Evidence packets you can actually verify.

Verify a packet

Public endpoint, no authentication. Post any packet and get a structured verdict.

curl -X POST https://catalyst-rain.strategic-innovations.workers.dev/rain/verify \
  -H 'content-type: application/json' \
  --data @packet.rain

The public keys

Served at the well-known path. Key id catalyst-prov-2026-07.

curl https://catalyst-rain.strategic-innovations.workers.dev/.well-known/catalyst-rain.json

The chain

Packets are appended to a hash-linked chain: each carries the digest of the one before it, so records cannot be reordered or removed without breaking every link that follows.

curl https://catalyst-rain.strategic-innovations.workers.dev/rain/head        # current head
curl https://catalyst-rain.strategic-innovations.workers.dev/rain/list        # recent records
curl https://catalyst-rain.strategic-innovations.workers.dev/rain/rec/<id>    # one signed packet

What is signed

Both signatures cover canonical(body ‖ hmk ‖ chain) — deep key-sorted, compact JSON. Never the whole envelope, since a signature cannot sign itself.

• body — the payload
• hmk — Catalyst state-in-payload structure. The FNV-1a value here is named state_token and is a bucketing device for hypervector positions. It is not an integrity mechanism and is not treated as one.
• chain — seq, prev_hash, this_hash
• signature — ML-DSA-65+Ed25519, plus the key_id that identifies which published key to check against

Try it

Sign a demo packet, then break one byte of the body and watch verification fail.

curl -X POST https://catalyst-rain.strategic-innovations.workers.dev/rain/demo | tee p.json
curl -X POST https://catalyst-rain.strategic-innovations.workers.dev/rain/verify -H 'content-type: application/json' \
  --data-binary @<(jq '.packet' p.json)