Lapidarc writes documentation from a codebase. Every factual sentence cites its source, two AI judge models check each claim, and a claim counts as verified only if both accept it. Documents that pass are signed. This post shows how to check that signature yourself, offline, without trusting us.

What gets signed

A signed Codex is a PDF plus a detached signature file (document.pdf.sig). The signature covers the exact bytes of the PDF. Nothing is normalised or re-encoded first, so changing a single byte breaks it.

The algorithm

ML-DSA-65, the post-quantum signature standard published as FIPS 204. The verifier uses liboqs from the Open Quantum Safe project.

The key

Our public key is published in the repo, with its SHA-256 fingerprint. Check the fingerprint before you trust any result. The verifier prints the fingerprint of the key it used every time, so you can compare.

Run it

You need Python 3.9+ and liboqs 0.15.0 (install steps are in the README). Then:

python verify.py document.pdf document.pdf.sig
  • Exit code 0 means VALID: the PDF is exactly the file that was signed.
  • 1 means INVALID: the file was changed, or the signature or key doesn't belong to it.
  • 2 means an input error.

We've tested it on Linux.

What a signature does not prove

A valid signature tells you the document hasn't changed since we signed it. It does not tell you every sentence is true. That's the judges' job, and every document prints their result: "N of M claims verified." Two questions, two answers, both visible.

The verifier is open source under Apache-2.0: https://github.com/lapidarc/verify