Take the internet away and it still checks out.
Every water figure you have ever been shown came with an implicit request to trust whoever produced it. This one does not. Download a real signed pack, pull your network cable, and check it with a verifier that cannot phone home even if it wanted to.
1 · Take the pack
A real evidence pack for a real closed period. Sixteen files: the statement, the balance, the windows, the observation roots, the calibrations, the envelope, the ledger and the public keys.
2 · Disconnect
Genuinely. Turn the wifi off. The verifier reads only the pack directory, opens no socket and knows no database, so nothing about the result depends on us being reachable or honest.
3 · Run it
The verifier recomputes every hash from the bytes on disk and re-walks the ledger chain, then checks the signatures against the public keys carried inside the pack itself.
guardian-verify ./pleione-sample-pack
What you will see
This is the real output for the pack above, not an illustration. Nine checks pass. One does not, and the reason it does not is the most important line on this page.
Most software would have printed VERIFIED and moved on. This pack covers a period where a quarter of the evidence was measured and two flows were not metered at all, so the balance cannot be independently recomputed from the windows alone. Saying so is the product. A verifier that returns a green tick on evidence it could not actually check is worth nothing to the person relying on it.
Questions
How do I verify a Pleione Water Statement?
Download the evidence pack, disconnect from the internet, and run the open verifier against the pack directory. It recomputes every file hash, the pack hash, the evidence root, the statement hash and the whole ledger chain, then checks the signatures against the public keys carried inside the pack.
Do I need to trust Pleione to verify a pack?
No, and that is the point. The verifier reads only the pack. It opens no socket and knows no database, so it cannot ask us whether a pack is good. If it could, a compromised build could simply be told to say yes.
What does INCOMPLETE mean on a verification result?
It means every integrity check passed but at least one step could not be attempted. On the sample pack, calculation reproduction is skipped because the attested balance rests on partially measured evidence: coverage is 25.1 per cent and two flows are unmeasured, so the residual cannot be independently recomputed from window aggregates alone. Reporting that honestly is the correct answer, not a failure.
Does verification prove the water numbers are correct?
No. Integrity is not truth. Verification proves the record has not been altered since it was signed. Whether the instruments were reading correctly is a separate question, which is why every reading in the record carries its own trust score.
The small print, which is not small
- This pack carries simulated data from our reference facility. The instruments are modelled, not installed. Everything about the record around them is real: real hashing, a real chain, real Ed25519 signatures, and a verifier that genuinely refuses to reach the network.
- Pack SHA-256
941ea02e6ed73350a382b9708ee3ecdc11b08d8812895be47ae170071e69f044. If you were handed this file by anyone other than us, check that first. - The verifier is the same program an auditor runs. It is not a web page we control, which is the only arrangement under which “you do not have to trust us” means anything.
- An in-browser verifier is deliberately not offered yet. It would be code we served you, checking a file we gave you, and reporting a verdict we rendered. Running it yourself is the stronger claim, so that is the one we make. How the method works →