Proof
Three artifacts. No email gate, no demo call. Download the files, open them in your tools, and check the hashes yourself. If the output does not match the claim, the product fails, and you have the receipts.
Verifier output
$ unzip -p audit-bundle.zip manifest.json | jq .merkle.root
"a320428f40579ec9eaea1a640614d26649f2111a0cc6f6b379003d25278bb6d2"
$ python verify_chain.py audit-bundle.zip
manifest: ok
files: 2 / 2 sha256 matches
merkle: root recomputed and matched
result: bundle intact
Downloads
A recall-lookback sample for one leafy-greens lot, exported in an FDA-oriented sortable layout.
Why this matters
FDA records requests may require records, including an electronic sortable spreadsheet under 21 CFR 1.1455(c)(3), unless an exemption or agreed alternative applies. This sample shows RegEngine's current column mapping and should be reviewed against the specific FDA request.
A three-event payload covering harvesting, initial packing, and shipping for one traceability lot code.
Why this matters
Several major buyers are standardizing on EPCIS 2.0 for supplier ingest. Confirm that what RegEngine emits validates against your retailer's onboarding tests before you sign a contract.
The CSV and EPCIS (Preview) payload plus a manifest.json with per-file SHA-256 hashes and a Merkle root computed by production code.
Why this matters
Compare each declared file's SHA-256 hash and the bundle's Merkle root with its included manifest. These checks establish internal consistency; they do not authenticate the issuer or establish that the source data is accurate.
Run it yourself
verify_chain.py reads the manifest, recomputes each declared file's SHA-256, and rebuilds the Merkle root using the same algorithm RegEngine ships in services/shared/merkle_tree.py. If those values disagree with the included manifest, the script exits non-zero.
Three-step verify
# 1. Download the bundle and the verifier
curl -O https://regengine.co/proof/audit-bundle.zip
curl -O https://regengine.co/sdk/verify_chain.py
# 2. Run it
python verify_chain.py audit-bundle.zip
# 3. (Optional) Recompute the leaf yourself
shasum -a 256 fsma-204-sample.csv
Watch it fail
audit-bundle-tampered.zip contains a changed CSV while the manifest's declared hash remains unchanged. Run the verifier against it and watch it exit non-zero. This demonstrates detection of changed file bytes against an unchanged manifest; replacing both the file and manifest is outside this check.
Tampered output
$ python verify_chain.py audit-bundle-tampered.zip
manifest: ok
verify: FAILED: fsma-204-sample.csv sha256 mismatch
result: bundle TAMPERED
$ echo $?
1
Changelog
2026-05-09: verifier mismatch found and fixed
A reader running the recipe on this page got an argparse error instead of a verification. The verifier we'd shipped didn't match the bundle we'd shipped. The hashes were correct, but the script next to them read JSON, not the zip the page describes.
Replaced with a verifier that opens the zip, recomputes every per-file SHA-256, and rebuilds the Merkle root using the same algorithm RegEngine ships in services/shared/merkle_tree.py. Added the EPCIS payload to manifest.json, added a build block (commit, generated_at, release), and published audit-bundle-tampered.zip so anyone can watch the new verifier fail closed.
If you found the original bug before we did, thank you. That's the system working.
python verify_chain.py audit-bundle.zip