Trust, but verify
Verify a bundle.
Drop a .bundle.json from hypgraph export. Your browser recomputes every SHA-256 in the chain
and checks every version and link against the event that wrote it. Nothing leaves your machine.
What this proves — and what it doesn't
- Proves: every event's hash is the SHA-256 of the exact string shown, each links to the one before, and every node version, link, withdrawal and retraction in the bundle matches the event that wrote it. Nothing in it was edited after it was written.
- Doesn't prove on its own: that the whole record wasn't rebuilt from scratch. For that, compare the bundle's head hash with one published at the time (in a paper, a preregistration, a repository tag).
- Scoped bundles (one investigation out of a shared record) redact the events outside it. Those can't be checked, and the result says so.