One document, certified twice. Every answer, every absence, every computed value and every derivation came back the same. Then one digit of the certificate is changed, and it no longer verifies.
Recorded outputTwo certify calls, made 2026-11-05 against the engine at its current release, on one document of Factum's frozen corpus. This page is built from the two response bodies. It is not a live run and nothing on it is a mock-up.
The corpus document is a synthetic invoice with a fictitious carrier. The run used no AI engine key, so the five prose sections were refused by name instead of written. The two certificates are signed by a development key minted for this recording, published below. It is not the production issuer key. Live runs on the frozen corpus are provisioned with a demonstration ID: request access.
1,817fields compared, path by path, nothing filtered out
1,812identical in both runs
5differ, all listed below
Every field that differs
Path
Run 1
Run 2
Why it moves
requestId
18e65cd0-43ab-42c8-8404-4fa5f2761ef2
e68f9c05-39b4-4859-9816-2dfa2eb85f5a
The id of the call itself. Each call has its own.
certificate.issuedAt
2026-11-05T23:56:23.275Z
2026-11-05T23:56:27.254Z
The issue instant.
certificate.barcode
…|at=2026-11-05T23:56:23.275Z
…|at=2026-11-05T23:56:27.254Z
The barcode ends with the issue instant. Every segment before it is identical.
certificate.answerRefusals.checkedAt
2026-11-05T23:56:23.275Z
2026-11-05T23:56:27.254Z
The instant the checklist was answered. It is the issue instant.
certificate.signature.signature
rQUj3NgAFK1qzsTCT2RgTpYuUi+i…
RQ5V3ZdZ+/lpUeDhENYleAT3RltU…
The signature is made over a body that carries the instant, so it moves with it.
Identical in both: all 18 answers, 2 statements, 4 arithmetic checks and 19 slots, the three boundary statements, every rule reference and every derivation id.
An AI system can route its claim through Factum. Factum hands back the answer, the work and a signature, and you can check all three yourself.
This is run 1, drawn from its signed body. Open any row to look through it: the claim on the surface, the check beneath it, the document's own cells beneath that.
POST /api/tenants/{tenant}/certify?reportType=fmc-demurrage-detention-invoice-completeness&filename=syn-inv-01-complete-import.html
FACTUM
Demurrage / detention invoice — completeness under 46 CFR part 541
the certification that the charges are consistent with the FMC’s demurrage and detention rulesresolved
Check how this was answered
statement point sp-cert-fmc-rules
slot S19
matches in the document 1
matched form consistent with
matched form Federal Maritime Commission
matched form demurrage and detention
cites 46 CFR part 541 (us-cfr, declared by the document)
cites 46 CFR 545.5 (us-cfr, declared by the document)
Source block 74 of the document
The charges stated on this invoice are consistent with the Federal Maritime Commission’s rules relating to demurrage and detention, including 46 CFR part 541 and 46 CFR 545.5.
text · block 74, characters 0 to 175 of the clause · syn-inv-01-complete-import.html
the certification that the billing party did not cause the chargesresolved
Check how this was answered
statement point sp-cert-no-causation
slot S20
matches in the document 1
matched form did not cause
matched form contribute to
matched form charges
Source block 75 of the document
The billing party’s performance did not cause or contribute to the charges invoiced above.
text · block 75, characters 0 to 90 of the clause · syn-inv-01-complete-import.html
Arithmetic
Does the allowed free time in days equal the span from the free-time start date to the free-time end date?satisfied2026-04-02 to 2026-04-05 inclusive is 4 day(s); the invoice declares 4.
Does the number of dates charged multiplied by the daily rate equal the total amount due?satisfied5 day(s) charged at 275.00 is 1375.00; the invoice states 1375.00.
Check how this was answered
arithmetic point ap-arith-charge-total
cites § 541.6(c)(1)–(3)
derivation drv:12250656e4fd1dc4dc741516fc95e746
produced by …/arithmetic/count-times-rate-equals-total@1
Was the invoice issued within 30 calendar days of the last date charged?satisfied10 calendar day(s) from the last date charged to 2026-04-20; the limit is 30.
Does the stated request window give the billed party at least 30 calendar days from the invoice date?satisfiedthe invoice allows 30 day(s) to request mitigation; the minimum is 30.
Check how this was answered
arithmetic point ap-arith-dispute-window
cites § 541.8(a)
derivation drv:a9e911bd4d3414bcb8074f22af24a62c
produced by …/arithmetic/declared-window-at-least@1
this result says PBLU4471820, stated by this document under "Container Number", FAILS its iso6346-container check digit - the standard's computation gives 4 and the identifier as stated ends in 0. This is a finding ABOUT THE DOCUMENT: the value is captured exactly as written and is not corrected here, and it was read from the document's own text layer rather than recognised off an image.
Section: What this invoice is aboutrefusedengine_unconfigured
Check how this was answered
code engine_unconfigured
this result says no engine credential is configured, so the engine is not used rather than a response being simulated
remedy declare
declaration needed registerTenantEngine
Source nothing was written
No span. The section was not written, so nothing was read for it. The engine is not simulated.
