Verify / Local hashing / Source binding
Check the file claim. Not the legal claim.
The verifier checks whether the profile and cited source files are the ones the profile claims to use.
No file upload. No backend. No compliance determination. The check happens locally in the browser.
01 / Operational flow
Four checks, one narrow result.
The verifier is intentionally small. It gives implementers a reproducibility check without pretending to replace legal analysis.
01Load descriptorexpected hashes
02Select fileslocal only
03Hash bytesSHA-256
04Read resultmatch / mismatch
02 / Tool
Local source-binding verifier.
Select files to compute SHA-256 locally. Match them against the bundled descriptor or use the result as a reproducibility check.
03 / Sample result
A serious result is narrow.
The result should be useful because it is limited.
Profile: DORA ICT incident initial notification Catalogue entry: matched Source bundle: 4 artefacts Hash status: verified Mapper report: present Legal fidelity: not asserted
Verifier meaning
Provenance checked. Compliance not checked.
This distinction is not a disclaimer bolted on later. It is the architecture.
04 / Boundary
The verifier refuses to become a regulator.
It checks file identity and profile-source binding. It does not determine whether an institution has complied with DORA or any other act.
This layer can show
- official source artefacts named and hashed
- field provenance, mapper notes and reproducibility
- schema divergence against a public reference profile
- where interpretation entered the machine profile
This layer cannot show
- legal approval or supervisory acceptance
- that a filing, firm or vendor is compliant
- that a mapping is legally complete without review
- that pinned sources are automatically the latest legal state