprise bundle. This release closes the loop: the issuer produces a signed tda_v1 attestation. The verifier confirms the attestation, the bundle, and the canonical-replay verifier binary all agree. No H33 contact at any step.

Constitutional invariants this release embodies

Q0 — Who bears risk? Never H33. This release bears attestation accuracy + issuance determinism + verifier correctness.

Q0.5 — Who owns the decision? Always the owner. The verifier surfaces structural verdicts. It never judges decisions.

Determinism — Eric LOCKED: identical bundle + decision set + verifier version + signing key → byte-identical canonical payload (excluding issued_at_ms + signatures). Tested in the harness; passes.

v0.1.0 release

⬇
h33-issue-attestation-v0.1.0-aarch64-apple-darwin
size903,424 bytes  ·  sha3-256132eb65f9193a7ba6e86f01badea68501ec0bf4c16262b4e7c1e312e19c3e254
Issuer ⬇
⬇
h33-verify-attestation-v0.1.0-aarch64-apple-darwin
size804,448 bytes  ·  sha3-256bc45c6b83d16fd29e2f08f95fb25ad8391f45e3ca1a1c696db660e29ccd0bc77
Verifier ⬇
{ }
sample-attestation-claim-84711.tda_v1.json
a real signed attestation against the canonical-continuity tenant · 2 decisions · 51 KB
Sample ⬇
↺
sample-verify-output.txt
what the verifier prints when you run it against the sample — captured PASS output
Output ⬇
≡
release_manifest.json
all hashes · build environment · what v0.1 proves · v0.2 deferrals
Manifest ⬇
≡
README.md
quick-start · determinism harness · the six verifier checks · honest v0.1 caveats
README ⬇

The three-artifact loop, end to end

A third party needs three downloads. Each comes from a different surface; together they prove agreement without H33.

1 · Bundle
Enterprise portability bundle
From /workspace/portability/
2 · Attestation
Signed tda_v1 JSON
From this page (sample) or issued by your own copy of the issuer binary
3 · Verifier
The canonical-replay binary
From /verifier/

Run the loop

chmod +x h33-verify-attestation-v0.1.0-aarch64-apple-darwin
chmod +x h33-independent-canonical-replay-v0.1.0-aarch64-apple-darwin

./h33-verify-attestation-v0.1.0-aarch64-apple-darwin \
    --attestation sample-attestation-claim-84711.tda_v1.json \
    --bundle tenant_insurance_claim_44962d9b-25f5-5622-bd9a-98d5580bb8a2_enterprise_bundle.tar.gz \
    --verifier-binary h33-independent-canonical-replay-v0.1.0-aarch64-apple-darwin
Expected output — six checks + replay verdicts
  • ✓ Issuer fingerprint internally consistent
  • ✓ Canonical payload hash matches declared value
  • ✓ All 3 PQ signatures verify (ML-DSA-65 · FALCON-512 · SLH-DSA-128f)
  • ✓ Bundle hash anchor matches
  • ✓ Verifier binary hash anchor matches
  • ✓ Each attested decision replays to its SACRED state_id
  • → OVERALL: PASS ✓ — bundle + attestation + verifier all agree. No H33 contact required.

Honest v0.2 deferrals