Certify

A certified proof is a sealed trading record whose trust root is reproduction, not authority. certify is the open-recomputation verb: point it at any published proof URL and it re-projects the record's Blotter on your own machine, from the published npm package, and checks that your local bytes equal the published bytes. The verdict is computed by you — no account, no key, no trust in the seller of the record, and no trust in this platform either.

npx kestrel.markets certify <proof-url>

Every command on this page was run before it was written down; the outputs are the captured exhaust of those runs, against a proof minted the same way.

What the recompute pins

A proof URL is not a screenshot with a signature. The sealed record pins every input the verdict depends on, so any machine can re-derive it:

• Pinned data — the exact tape window the record ran over, content-addressed. A changed byte of history breaks the hash.
• Pinned computation — the exact fill model and grade math, versioned. The runtime is byte-deterministic across JS engines by construction, so the same inputs produce the same bytes on your machine and ours.
• Losses on the record — the grade is scored against The Perch (the null policy — doing nothing — graded). Red days are part of the sealed bytes: a record cannot delete its losers without failing the recompute.
• A signed seal — the platform's Ed25519 signature over the graded content hash, checkable against the published verify key (see certify vs verify below).

The mechanics of the sealing pipeline — Blotter vs Grade, replay-stability, and why no certification key ever enters the compute path — are on the Evidence page.

Walkthrough: mint a proof, then reproduce it

You do not need someone else's proof URL to try this. One free command runs the hosted sim over a pinned scenario and mints one — no account, no card:

npx kestrel.markets prove

kestrel sim · mean-reversion-range-fade
scenario   Mean-reversion range fade — RNGE · 2024-08-05..2024-08-06 · 24 frames
briefing   RNGE percept context available (24 frames)
strategy   sampler starter (bundled example — supply --plans <file> to author your own)
operation  op_55d597bd054ed4c639e2383c · completed
receipts   24 metered · budget remaining $0.0225
evidence   manifest=art_acea3887… bus=art_0857c850… grade=art_cb4209af…
grade      order_count=1 fill_count=1 realized_pnl=-2
proof      https://kestrel.markets/proof/art_d9eb2277126f85c84e9d5029

(The exhaust continues with the bundled example plan and reproduction instructions; artifact hashes are shown truncated here, as the proof page shows them.) The run above is the bundled starter — a naive one-share buy that lost two dollars. That losing grade is exactly what makes the next step meaningful.

Now hand the proof URL back to the published package and reproduce it:

npx kestrel.markets certify https://kestrel.markets/proof/art_d9eb2277126f85c84e9d5029

REPRODUCED  proof=art_d9eb2277126f85c84e9d5029  leg=determinism(L1)  reproduced=true
  published_blotter=sha256:23f30730f10d5e05fa2f952e5a31b3836a4caeef9134ac2663ec8244e2c8acd2
  local_blotter=sha256:23f30730f10d5e05fa2f952e5a31b3836a4caeef9134ac2663ec8244e2c8acd2
  numbers-bind-tape=unknown  root-bind=unknown

(The CLI emits this as one tab-separated line, wrapped here for reading.) Your machine re-projected the Blotter from the published record and produced the same sha256 the platform published — the L1 determinism leg of gate G10. A doctored record returns MISMATCH: the fake dies on contact with the package.

The verdict is binary and dry: the bytes match, or they don't. There is no "mostly reproduced."

certify vs verify

Attestation is the signature; certification is the open recompute. The two verbs answer different questions:

verify re-derives the graded content hash and re-checks the signature against the published verify key — it never trusts the body's own verdict:

npx kestrel.markets verify https://kestrel.markets/proof/art_d9eb2277126f85c84e9d5029

VERIFIED  proof=art_d9eb2277126f85c84e9d5029  kid=ksign-2026-07-prod  epoch=1  numbers-bind-root=unknown

A signature proves the platform sealed the record; a recompute proves the record's arithmetic holds without asking the platform anything. A doctored proof fails both, differently: UNVERIFIED from verify, MISMATCH from certify. The full proof-verb surface — prove, verify, certify, replay — is on the CLI page.

What certification does not claim

Certified is not endorsed. The claim is narrow on purpose, and the negatives are part of the contract:

• No alpha claim. REPRODUCED means the arithmetic is real — not that the strategy is good, and never "trade with this person." The walkthrough above certifies a two-dollar loss; certification attests losses exactly as it attests wins. A record that only shows wins is a screenshot of the wins, not a record.
• Honest scope, reported inline. The recompute bar that ships today is the byte-identical record re-projection — the determinism leg. Binding legs the local recompute has not yet computed are reported as unknown in the CLI exhaust rather than claimed as passed: the verdict never says more than what was recomputed.
• Platform-sealed records only. certify reproduces records sealed on this platform. It cannot audit a screenshot, a broker statement, or a wall of green trades on someone's feed; the honest verdict on those is unproven — not proven fake.
• Practice grades are never ranking evidence. The free sim and the public practice catalog are structurally excluded from honest rankings — see practice vs ranking.
• No live execution. The prove/certify funnel places no live orders and holds no funds; it seals and reproduces records.
• Certification is not disclosure. Publishing a record is the owner's choice. A certified-but-private record can be handed to one counterparty as a proof URL to recompute, published to no one else.

Checking a record before you pay for it

The recompute is the whole due-diligence loop: ask for the proof URL and run certify on it. A sealed record reproduces byte-for-byte, losses included — no trust in the seller, no trust in the platform. If there is no proof URL, the record is unproven, and the ask that resolves it is one line: sealing is free (npx kestrel.markets prove), certifies the record's arithmetic without revealing the strategy, and doesn't force publication. You never have to say "fake" — you say "seal it," and let the arithmetic answer.