Hummand presents

Receipt

What the act leaves: signed, chained to the same client's previous one, hashes only.
Any auditor verifies it without Hummand.

Format humanproof/1 published;
verifier in the browser and on the command line.

Receipt · what remains after the act

The proof is
the receipt.

Every finished act generates a receipt: positive, negative, expired, cancelled, even the technical failure. It carries what happened, with type, level, result, steps, sources, guarantees, consents and policy, and everything about the person enters as a hash. The signature is made with a key that never leaves the key module; the public key is published. The absence of a receipt is the only invisible state, and the chain exposes it.The receipt is the digitally signed record of what happened. A hash is a code that identifies a piece of data without revealing it; the chain links each receipt to the previous one, so a receipt removed or altered in the middle of the series shows.

Hashes only,
and one signature.

The act

`tipo · nivel · resultado`available

The catalogue type, the level actually reached (not the requested one) and the result: positive, negative, expired, cancelled, failed or revoked
motivo_codigo when there is one; never the reason in text

`etapas · fontes`available

Every step completed, with result and timestamp
Every source used, with the component and the version: live presence comes from a certified third-party component, and the receipt says which

`garantias`available

Five statements, true, false or null: humano_vivo, mesma_pessoa_da_referencia, identidade_civil, consentiu, biometria_retida
The verifier requires coherence between them, the level and the steps
humano_vivo is the certified component verdict, decided on a probabilistic criterion with a threshold; the receipt records the verdict and the component version, not a score
mesma_pessoa_da_referencia applies a threshold defined by Hummand over the reported similarity

`politica_versao`available

The version of the policy applied: the auditor knows which steps were required that day

The person, hashed only

`sujeito`available

ref_cliente_hash: the reference the client gave the person, as an HMAC with a per-client secret, because a plain hash of a CPF is reversed by enumeration
referencia: type, origin and hash of the reference image, when there was one; the image itself never enters the receipt and is erased when the act ends

`contexto`available

The hash of the context and the list of declared keys the policy read; never the content

`consentimentos`available

Per step: the kind (general or biometric), the timestamp, the hash of the text and the text version

The chain

`prev_hash`available

The hash of the same client's previous receipt; the first one points to a genesis derived from the client id
A batch rebuilds the order from the hashes, in any input order, and exposes gaps in the middle, insertion, reordering and forking
A batch that does not start at genesis is labeled as externally sourced, and does not pass as a complete chain
Cryptographic destruction of an act's data does not break the chain: the receipt carries no biometrics, no image and no identifier in the clear
What refers to the person is pseudonymized, which lowers exposure and does not make the receipt anonymous

`encadeamento · mandato_ref · revisado_por`available

Links to other receipts: the dual-operator group, the mandate of a delegated act, the reviewer's step-up

The signature

`kid · alg · assinatura`available

ES256 (ECDSA P-256 with SHA-256) over the RFC 8785 canonical form of the receipt without the signature field
kid and alg sit inside the signed payload: there is no algorithm negotiation
The private key lives in a managed key module and never leaves it; the public key is published as a JWKS, by kid

`formato`available

humanproof/1. The format is closed: an unknown field is a verification error
A format change is a version change; version 1 is never edited

Variations by type

`escopo · mandatario`available

Agent mandate: actions, limits, validity and revocability; who receives the mandate, hashed

`verificacao_mandato`available

Delegated act: valid, within scope, within validity, not revoked; no new presence
It is the issuer asserting. Coherence guarantees the receipt does not contradict itself; checking the mandate against the grant receipt belongs to the verifier, and it does not do that yet

`documento_anexo`available

The document attached to the mandate. Only the hash goes, sent at creation; available since 0.28.0, in the person mandate

`recibos_individuais · humanos_distintos`target architecture

Dual operator: the group receipt references both individual ones and states that they were distinct humans

`gatilho · assinatura_juridica`target architecture

Exception proof: the origin of the trigger (client or source) and its hashed reference; never the reason
Signature: ICP-Brasil, gov.br or advanced, with the chain validity and the certificate serial hashed

Receipt

Verifiable without Hummand

Paste the JSON and the public key into the verifier: it runs entirely in the browser,
no account and nothing sent.

Open the verifier

One link per client

Every receipt points to the same client's previous one by hash. An exported batch rebuilds
the chain from genesis, and exposes gaps, reordering and forking.

Where to verify

labs.hummand.com.br/verificar

In the browser

AvailableWebAssembly, nothing sent

Traits

Checks: signature, format, coherence and chain
Where it runs: in your browser; nothing is sent
Key: JWKS by kid, pasted or fetched from the gateway
Implementation: the server's, compiled to WebAssembly

Open the verifier

humanproof-verify

On the command line

Availablebinaries with checksums, distributed to clients

Traits

Input: one receipt or the whole batch exported from the API
Offline: reads files and opens no network
Report: text or JSON; exit code 0, 1 or 2
Chain: rebuilt from the hashes, in any order

Talk to us

1.0

Verify a receipt

Paste the JSON and the public key. No account, nothing sent: it runs in your browser.

Open the verifier

2.0

Talk to us

A technical conversation, straight with the people who build it, no sales script.

Contact

Receipt

The proof is the receipt.

Hashes only,and one signature.

The act

tipo · nivel · resultadoavailable

etapas · fontesavailable

garantiasavailable

politica_versaoavailable

The person, hashed only

sujeitoavailable

contextoavailable

consentimentosavailable

The chain

prev_hashavailable

encadeamento · mandato_ref · revisado_poravailable

The signature

kid · alg · assinaturaavailable

formatoavailable

Variations by type

escopo · mandatarioavailable

verificacao_mandatoavailable

documento_anexoavailable

recibos_individuais · humanos_distintostarget architecture

gatilho · assinatura_juridicatarget architecture

Verifiable without Hummand

One link per client

Where to verify

In the browser

On the command line

Verify a receipt

Talk to us

The proof is
the receipt.

Hashes only,
and one signature.

`tipo · nivel · resultado`available

`etapas · fontes`available

`garantias`available

`politica_versao`available

`sujeito`available

`contexto`available

`consentimentos`available

`prev_hash`available

`encadeamento · mandato_ref · revisado_por`available

`kid · alg · assinatura`available

`formato`available

`escopo · mandatario`available

`verificacao_mandato`available

`documento_anexo`available

`recibos_individuais · humanos_distintos`target architecture

`gatilho · assinatura_juridica`target architecture