An unanchored receipt is reported untrusted, not valid. A tampered file is reported invalid.

Receipt-Lite is not accepted. A hash mismatch is invalid. Untrusted is exit 3, invalid is exit 1.

A Receipt-Lite carries no timestamp authority or Bitcoin anchor, so the tool cannot establish when the file existed and reports it untrusted, not valid, even though the file hash matches. A tampered file fails the hash comparison itself, so it is reported invalid.

Watch

Needs: a browser.

CI: run CI, 2026-08-31 , executed by GitHub Actions, not by me.

You should see: jobs Clippy, Format, Test, MSRV (1.92.0), all green.

Would falsify: a failed job.

You should see: Status: NOT VERIFIED: the receipt carries no anchors (Receipt-Lite), Reason: receipt_unanchored, exit 3 for the unanchored receipt; Status: INVALID, Reason: file_hash_mismatch, exit 1 for the tampered file.

Would falsify: valid or exit 0 for the unanchored receipt, or valid for the tampered file.

Typed replay of the verbatim local transcript of 2026-09-24 at pin 96cc146, run in a clean git worktree: every command shown is the literal command run, every output line is the literal output; no declared omissions. The verify calls now use the full paths from the Run section below (test_data/files/..., test_data/receipts/...) rather than the shortened filenames the previous recording showed, since those are the paths that actually resolve in the repo. Output timing is not execution timing. Not a CI artifact.

Run

Needs: Rust 1.92 or newer. Clone, build and the two verify calls: not timed. CI’s Test job took 40 s on a GitHub Actions runner.


git clone https://github.com/evidentum-io/atl-cli.git && cd atl-cli && git checkout 96cc146
cargo build --release

./target/release/atl-cli verify test_data/files/document.pdf test_data/receipts/valid/document.pdf.atl
# exit 3 · untrusted · receipt_unanchored · hash match YES

./target/release/atl-cli verify test_data/files/document.pdf test_data/receipts/invalid/tampered_proof.atl
# exit 1 · invalid · file_hash_mismatch

Would falsify: valid or exit 0 for the unanchored receipt, or valid for the tampered file.

Read

Needs: nothing to install.

The status/exit-code contract is one function, Status::exit_code, in verdict.rs: Valid → 0, Invalid → 1, Error → 2, Untrusted → 3 — exactly one status exits 0, so a script testing if atl-cli verify … is answered only by valid. A Receipt-Lite (no anchors) is ReceiptVerdict::unanchored() (verdict.rs): Status::Untrusted, reason receipt_unanchored, per ATL v2.0 §5.5 (“a receipt without any verified anchors SHOULD be treated as untrustworthy”) — even when its Merkle proofs are sound. A source-file hash mismatch is checked first, before any anchor reasoning, in receipt_refutation (single.rs): “a source file whose hash does not match the receipt refutes everything downstream,” reason file_hash_mismatch, Status::Invalid. Full outcomes table (all four statuses, every reason code) in README.md .

Test data: test_data/files/document.pdf against test_data/receipts/valid/document.pdf.atl (matching hash, zero anchors) and test_data/receipts/invalid/tampered_proof.atl, a fixture built with payload_hash set to 32 zero bytes (generate_test_data.rs) rather than a modified source file.

Does not establish

TSA or Bitcoin anchors
production receipts
that Merkle proofs are a theorem

If this does not survive your check, write me.