How to verify us
Every claim on this site is meant to be checkable by somebody who does not trust us. This page is the instructions. It takes about two minutes for the first level, needs no account and no permission, and it is designed to be able to fail — if a published number had been edited after the fact, the command below would say so.
There are three levels, each more hands-on than the last, and each independent of taking our word for anything. The first needs nothing but Python. The second adds one library and checks the signatures. The third clones the engine and re-runs it. You do not need to do all three: the first one alone establishes that the numbers you are reading are the numbers that were published.
Level 1 — recompute every hash
Each published artifact carries a SHA-256 over its own canonical bytes. This recomputes all 26 of them from files downloaded straight off this site and confirms every one matches. No repository, no install, no data — the Python standard library is enough.
mkdir canli-verify && cd canli-verify
for f in \
borrow_execution_contract capacity corporate_action_contract crowding_risk_contract \
deflation earnings_narrative_change_diversification \
earnings_narrative_change_input_data_manifest financing_contract \
futures_execution_contract kill_log lint_debt_contract market_status_contract \
options_execution_contract pre_registration red_team reproducibility \
repurchase_issuance_companyfacts_audit repurchase_issuance_identity_overlap_audit \
repurchase_issuance_semantics_audit research sleeve_atlas sleeve_atlas_audit \
sleeve_family_lineage_audit track_record treasury_tentative_schedule_audit \
trial_ledger ; do
curl -sO https://canlicapital.com/glassbox/$f.json
done
curl -sO https://canlicapital.com/glassbox/reproduce.py
python3 reproduce.py --dir .You should see L1 content hashes : 26 reproduced, 0 failed.
If any line says FAIL, a published file no longer matches the hash it was published with,
and the kit exits non-zero. That is the kit working, not the kit breaking.
Level 2 — check the signatures and the chain
Two commitments are Ed25519-signed, and the whole track record is written into an append-only hash chain: each entry links to the one before it by hash, and every link is signed. Re-deriving that chain is the check that matters most, because it is the one that catches a past day being quietly rewritten rather than a present file being edited.
pip install cryptography
for f in capacity_commitment founder_commitment ; do
curl -sO https://canlicapital.com/glassbox/$f.json
done
python3 reproduce.py --dir .
# and the append-only chain, which is the part that cannot be quietly rewritten
curl -sO https://canlicapital.com/glassbox/transparency_log.json
curl -sO https://canlicapital.com/glassbox/verify_transparency.py
python3 verify_transparency.py transparency_log.jsonThe chain currently holds 406 entries, from 2026-06-27 to
2026-08-22, signed under the public key
0c6606a6b0c5b66fbf3b78521c85e72019484e0177d04a873a651179175ac095. If any earlier entry had
been altered, that entry's chain hash — and every signature after it — would fail here.
Level 3 — re-run the engine
The last level checks that the engine which produced the numbers is deterministic and unchanged: a golden-master test replays a scripted fixture and requires the output to be byte-for-byte identical. This one needs the repository.
git clone https://github.com/arhancanli/alphac.git
cd alphac && uv sync
uv run python scripts/reproduce.pyRun inside the repo, the same reproduce.py executes all three levels at
once and prints a summary of each.
What this does not prove
A verification page that only lists what it establishes is marketing, so here is the other half, stated as plainly as the commands above.
A matching hash does not make a number correct. It proves the file you are reading is the file that was published and has not been edited since. If a figure was computed wrongly, it will hash perfectly. What defends against that is a different thing entirely — the measurements, each published with its own claim boundary, and the published corrections we have had to make against our own earlier figures.
A valid chain does not make the history complete. It proves that nothing has been altered or removed since the chain began, at 2026-06-27. It cannot say anything about what was or was not recorded before that date, and it never will. That is a real limit and it does not shrink with time.
A deterministic engine is not an accurate one. The golden master proves the engine reproduces its own output exactly. It says nothing about whether the model of the market inside it is any good, which is what the research library exists to argue about and what the forward record exists to settle.
And none of it is a return. This book trades on paper. No real capital is deployed, nothing here is investment advice, and a verified record of a simulation is still a record of a simulation.
If something does not reproduce
Then we would want to know before you do, and we have deliberately made that easy to
report: the failing output of reproduce.py is self-describing, name the file
and the level. A published record whose only asset is that it checks out cannot ship a
bundle that does not check out, so a genuine failure here is a defect on our side, not a
support question.