v1.1.1

verify-trail.mjs for this release, and the SHA-256 of the exact files attached below.

ffbb5d78c4c6023845206ffb7e89b0a3056bf9049f7765d67495dec03e2c9c1d  verify-trail.mjs
ba4e81d969a7921bf73c1c584216d122f724c2127316268bcacfe60c7101c8dd  fixtures.zip

Check your copy with shasum -a 256 verify-trail.mjs, or on Windows
certutil -hashfile verify-trail.mjs SHA256. This digest is computed by the
release job from the bytes it attaches, so it is not a value anybody typed.
The verifier prints the same digest, of itself, on the first line of every run.

fixtures.zip is the fixtures directory at this release, one frozen export per format.
Extract it beside verify-trail.mjs and run the verifier against each fixture before
you trust it with your own record.

v1.1.0

verify-trail.mjs for this release, and the SHA-256 of the exact file attached below.

9aa93584d6281c0d62bf48a9dd6c29703dea2938f4b874086ce13b0914c33c59  verify-trail.mjs

Check your copy with shasum -a 256 verify-trail.mjs, or on Windows
certutil -hashfile verify-trail.mjs SHA256. This digest is computed by the
release job from the bytes it attaches, so it is not a value anybody typed.

Added 2026-09-17: fixtures.zip, the fixtures directory exactly as it stands at this tag, built with git archive --format=zip <tag> fixtures. Extract it beside verify-trail.mjs and run the verifier against each fixture before you trust it with your own record. It was attached after release; verify-trail.mjs and the digest above are unchanged.

Added 2026-09-17: this version prints each document's title inside its verdict line, as in verified 1000202 "Quality manual" as at 2026-08-04. No hash covers a title, so a name changed in the export is printed there without being detected. Its verdicts about the chains are correct. v1.1.1 names documents in its verdicts by page id alone and prints titles below a line saying no hash covers them. verify-trail.mjs, fixtures.zip and the digests above are unchanged.

v1.0.0

verify-trail.mjs for this release, and the SHA-256 of the exact file attached below.

73fa6f548a8fd25cea979fa9546dab8bc6187854b1c79e3557b6b24276410ae3  verify-trail.mjs

Check your copy with shasum -a 256 verify-trail.mjs, or on Windows
certutil -hashfile verify-trail.mjs SHA256. This digest is computed by the
release job from the bytes it attaches, so it is not a value anybody typed.

Added 2026-09-17: fixtures.zip, the fixtures directory exactly as it stands at this tag, built with git archive --format=zip <tag> fixtures. Extract it beside verify-trail.mjs and run the verifier against each fixture before you trust it with your own record. It was attached after release; verify-trail.mjs and the digest above are unchanged.