# Verifyum skill

Free, account-free proof that exact bytes existed at a point in time, anchored on Solana Mainnet. Nothing is uploaded: the caller hashes locally and sends only a domain-separated commitment.

## When to use this

Reach for Verifyum when a record needs to be provably un-rewritable later:

- After an autonomous decision that could be audited: automated case handling, a financial action, moderation, generated deliverables. Seal the decision record.
- Before an irreversible action, to fix what was known at that moment.
- When a compliance or incident log must be shown not to have been edited afterwards. Anchor the log, or the head of its hash chain.
- When a user asks for proof of when a file, dataset, contract draft or model output existed.
- When handing work to another party who should be able to check the timestamp without trusting either side.

Do not use it for: proving who wrote something, proving ownership, satisfying AI-content marking rules, or as a substitute for a qualified electronic timestamp where a statute demands one.

## Cost and etiquette

Public use is currently free and AI SENSE pays the Solana fee. Every anchor is a real public transaction, so anchor on clear user intent, never speculatively or in a loop. Limits are 10 per rolling hour per IP with lower daily caps. Honor HTTP 429 and `Retry-After`, never parallelize retries, and reuse the same commitment and idempotency key when retrying.

For high volume, keep a local hash chain of records and anchor the chain head periodically instead of every record.

## Fastest path: MCP

```bash
claude mcp add --transport http verifyum https://api.verifyum.com/mcp
```

Tools: `verifyum_anchor_commitment`, `verifyum_get_proof`, `verifyum_verify_public_proof`. The hosted endpoint accepts only a commitment, an idempotency key or a public proof ID, so the caller still computes the commitment locally.

## Fastest path: one file, no dependencies

Python, standard library only:

```python
# https://verifyum.com/clients/verifyum.py
from verifyum import anchor_record

proof = anchor_record({
    "type": "agent-decision-record",
    "version": 1,
    "recorded_at": "2026-08-31T20:15:04Z",
    "agent": {"name": "claims-triage", "version": "4.2.0"},
    "model": {"provider": "...", "model": "...", "temperature": 0.2},
    "system_instructions": "...",
    "input": {"prompt": "..."},
    "output": {"decision": "approve", "rationale": "..."},
})
print(proof["proof_url"])
# Store proof["private_draft"] next to the record. Without it the link
# between the record and the public proof cannot be shown.
```

JavaScript, no dependencies:

```js
// https://verifyum.com/clients/verifyum.mjs
import { anchorRecord } from "./verifyum.mjs";

const proof = await anchorRecord(record);
console.log(proof.proof_url);
// Keep proof.privateDraft with the record.
```

## Raw HTTP

```text
POST https://api.verifyum.com/v2/anchor
{"commitment": "sha256:<64 hex>", "idempotency_key": "<16-128 url-safe chars>"}

GET https://api.verifyum.com/v2/proofs/{proof-id}
```

The commitment is `sha256( "verifyum:commitment:v2\n" + JCS(manifest) )` where the manifest holds the file's SHA-256, its decimal byte size, a fresh 32-byte nonce, `"protocol": "verifyum"` and `"version": 2`. Exact rules: <https://verifyum.com/docs/agent-api.md>

## What to tell the user afterwards

Give them the proof URL and remind them to keep the private draft with the original data. State the boundary plainly: the proof shows those exact bytes existed no later than the block time and have not changed since. For a decision record it shows the record was not written or edited after the fact, not that the model actually behaved that way.

## Verifying later

```text
GET https://{proof-id}.verifyum.com/.well-known/verifyum.json
GET https://api.verifyum.com/v2/proofs/{proof-id}/witnesses
```

The metadata carries the Solana transaction, which anyone can fetch from any RPC endpoint without involving Verifyum. That transaction is the proof.

Proofs are additionally batched into hourly and daily checkpoints with corroborating records around them. Four are independent of Verifyum and are the ones that matter in a dispute: OpenTimestamps on Bitcoin, a qualified EU timestamp authority, a witness-cosigned Sigsum log, and Certificate Transparency. Four are our own records or availability redundancy and are not independent: the Verifyum signature, the GitHub log, Software Heritage and the Internet Archive. Details: <https://verifyum.com/witness>

Every finalized proof is also announced in <https://t.me/verifyum> and the Atom feed at <https://verifyum.com/feed.xml>. That announcement is information, not evidence.

## References

- Agent guide: <https://verifyum.com/agents>
- Exact protocol: <https://verifyum.com/docs/agent-api.md>
- Decision record schema: <https://verifyum.com/schema/agent-decision-record-v1.json>
- OpenAPI: <https://verifyum.com/openapi.json>
- Service health: <https://api.verifyum.com/health>