Verifiable by design

We publish machine-readable files so AI assistants describe brands accurately. You should not have to trust us about what is in them. This page shows our own files as they are served right now, and how to check them.

Signed (Ed25519): Recommendation files. Our manifesto, once its signature is published.
Checksummed, not signed: AI files: llms.txt, llms-full.txt, knowledge graph, ontology, sitemap and robots.txt. Each one is listed with its SHA-256 in our checksum manifest.

1 · Every AI file says where it came from

The header at the top of a text file names the generator, the generation date and where to verify the file.

/llms.txt

Generated: When this version of the file was made.
Generator: What made it.
Checksum: SHA-256 of the text below the header. See below.
Verify: Where the checksum manifest is.
Spec: The version of this header format.

Two checksums, two jobs

A file's header can't contain its own checksum, so the two cover different bytes.

Header checksum: Covers the body only: everything after the header block and the blank line that follows it.
Manifest checksum: Covers the whole file, header included, exactly as served. This is the one to compare a downloaded file against.

So the two values are different on purpose.

2 · One manifest lists the checksum of every file

/.well-known/xaudient-verify.json lists the SHA-256 of each file exactly as served. If one byte changes, the checksum no longer matches. Files we no longer publish are listed as withdrawn, with no checksum. The methodology entry points to the manifesto that describes how these files were produced.

/.well-known/xaudient-verify.json

3 · Recommendation files are signed

A signature proves more than a checksum: who issued the file, not only that it is unchanged. Recommendation files are signed with an Ed25519 key. The public half is published at /.well-known/xaudient-rec-keys.json, so anyone can check a file without asking us.

/.well-known/xaudient-rec-keys.json

Example

This is what a signed file looks like. It is an example, signed with a separate demo key that signs nothing else: it is not a Xaudient recommendation, and it describes no real company.

/examples/signed-recommendation-example.md

4 · Check it yourself

Checksum

Download a file and compare its SHA-256 with its entry in the manifest.

shasum -a 256 llms.txt

Signature

For a signed file, the signed bytes are everything before the line that starts the signature block. Their SHA-256 is file_sha256 in that block. sig is the Ed25519 signature of those bytes, in base64url, and key_id names the public key to check it with.

What we do not claim

AI files are checksummed, not signed. A checksum shows that a file is the one the manifest lists. It does not show who published it. Only a signature does that.