Section: Timingrefusedengine_unconfigured
Check how this was answered
code engine_unconfigured
this result says no engine credential is configured, so the engine is not used rather than a response being simulated
remedy declare
declaration needed registerTenantEngine
Source nothing was written
No span. The section was not written, so nothing was read for it. The engine is not simulated.
Section: What is owedrefusedengine_unconfigured
Check how this was answered
code engine_unconfigured
this result says no engine credential is configured, so the engine is not used rather than a response being simulated
remedy declare
declaration needed registerTenantEngine
Source nothing was written
No span. The section was not written, so nothing was read for it. The engine is not simulated.
Section: Disputing this invoicerefusedengine_unconfigured
Check how this was answered
code engine_unconfigured
this result says no engine credential is configured, so the engine is not used rather than a response being simulated
remedy declare
declaration needed registerTenantEngine
Source nothing was written
No span. The section was not written, so nothing was read for it. The engine is not simulated.
Section: What the billing party certifiesrefusedengine_unconfigured
Check how this was answered
code engine_unconfigured
this result says no engine credential is configured, so the engine is not used rather than a response being simulated
remedy declare
declaration needed registerTenantEngine
Source nothing was written
No span. The section was not written, so nothing was read for it. The engine is not simulated.
Boundary
CERTIFIED: this report states which of the fields this checklist asks for were LOCATED on the invoice submitted, and names each field that was not. A field reported as not located is reported as missing from this invoice, without a hedge: where 46 CFR part 541 requires a field, it requires it on the invoice itself, and 46 CFR § 541.5 makes the omission of a required field dispositive.
NOT ATTESTED
That every field this checklist asks for is required of this particular invoice is not attested; some apply only to an export, or only to an import.
What an omission decides about the charges billed is not attested, and whether they are owed is not determined here.
That a located value is correct is not attested; it is certified as the invoice states it.
CERTIFIED: the arithmetic below was performed as declared, and every input is the value its source stated, cited by fact id.
NOT ATTESTED
That this quantity is meaningful, that it is the right model of anything, or that it predicts anything is not attested.
The formula is the operator's declaration, not a finding.
CERTIFIED: nothing under this boundary. This report type declares no citation check.
NOT ATTESTED
This certificate does not attest anything about a citation in this document, because no citation was checked.
F
vd-418b7ced1cea5f8e
Key
A development key minted for this recording. Not the production issuer key.
479 characters inside the signature, ending at=2026-11-05T23:56:23.275Z. The verifier prints it in full.
A view of the signed body, and nothing more. The window is never the source of truth; the signed certificate is. An identifier check that reads "invalid" is a finding about the document: the fictitious container number does not carry the check digit its own standard computes.
Change a digit
One byte of run 1 is changed: the total amount due, from 1375.00 to 1875.00. The file is still valid JSON. It is the same length. It differs from the original in exactly one character.
NOT VERIFIED
code signature_does_not_verify
document keyId vd-418b7ced1cea5f8e
your key's keyId vd-418b7ced1cea5f8e
reason the signature does not verify over this document under the supplied key. The keyId matched, so the key is the right one: the document does not hold the bytes that were signed.
Verify it without us
Download the Factum Verifier, the two certificates and the key. Run the command. It needs Node 18 or later and nothing else: no install, no network, no account.
Verifiedexit 0
The verifier states its own boundary. A valid signature says the holder of this key signed these bytes. Whose key it is comes from where you obtained it.
Recorded outputThe verifier's output on run 1 (exit code 0). Run 2 reads the same, with its own instant (exit code 0).
node factum-verify.mjs run-1.json public-key.txt
VERIFIED
keyId vd-418b7ced1cea5f8e
canonical bytes 59952
barcode … (the signed barcode, 479 characters, printed in full when you run it)
surface FULL - the body carries no surface block, so every claim the run captured is on it
CERTIFIED BY THIS CHECK: this document was signed by the holder of the private half of the
key you supplied, over the canonical form named in its signature block, and has not been
altered by one byte since.
NOT CERTIFIED BY THIS CHECK: that the key you supplied is the operator's. That comes from
WHERE YOU OBTAINED THE KEY and from nothing in this file - a valid signature under the wrong
key is exactly what a forgery looks like.
node factum-verify.mjs run-2.json public-key.txt
VERIFIED
keyId vd-418b7ced1cea5f8e
canonical bytes 59952
barcode … (the signed barcode, 479 characters, printed in full when you run it)
surface FULL - the body carries no surface block, so every claim the run captured is on it
CERTIFIED BY THIS CHECK: this document was signed by the holder of the private half of the
key you supplied, over the canonical form named in its signature block, and has not been
altered by one byte since.
NOT CERTIFIED BY THIS CHECK: that the key you supplied is the operator's. That comes from
WHERE YOU OBTAINED THE KEY and from nothing in this file - a valid signature under the wrong
key is exactly what a forgery looks like.
This is one document under one checklist. Contracts, citations, a tie-out, EDI invoices, a composed checklist, a round trip and a workbook fill are recorded the same way: worked examples. The same certificate is shown as the Console draws it on the Console page.