Proof of Agent Work · open verifier

Don't trust us. Check us.

A POAW receipt is three things: the steps an AI agent took, a post-quantum signature over them, and a timestamp from an independent authority. The record on the right is verified live in your browser. Try to change it.

Verify with OpenSSL Verify your own receipt

Independent check

Python standard library and stock OpenSSL 3.5. No code from us.

Run on 21 October 2026 against the sample below. All three checks passed. With a single changed byte, each of them failed.

# 1. fetch the receipt, the check script, and our public key (also published in did.json)
curl -O https://destill.ai/poaw/sample-receipt.json
curl -O https://destill.ai/poaw/verify_receipt.py
curl -O https://destill.ai/poaw/destill-key-1.pem

# 2. recompute the Merkle root from the steps (stdlib only), writes root.bin, sig.bin, token.der
python verify_receipt.py sample-receipt.json

# 3. ML-DSA-65 signature (FIPS 204), stock OpenSSL 3.5 or later
openssl pkeyutl -verify -pubin -inkey destill-key-1.pem -rawin -in root.bin -sigfile sig.bin
#    -> Signature Verified Successfully

# 4. RFC 3161 timestamp over sha256(signature), checked against the TSA's certificate chain
openssl ts -verify -token_in -in token.der -digest <printed by step 2> -CAfile <your CA bundle>
#    -> Verification: OK

The PEM file holds the same key as did:web:destill.ai#key-1, re-encoded for OpenSSL. Check the bytes against did.json; you do not have to take our word for it.

Your receipt

Verify any POAW receipt.

Paste a poaw-receipt/1 bundle or drop the file here. Nothing is uploaded. The only network call fetches the signer's public key from the domain named in its DID.

Choose file Download the sample

Format

`poaw-receipt/1`

Field	Meaning
receipt.actions[]	The agent's steps: `seq` (1…n, contiguous), `type`, `payload`, `ts`. Sensitive content is recorded as a SHA-256 hash, never in clear text.
receipt.merkleRoot	SHA-256 Merkle root. Leaf = SHA-256(`"LEDGER:LEAF:"` + compact JSON of {seq, type, payload, ts}). Parent = SHA-256(left ‖ right). An odd node is paired with itself.
receipt.signatureHex	ML-DSA-65 (FIPS 204, pure, empty context) over the 32 root bytes.
receipt.verificationMethod	A `did:web` key ID. The verifier resolves the key from that domain and accepts it only if it is listed under `assertionMethod`. A key embedded in the receipt is never trusted.
receipt.keyCustody	`software` today. `hsm` once hardware custody is in place.
timestamp.tokenB64	An RFC 3161 TimeStampToken (CMS) whose message imprint is SHA-256(signature bytes).

Status, measured 21 Oct 2026

What exists, and what does not yet.

In place and verified

Signing library (TypeScript): Merkle receipt, ML-DSA-65, RFC 3161, did:web. Smoke tests pass and reject a tampered record or a revoked key.
This verifier, in the browser and via OpenSSL, as shown above.
Published issuer key at did:web:destill.ai.

Not yet

Hosted POAW API: today the library runs inside the operator's system. There is no public signing service.
Hardware key custody (HSM / enclave): keys are held in software.
Public transparency log: receipts are not yet anchored in a public append-only log.

Also see the AI-Act conformity credential verifier · Proof of Agent Work for insurers