Validate a reasoning proof yourself.
The "hello world" of verifiable reasoning. A working, public demonstration that a piece of reasoning — not just an action — can be sealed into a proof and re-checked by a total stranger.
Someone said hello. We sealed the reasoning into a proof.
Distributed systems today can verify what happened — they record state. What they cannot verify is the reasoning that produced the act. This repository is a small, complete demonstration that closes that gap once, end to end.
Here is what actually happened. Someone said "hello." A declared rule turned it into "hello world." That event — the Rule, the Input, the Output, and an attested declaration of Meaning — was sealed into a single hash and stamped onto a public network (Hedera testnet). A token now exists whose name is that hash, and a second token carries a provenance commitment derived from it — two on-chain anchors you can open and read for yourself.
Nothing here claims the reasoning was wise. The proof attests that the binding fired — that this rule, on this input, produced this output, declared by this author, at this time.
Anchors in the rock, and the rope you trust between them.
A climber protects every move with anchors: fixed points driven into the face and tested, each one set so that it will hold a fall. A morpheme proof is an anchor of just this kind. Once the consensus topic has witnessed it and stamped it with its hour, it is seated in the wall, and it stays there for anyone who climbs that way after. The crowd that saw it placed is what gives it the strength to hold.
Reasoning is the climb. You advance by running a line from an anchor already placed toward the hold you are reaching for next, and the instant the proof fires is the instant you clip in: the carabiner closes around the anchor and your weight comes onto it. From there the movement is deliberate and recoverable. You can press upward into new ground or lower yourself back to a point you already trust, and the anchor below keeps you on either path. A sequence of these clips becomes a route, and every clip is a choice made in the open, every anchor a place the reasoning can return to and a place another climber can find, read, and carry forward.
What the anchor promises is exact and bounded. It testifies that the binding held at the moment it was clipped, and it leaves the worth of the route to whoever chooses to climb it.
No key. No API. No account. No taking our word for it.
Verification runs entirely off the public mirror node. The verifier never contacts us, never needs permission, and never takes the author's word. Four independent checks all have to pass — and any failure is loud.
Logic
Recompute the hashes. The inputsHash, outputsHash, and bindingHash must match the anchored proof. (Peirce.)
Meaning
Dereference M. The declared meaning URI must actually resolve to its rule definition. (Floridi.)
Material
Reconstruct the token's stamped state. It must reconstruct the binding: material == logical, or fail. (Tarski.)
Closure (self-proof)
The account that signed, paid the mint, and stamped the state must equal the author: signer == author, or fail.
Two tokens, on a public network.
The binding left two anchors on Hedera testnet. Open either on HashScan and read the field for yourself — no login required.
1. The named proof. A token whose name itself is the bindingHash — the whole reasoning event, collapsed into one identifier:
bindingHash 0xe97c354cf074ccfaf15cd3503fe3412394600cb72f19c74174f16946a74342c5
2. The provenance commitment. A second token (the "Hello World Morpheme") carries a { n, root } stamp in its metadata. The root is derived from the bindingHash above — the first link in a chain that can grow:
root 0x26b23fe4e4ae3ca3ef0736effd65fdb0f700c6bedcfc70e283dcb21b4aac8772
Honest caption: this is a testnet proof — a working demonstration, not a permanent record. A mainnet artifact follows at a later milestone.
Nothing here is on our say-so. Here is the arithmetic.
Nothing here rests on our word. Every value above is the output of a hash anyone can run, and below is the whole sum laid out plainly, line by line, until it arrives at the two figures HashScan shows for the two tokens. One note on reading it: the objects are printed here with their indentation intact, the better to follow them — but the bytes that actually go under the hash are the same objects in canonical form, keys sorted into alphabetical order and every last space stripped away. The hash throughout is keccak256.
// 1 · Hash the input the rule was handed. inputsHash = keccak256(canonical(inputs)) = 0x2e484d90365025392c5c33759b989ce81b22df375b155f6e5d8b72c48b4768e4 // 2 · Hash the output it produced. outputsHash = keccak256(canonical(output)) = 0xe53c38c0f8fc06efe1897d2aa2ea85baa3fa24ad81f297752dbcb7cbdd8293eb // 3 · The rule (M) is named by URI, never copied inline. // Follow that URI and it resolves to the canonical whitepaper. ruleUri = "hcs://0.0.9168005/1780949669.776616000" // 4 · Seal R‖I‖O‖M into one binding: keccak the canonical triple. bindingHash = keccak256(canonical({ "inputsHash": "0x2e484d90365025392c5c33759b989ce81b22df375b155f6e5d8b72c48b4768e4", "outputsHash": "0xe53c38c0f8fc06efe1897d2aa2ea85baa3fa24ad81f297752dbcb7cbdd8293eb", "ruleUri": "hcs://0.0.9168005/1780949669.776616000" })) = 0xe97c354cf074ccfaf15cd3503fe3412394600cb72f19c74174f16946a74342c5 ↑ this is the attest token's name, letter for letter. // 5 · Wrap the binding in a provenance entry, then roll it up. // At n=1 the root simply is this entry's hash; each later entry // would chain on as root = keccak256(prevRoot ‖ entryHash). root = keccak256(canonical({ "bindingHash": "0xe97c354cf074ccfaf15cd3503fe3412394600cb72f19c74174f16946a74342c5", "domain": "grammar.self", "proofMode": "registry", "proofUri": "hcs://0.0.9168006/1780949774.727251977", "ruleId": "sphere://demo/grammar/lexeme-isbound-morpheme", "timestamp": "2026-06-08T20:16:14.337Z" })) = 0x26b23fe4e4ae3ca3ef0736effd65fdb0f700c6bedcfc70e283dcb21b4aac8772 ↑ this is the HELLO token's { n: 1, root } metadata.
Two figures, two tokens, and not an ounce of trust asked of you. Step 4 arrives at the name of the attest token; step 6 at the commitment stamped into the HELLO token. Recompute either one and hold it against the chain: change a single byte of the input, the rule, or the timestamp, and the hashes part ways at once — plainly, and loudly.
One file. 187 lines. ~35 at the core.
The whole demonstration is one file — about 187 lines, roughly 35 of which are the cryptographic core: a canonical-JSON serialization and a hash recipe. Produce a proof and verify it, keyless, from the command line:
npm run core produce # say hello → prove "hello world" → stamp on testnet
npm run core verify <tokenId> # re-derive and confirm, keyless