Receipts for a class
Your academy already grades people. At the end of a run a score exists, and today it leaves the building as a screenshot or a PDF, which the hiring center on the other end has no way to tell apart from an edited one. This closes that one gap, and nothing else. You do not install anything, you do not get an account, and the person checking the document at the other end does not either.
An email to hello@arcaeon.io with three things in it.
If one row in the roster is malformed, the whole roster comes back refused, with the row named by number, and not one receipt is minted. A half-issued class — six trainees with paper, the rest without, and nobody sure which — is worse than a rejected file.
One email back, carrying one file.
Two files per person. The receipt is JSON — that is the thing a stranger verifies. The exhibit is plain text — that is the thing a human reads. Your academy's name and the class ride inside the seal rather than in a header, so a receipt carrying an altered one no longer matches its own digest and reads FAIL to whoever checks it. A name printed outside the digest is a name anyone can retype.
One row per trainee: receipt id, issuer, cohort, trainee, scenario, the stated score, when it was issued, the verdict, whether the chain still checks out, and whether it carries an independent timestamp. Counts of each verdict at the top. No class average, no pass rate, no ranking — the tool has no opinion about your cohort and we are not going to invent one.
Every receipt and exhibit, the ledger files they name, the roster report, a manifest carrying a sha256 for every file in the archive, and a README written for a stranger with no tools and no account. It checks out with the network switched off, which is a test that runs rather than a sentence we wrote. If we went away tomorrow, the archive would still verify.
The part that is free
The hiring center on the other end opens the verifier and drops the file on it. The page runs entirely in their browser. Nothing is uploaded, including to us, and there is no sign-in between a person and the answer. That is deliberate: a verifier somebody has to pay for is a verifier with an interest in the verdict.
A whole class can be dropped on it at once, up to 20 receipts in one pass. Past 20 it refuses the batch and says so, naming the cap and the count — it does not quietly check the first 20 and go silent. That number is printed here next to the word free because free with a hidden cap is a small lie, and this is a product about not telling those.
There are two verifiers, not one: that page, and the
arcaeon-receipt verify command line, each written against the same
canonical form. You are not required to trust either of them alone.
Issuing is free and verifying is free. The optional independent timestamp is the only piece that costs us money per use, and if that ever gets expensive the lever we pull is that timestamp — never the free verification, and never a charge to check whether a document is genuine.
This is not our summary of the claim. It is the claim, copied out of the code that mints the receipt, and it prints on the face of every exhibit above the results, so the first thing a hiring manager reads is the limit.
Proves: the score and the ballot are unaltered since the timestamp.
Does not prove: the score is correct.
Does not prove: the sim was not attempted before.
Method: a sha256 digest of the canonical JSON ballot object — score, verdict, and whatever fields the grading engine produced — bound to a stated timestamp inside the receipt body, and hash-chained, one row per ballot.
The word correct appears in that block exactly once, as a denial. A receipt says the number in front of you is the number the sim issued. It says nothing about whether the number was deserved, and anyone who tells you otherwise is selling a sentence we do not have.
A person runs it. There is no portal, no API, no instructor dashboard, and no login. You email us and someone reads the email and runs a command-line tool. We are telling you that up front because you will find it out in week one anyway, and because a manual run is how we learn what a real class needs before we build the thing that automates it.
It does not verify identity. Nothing here proves the person named on the receipt is the person who sat the scenario. That is proctoring, it happens before the grade exists, and sealing an unproctored result seals an unproctored result.
A trainee can show you their best one. Someone who runs a scenario three times can hand over one document, and nothing in that document reveals the other two. Your roster report shows you all three; it does nothing for a hiring center reading one receipt cold.
The independent timestamp is optional and off by default. Without it, the sequence is recorded in a file you control, and a receipt that says so on its own face is proving less to a stranger than one that is pinned outside your building. Ask for it if you want it.
It does not replace your process, or theirs. It removes one doubt: whether the number on the page is the number the sim issued. Every other question a hiring panel has is still theirs to answer.
Email hello@arcaeon.io with a roster, or call (855) 301-1717. The number is a recorded menu that answers the common questions, and you can leave a message any time.
What this costs is not on this page. Ask, and you will get a number rather than a meeting.