Public probe demo
Verify a receipt on your machine.
Python standard library only. No clone required. Download the verifier and a fixture chain, then get a pass/fail HMAC result in under two minutes.
Path A · fixture HMAC (offline)
Check a signed chain you can reproduce.
The fixture secret is demo-only. It is not the live probe worker key.
curl -fsSL https://hummbl.io/verify/receipt/verify_receipt.py -o verify_receipt.py
curl -fsSL https://hummbl.io/verify/receipt/fixture-chain.json -o fixture-chain.json
export RECEIPTENGINE_HMAC_KEY='fixture-demo-hmac-key-not-the-probe-secret'
python3 verify_receipt.py fixture-chain.json
Expected: PASS (hmac+chain). Truncate, reorder, or alter
a signature in the fixture and the same command fails.
Artifacts:
verify_receipt.py ·
fixture-chain.json ·
repo path
scripts/verify_receipt.py
Path B · archived public probe
Structure-check the archived receipt.
The hummbl-receipt-probe worker was retired in September 2026. Its scoped observation survives as an archived receipt that can still be structure-checked without the probe signing secret. HMAC authenticity remains limited to parties that hold the shared key.
# Archived scoped observation (LANDING-012):
python3 verify_receipt.py --structure-only https://hummbl.io/manifest/evidence/hummbl-governance-v1.4.2-public-probe-receipt.json
Retired probe surface:
hummbl-receipt-probe.hummbl.workers.dev
· Evidence receipt
r-7e400da03299
Assurance boundary
What this does not claim.
- Not public-key proof
- HMAC verifies integrity and authenticity inside a shared-secret trust domain. It is not independent non-repudiation.
- Not the KRINEIA paper
- This path verifies probe/fixture ReceiptEngine bytes. It does not settle paper naming or admission framing.
- Not a general production claim
- A scoped public GET is not customer evidence and does not make the Alpha package “production-tested.”
- MCP is secondary here
- Integration via MCP remains documented on Build. This page’s first action is local verification.
Related surfaces
File verify stays at /verify.
Local file hashing and format profiles remain on /verify. Receipt HMAC checks live here so the stranger demo does not rewrite the homepage hero.