surface
Proof Surface
The CROWN receipt chain, rendered and verifiable offline
corecruxctl verify-store --mode full --strict ok: true · 4 receipts · chain intact
Signatures bind to both the receipt id and the payload hash, so a receipt cannot be edited in place or transplanted elsewhere; ordering is carried by chained segment seals on the spine. You can run this exact experiment on your own machine: scripts/demo-receipt-tamper.sh in the Crux repo.
The Proof Surface is where CueCrux's receipts stop being an abstraction and become something you can read. Every state mutation in the system mints a CROWN receipt: Ed25519-signed, hash-chained onto a BLAKE3 append-only spine. The Proof Surface renders those chains, receipt by receipt, so an operator, auditor, or counterparty can walk the exact sequence of what happened and confirm that nothing was inserted, removed, or edited after the fact.
Each receipt resolves to its full context: which passport acted, at what trust tier, under which grants, doing which verb, touching which state. Refusals appear in the same chain as signed RefusalReceipts with reason codes, because what the system declined to do is evidence too. This is what makes receipts a debugging surface as much as a compliance one: when something goes wrong, you replay the signed trail instead of interviewing the logs.
Verification does not require CueCrux, an account, or a network connection. corecruxctl verify-store checks a store's chain locally; exported contexts and .cruxpack bundles verify offline against their signatures and hashes; and tamper-rejection is exercised as a release-blocking CI gate, meaning a build that fails to reject a doctored chain does not ship.
For regulated teams, the practical output is evidence packs: selected trails exported as self-contained bundles that a regulator or opposing party can verify independently. The Proof Surface exists to make one sentence true in the strongest available sense: prove every one.