Inspect the certificate.
Check what it proves.
An OctoProof certificate records a run’s evaluation evidence, hashes and limitations. Its content hash detects changes. A signed certificate can also be checked by the issuing server.
Try the verifier
The example demonstrates the certificate format and signing process. It contains no customer data, training result or accuracy claim.
Verification sends this certificate to OctOpus. A certificate should contain hashes and metrics, not dataset rows.
Integrity is different from model quality
A matching signature confirms that this server’s key signed the content. It does not independently establish accuracy, fairness, suitability for your use case or a customer outcome. Read the evaluation fields, missing evidence and the underlying experiment code.
Current signatures use HMAC-SHA256. Signature verification requires the issuing server’s private key; it is not public-key verification. The public endpoint checks the signature without revealing that key. A certificate from another deployment or an older key may be intact but unverifiable here. Unsigned certificates are labelled as such.
Use the public POST /api/proof/verify endpoint for automated checks, or inspect proof_card.json in your run’s artifacts. Read the documentation.