The node signs the digest of the whole receipt. Change the answer (level 0), one output token (level 1), or tamper with the Ed25519 signature, then verify — the same Rust verifier as the CLI checks the signature, the output binding, the M1 input/state binding and the M3 top-k execution audit.
Untrusted Node
as servedoutput (the answer it returned)
tokens: [200, 201, 202, 203, 204, 205, 206, 207, 208, 209, 210, 211, …]
ccda436644126950…fb9a01 197f6b23e16c8532…368d61 cbb035b7f73eb917…ed195b Verifier
receipt level 1This ran entirely in your browser. No network calls. No server. Signature, output digest, M1 input/state binding and the M3 top-k containment check are all done by the simon-core Rust verifier compiled to WebAssembly.
level 1: receipt commits the exact prompt token ids (M1); tamper flips one output token; the M3 audit then checks the node's tokens against the verifier's top-k.