Check our evidence yourself

Version 0.5 · Last updated: 2026-10-03

Any change to these commitments is dated in the changelog below, with what changed and why. Bill of Rights Article IX — Falsifiability commits Holistic Quality to making every claim independently testable. Manifest verification is the operational form of that commitment: a regulator should be able to run a command on their own machine and confirm three things, without trusting our servers: that a case file we gave them has not been altered; that every source it cites is the file we archived, by SHA-256; and that every value we quote appears in that archived source. The published verifier, v0.1.0, does not perform these checks yet.

Status

The published verifier is v0.1.0. It verifies a signed manifest (its canonical hash and its signatures). It does not yet check an export against the archived sources. Case-file exports do not yet carry manifests. None of the 16 research manifests is signed yet. Verification instructions, and the public keys to verify against, are published on this page with the first signed manifest. Our source archive holds 3,896 captured documents, each with a SHA-256; 1,735 carry a confirming quote and 29 were read through a text extractor.

What the verifier checks

1. Canonical-hash check. Recompute SHA-256 over the manifest's canonical-JSON form (signatures stripped) and confirm it matches the hash inside the signature bundle. Catches post-hoc tampering with the manifest payload.
2. GPG signature check. Every signature in the bundle is detached-verified against the canonical-hash bytes. Catches forged or broken signatures.

Signing policy

A research manifest is signed by its author, and its bundle carries a timestamp record; a second, independent reviewer's signature is added once one is engaged. The published verifier, v0.1.0, does not implement the one-signature path: it requires at least two different signers, so it reports a one-signature manifest as FAIL.

Why it matters

Once manifests are signed, this makes "we sign our manifests" a falsifiable property rather than a marketing claim. A regulator who cites a Holistic Quality research artifact in an official proceeding can, once its manifest is signed, independently confirm that the manifest behind that artifact is the one Holistic Quality published. If Holistic Quality ever publishes an artifact under a signed manifest that does not verify, the regulator has cryptographic proof and — per Bill of Rights Article IX — can publish the violation without legal exposure.

A verification failure shows that the file differs from what we archived or signed; it does not show that our reading of it is wrong.

What it does not prove

• That the regulator's own document is right.
• That our reading of it is right.
• That no newer document exists.
• It proves provenance and integrity, not truth.

Installation

Requires: Python 3.9 or newer, plus the gpg system binary (preinstalled on most Linux distributions and macOS).

# Install the verifier — exposes the `verify-manifest` command
pip install holisticquality-verify-manifest

# Confirm the install worked
verify-manifest --help

The package is holisticquality-verify-manifest v0.1.0 (Apache-2.0). It contains only the verification path — no Holistic Quality infrastructure, no network access — so the whole thing is auditable in minutes.

Source code

The verifier is published as the open-source holisticquality-verify-manifest package (Apache-2.0). The source distribution — pip download holisticquality-verify-manifest --no-binary :all:, or the “Download files” tab on PyPI — contains the full CLI, the verifier, and its test suite.

• CLI entry point: verify-manifest (module hq_verify_manifest.cli)
• Underlying verifier: hq_verify_manifest.verify

Research manifests

Each Holistic Quality research artifact is published with a manifest (<artifact>.manifest.json) that records the SHA-256 of its downloadable PDF and of its publication source. None of the 16 research manifests is signed yet.

Related pages

• Regulator's Bill of Rights — the 10 commitments (Article IX is the public commitment this CLI operationalizes)
• Engagement Registry — public list of data sources + customer relationships
• Agency Directory — searchable, citable catalog of regulatory bodies (scope, status, region, official websites)
• Across the product surface
• ALETHEIA — For Regulators — chemistry-data provenance chain (IARC / EPA IRIS / OEHHA / ECHA / OECD)
• Safety Database — For Regulators — state-regulator framing (OEHHA / Prop 65 / CARB / state AGs / state EPAs)

Changelog

v0.5 (2026-10-03): corrects v0.4. The published verifier, v0.1.0, has no network access and reads only an on-disk manifest file; it does not fetch a manifest from its published address. The sentence asking readers to run it on a URL is removed, and the title no longer says it verifies exports.

v0.4 (2026-10-01): the page leads with checking an export (the three checks) and says what each does not prove; the status figures are derived when the page is built; single-signature verification is described as applying only at a research manifest's published address; the network sentence now describes the verifier fetching a research manifest from its published address.

v0.3 (2026-09-25): the ratification pledge in the page header is replaced by the change policy above, because no advisory board will be formed (R-19); the regulator-contact sentence now says access opens once our data meets its quality bar, replacing an inquiry route that no longer exists.

v0.2 (2026-09-24): this page previously said manifests are authentic when signed by two distinct people, said signer key fingerprints were published, and offered a worked example signed with test keys. None of this was true of any Holistic Quality manifest, and the test keys no longer exist, so it was removed. This changes a commitment the page made. The signing policy is now the author's signature plus an independent public timestamp; a second, independent reviewer's signature will be added once a reviewer is engaged. Verification instructions and public keys will be published here with the first signed manifest.

Contact

Verification questions or any feedback about the CLI — email verify@holisticquality.io. Questions about regulator access: email regulator@holisticquality.io. Access for regulators opens once our data meets its quality bar. Per Bill of Rights Article IX, you are not required to use this channel before publishing a verification discrepancy — it is provided as a courtesy, not a prerequisite.

Open corrections — the correction directives open against the live properties, or not yet tied to one, by record id and date filed. Findings not yet placed in a directive are not listed.