VERIFY IT YOURSELF

Do not take our word for it. Take the record.

How verification works, what the tool does, and how to check a record with our service switched off.

The claim, stated so it can be falsified

Every savings figure TokenMark™ produces is carried in a sealed record that a third party can recompute without us. That is either true or it is not, and it is designed to be checked rather than believed.

What the verifier does

  1. Recomputes the digest from the record's own contents, rather than reading the digest the record claims.
  2. Confirms both signatures against public keys — one from the component that performed the work, one from the component that certified it.
  3. Confirms the two signatures come from different privilege domains. Two signatures from the same domain is a failure, not a pass.
  4. Re-executes the structural checks: that every context span is accounted for, that the retained and withheld sets are disjoint and complete, that the record's predecessor digest matches, and that the measurement basis resolves within the policy bundle pinned at the time.
  5. Recomputes the savings figure from the underlying counts.

It makes no network requests. It contacts no service of ours. It works years later, on an archived record, with our company gone.

$ tokenmark-verify statement-2027-03.json --bundle policy.tmb digest recomputed .............. match generator signature ............ valid uid 1871 (gateway domain) attester signature ............. valid uid 1872 (attester domain) distinct privilege domains ..... confirmed R-1 manifest closure ........... pass T-1 span partition ............. pass E-1 lineage continuity ......... pass C-1 baseline pinned ............ pass C-2 rate reference resolves .... pass measurement recomputed ......... match VERIFIED digest=2e07003460a386e5b9c1f4d802a77e31 $ echo $? 0

What failure looks like

A control that fails quietly is not a control. Alter one byte of a sealed record and verification does not shrug:

$ tokenmark-verify tampered.json --bundle policy.tmb digest recomputed .............. MISMATCH recorded 2e07003460a386e5b9c1f4d802a77e31 computed 9f41ab77c05e13d84a2b6708ee5c9013 INTEGRITY FAULT record contents do not match the sealed digest $ echo $? 2

Three exit conditions, deliberately distinguished

CodeMeaningWhat to do
0Verified. Signatures valid, contents unaltered, structural checks pass.Nothing. The figure is supported.
2Integrity fault. A signature is missing or invalid, contents do not match, both signatures share a domain, or a structural check failed. Investigate. The record is not reliable evidence.
3Configuration fault. An input could not be resolved — wrong path, missing policy bundle.Re-run with correct inputs. Not a finding.

The separation matters more than it looks. A tool that reports one undifferentiated failure gets switched off within a quarter, because operators cannot tell "fix your command line" from "something is wrong with the money."

The part we cannot fake

The reason a compromised gateway cannot forge a record is not that it has been told not to. It is that the operating system will not give it the key. That is observable directly:

# run a read of the attester key as the gateway service account $ setpriv --reuid=tmgw --regid=tmgw --clear-groups \ cat /var/lib/tokenmark/attester/ed25519.key cat: /var/lib/tokenmark/attester/ed25519.key: Permission denied $ echo $? 1 # the same read, as the attester's own account $ setpriv --reuid=tmatt --regid=tmatt --clear-groups \ stat -c '%U %a' /var/lib/tokenmark/attester/ed25519.key tmatt 600

This check runs before the platform admits its first request, and your team can re-run it whenever you like. It is the difference between a vendor telling you the roles are separated and your own operating system demonstrating it.

Getting the tool

The verifier and a sample sealed record are available to design partners, prospective customers, and any practitioner who wants to test the claim — including auditors with no client relationship to us. It is a single binary with no dependencies and no telemetry.

Request the verifier and a sample record

Auditors and researchers: say so in the notes field and we will send it without a sales conversation attached.

Programs & participation
NVIDIA InceptionMember
NIST Zero DraftsSubmissions filed
NIST AI 300-1Public comment
NIST NCCoEPost-Quantum Cryptography
Community of Interest
DOE Genesis MissionConsortium participant
Congressional Internet CaucusAdvisory Group — former member

Participation in an open public process is not endorsement. No agency, standards body, consortium or company listed here endorses Atom Works™, its products or its claims.