# Certify (/docs/certify) A **certified proof** is a sealed trading record whose trust root is reproduction, not authority. `certify` is the open-recomputation verb: point it at any published proof URL and it re-projects the record's Blotter **on your own machine**, from the published npm package, and checks that your local bytes equal the published bytes. The verdict is computed by you — no account, no key, no trust in the seller of the record, and no trust in this platform either. ```bash npx kestrel.markets certify ``` Every command on this page was run before it was written down; the outputs are the captured exhaust of those runs, against a proof minted the same way. ## What the recompute pins [#what-the-recompute-pins] A proof URL is not a screenshot with a signature. The sealed record pins every input the verdict depends on, so any machine can re-derive it: * **Pinned data** — the exact tape window the record ran over, content-addressed. A changed byte of history breaks the hash. * **Pinned computation** — the exact fill model and grade math, versioned. The runtime is byte-deterministic across JS engines by construction, so the same inputs produce the same bytes on your machine and ours. * **Losses on the record** — the grade is scored against **The Perch** (the null policy — doing nothing — graded). Red days are part of the sealed bytes: a record cannot delete its losers without failing the recompute. * **A signed seal** — the platform's Ed25519 signature over the graded content hash, checkable against the published verify key (see [certify vs verify](#certify-vs-verify) below). The mechanics of the sealing pipeline — Blotter vs Grade, replay-stability, and why no certification key ever enters the compute path — are on the [Evidence](/docs/concepts/evidence) page. ## Walkthrough: mint a proof, then reproduce it [#walkthrough-mint-a-proof-then-reproduce-it] You do not need someone else's proof URL to try this. One free command runs the hosted sim over a pinned scenario and mints one — no account, no card: ```bash npx kestrel.markets prove ``` ``` kestrel sim · mean-reversion-range-fade scenario Mean-reversion range fade — RNGE · 2024-08-05..2024-08-06 · 24 frames briefing RNGE percept context available (24 frames) strategy sampler starter (bundled example — supply --plans to author your own) operation op_55d597bd054ed4c639e2383c · completed receipts 24 metered · budget remaining $0.0225 evidence manifest=art_acea3887… bus=art_0857c850… grade=art_cb4209af… grade order_count=1 fill_count=1 realized_pnl=-2 proof https://kestrel.markets/proof/art_d9eb2277126f85c84e9d5029 ``` (The exhaust continues with the bundled example plan and reproduction instructions; artifact hashes are shown truncated here, as the proof page shows them.) The run above is the bundled starter — a naive one-share buy that lost two dollars. That losing grade is exactly what makes the next step meaningful. Now hand the proof URL back to the published package and reproduce it: ```bash npx kestrel.markets certify https://kestrel.markets/proof/art_d9eb2277126f85c84e9d5029 ``` ``` REPRODUCED proof=art_d9eb2277126f85c84e9d5029 leg=determinism(L1) reproduced=true published_blotter=sha256:23f30730f10d5e05fa2f952e5a31b3836a4caeef9134ac2663ec8244e2c8acd2 local_blotter=sha256:23f30730f10d5e05fa2f952e5a31b3836a4caeef9134ac2663ec8244e2c8acd2 numbers-bind-tape=unknown root-bind=unknown ``` (The CLI emits this as one tab-separated line, wrapped here for reading.) Your machine re-projected the Blotter from the published record and produced the same `sha256` the platform published — the L1 determinism leg of gate G10. A doctored record returns `MISMATCH`: the fake dies on contact with the package. The verdict is binary and dry: the bytes match, or they don't. There is no "mostly reproduced." ## certify vs verify [#certify-vs-verify] Attestation is the signature; certification is the open recompute. The two verbs answer different questions: | Verb | Question it answers | Trust root | | ------------------------ | ------------------------------------------ | -------------------------------- | | `verify ` | Did the platform sign exactly these bytes? | the published Ed25519 verify key | | `certify ` | Do these bytes reproduce on my machine? | your own recomputation | `verify` re-derives the graded content hash and re-checks the signature against the published verify key — it never trusts the body's own verdict: ```bash npx kestrel.markets verify https://kestrel.markets/proof/art_d9eb2277126f85c84e9d5029 ``` ``` VERIFIED proof=art_d9eb2277126f85c84e9d5029 kid=ksign-2026-07-prod epoch=1 numbers-bind-root=unknown ``` A signature proves the platform sealed the record; a recompute proves the record's arithmetic holds without asking the platform anything. A doctored proof fails both, differently: `UNVERIFIED` from `verify`, `MISMATCH` from `certify`. The full proof-verb surface — `prove`, `verify`, `certify`, `replay` — is on the [CLI](/docs/cli#the-proof-verbs-prove-verify-certify) page. ## What certification does not claim [#what-certification-does-not-claim] Certified is not endorsed. The claim is narrow on purpose, and the negatives are part of the contract: * **No alpha claim.** `REPRODUCED` means the arithmetic is real — not that the strategy is good, and never "trade with this person." The walkthrough above certifies a two-dollar **loss**; certification attests losses exactly as it attests wins. A record that only shows wins is a screenshot of the wins, not a record. * **Honest scope, reported inline.** The recompute bar that ships today is the byte-identical record re-projection — the determinism leg. Binding legs the local recompute has not yet computed are reported as `unknown` in the CLI exhaust rather than claimed as passed: the verdict never says more than what was recomputed. * **Platform-sealed records only.** `certify` reproduces records sealed on this platform. It cannot audit a screenshot, a broker statement, or a wall of green trades on someone's feed; the honest verdict on those is *unproven* — not proven fake. * **Practice grades are never ranking evidence.** The free sim and the public practice catalog are structurally excluded from honest rankings — see [practice vs ranking](/docs/concepts/evidence#practice-vs-ranking). * **No live execution.** The prove/certify funnel places no live orders and holds no funds; it seals and reproduces records. * **Certification is not disclosure.** Publishing a record is the owner's choice. A certified-but-private record can be handed to one counterparty as a proof URL to recompute, published to no one else. ## Checking a record before you pay for it [#checking-a-record-before-you-pay-for-it] The recompute is the whole due-diligence loop: ask for the proof URL and run `certify` on it. A sealed record reproduces byte-for-byte, losses included — no trust in the seller, no trust in the platform. If there is no proof URL, the record is unproven, and the ask that resolves it is one line: sealing is free (`npx kestrel.markets prove`), certifies the record's arithmetic without revealing the strategy, and doesn't force publication. You never have to say "fake" — you say "seal it," and let the arithmetic answer.