# KURAL specimen pack — verify a real anchored evidence record offline

This zip is everything you need to independently verify ONE labelled field
of one real KURAL evidence record without talking to api.kural.tech.

## Quick verify

```bash
# 1) Get the kural-verify binary for your platform
curl -sL https://github.com/Pe2kay/iGaming-AI-Compliance/releases/latest/download/kural-verify-linux-amd64 -o kural-verify
chmod +x kural-verify

# 2) Verify this specimen
./kural-verify \
  --proof proof.json \
  --value-file value.json \
  --expected-root 0ed196e2138381de427f4e6d45165db06aff190589a9bf73859f167891679f2b
```

Expected output:

```
CHAIN HEAD MATCH
  label:    rows
  leaf:     f83fe2dd59c7bedada36e02ffc9a4c3bd8a6238d93367d05c8c392de670368b6
  root:     0ed196e2138381de427f4e6d45165db06aff190589a9bf73859f167891679f2b
  path-len: 3 step(s)
```

## What's in this pack

| File | What it is |
| ---- | ---------- |
| `proof.json` | Merkle proof for the labelled field `rows` |
| `value.json` | The original canonical-JSON bytes of that field's value |
| `value-string.txt` | (only present when value is a string) — for --value-string convenience |
| `evidence-record.json` | The full anchored record for transparency — you can verify any OTHER field by rebuilding the tree yourself |
| `chain-context.json` | The chain-link metadata: ledger_id, prev_chain_hash, chain_hash, merkle_root, appended_at |

## Chain context for this record

- **ledger_id:**       `ae12b171-2a05-48cf-8571-f5f4e71ac848`
- **operator_id:**     `OP-GREENTUBE`
- **control_id:**      `BOARD.REPORT`
- **appended_at:**     2026-06-01T22:28:11.772Z
- **merkle_root:**     `0ed196e2138381de427f4e6d45165db06aff190589a9bf73859f167891679f2b`
- **prev_chain_hash:** `(genesis)`
- **chain_hash:**      `d3bec0beb1ae6aa4e56a31016f431617717b081efacd6256ff95185a56b6fb52`

The chain hash is `sha256("c|" + prev_chain_hash + "|" + merkle_root)`. You can
re-compute it yourself with one line of bash:

```bash
printf 'c|%s|%s' "" "0ed196e2138381de427f4e6d45165db06aff190589a9bf73859f167891679f2b" | sha256sum
# -> d3bec0beb1ae6aa4e56a31016f431617717b081efacd6256ff95185a56b6fb52
```

## Why you should care

A vendor saying "we use Merkle proofs" without giving you a way to verify
them is marketing. KURAL ships the verifier because the audit-decision
isn't whether we can show a green checkmark in our dashboard — it's
whether you can prove our claim on your own laptop.

You trust SHA-256, the JSON spec, FreeTSA's RFC 3161 TSA, DigiCert's TSA,
and (Phase 2) Sigstore Rekor. KURAL is one of five parties who would all
have to be colluding for this specimen to lie.

Generated 2026-06-10T17:53:01.972Z from ledger row ae12b171-2a05-48cf-8571-f5f4e71ac848.
