DOCUMENT ASSURANCE · POST-DELIVERY BATCH VERIFY

Do not guess which delivery file changed. Check the whole ZIP, then verify every evidence layer inside.

Senders can create a detached SHA-256 seal for the final ZIP and carry it through a separate trusted channel. Recipients can check the ZIP's raw bytes first, then verify ZIP integrity, the manifest, every PDF and every processing receipt.

Whole-ZIP raw-byte seal PDF + receipt fingerprints Browser-local processing

Back to Document Assurance

LAYER 1 · DETACHED WHOLE-PACK SEAL

Before unpacking the ZIP, confirm whether you received the same final delivery artifact.

This layer hashes the final ZIP's raw bytes sequentially. The seal stays outside the ZIP to avoid self-reference; changing even one byte changes the full fingerprint. It is not an identity digital signature, so carry it through a trusted channel separate from the ZIP when identity matters.

Sequential whole-ZIP SHA-256 · No upload Detached seal can travel by a second trusted channel

1. Choose the final delivery ZIP

FileNest calculates SHA-256 sequentially over the final ZIP's raw bytes without unpacking, modifying or uploading it. The filename is only a readable label; exact byte size plus the full 64-hex SHA-256 determine whether the content is identical.

constrained device · sequential hash limit 96.0 MB

2. Create a new seal, or add a received seal to verify the whole pack

Senders leave the seal input empty to create one. Recipients add the seal JSON supplied through a separate trusted channel before verification. Seals are capped at 64 KB and strictly checked for UTF-8, schema, algorithm, byte size and SHA-256.

LAYER 2 · INTERNAL EVIDENCE RE-VERIFICATION

After the whole-pack fingerprint checks out, verify ZIP structure, manifest, PDFs and processing receipts.

FileNest first checks ZIP directory metadata and the declared decompression workset, then runs CRC32, manifest-structure validation, per-PDF SHA-256 and, for newer packs, per-receipt SHA-256 plus PDF↔receipt evidence cross-checks.

Verify the whole pack locally · No upload Recalculate SHA-256 + exact bytes for every PDF and receipt

1. Choose the complete Assurance Run delivery ZIP

FileNest first reads ZIP directory metadata and checks the declared decompression workset. Only after that safety gate passes does it run CRC32, manifest-evidence validation, per-PDF SHA-256 and, for newer packs, per-receipt SHA-256 plus evidence cross-checks. Delivery files are not uploaded for verification.

constrained device · ZIP read limit 96.0 MB

Verification boundaryFileNest first checks ZIP entry count, declared uncompressed size and the device workset without CRC decompression, then enables CRC32 only after the safety gate passes. It next validates manifest structure, page-reviewability evidence and per-PDF SHA-256; newer packs also get per-receipt SHA-256, exact-byte and PDF↔receipt cross-evidence verification. It verifies delivery evidence only, never executes scripts or other ZIP contents, and never backfills missing legacy evidence as if it had happened.

EVIDENCE BOUNDARY

Verify content integrity without pretending it is an identity signature or receipt proof.

A detached-seal pass means the final ZIP's exact byte size and full SHA-256 match. An internal-verification pass means manifest-recorded PDFs and, for newer packs, processing receipts match their content evidence without disallowed extras. Neither result is an identity digital signature, trusted timestamp, legal certification or proof of receipt.