The film
About 4:42, hosted by Rerun. It asks you one question and waits for your answer before it shows you. The guide's voice is not recorded yet, so for now the film plays with captions; the full words are also below.
Nothing loads until you press play.
Since this lesson was made
16 October 2026: Flywheel closed the gap this lesson found
The film says Flywheel's verifier never recomputes the receipt's own identifier, and that it never reads the envelope's schema name or the signature's key name. That was true of the version this lesson checked (Flywheel at f04ef26). On 16 October 2026 Flywheel merged a fix, pull request 419 (commit 21d4669): its verifier now recomputes the identifier, checks the key name against the pinned key, and checks the schema name.
We reran the one-byte sweep of the receipt against both versions. Of 5,744 flipped copies, 1,315 no longer parse. The old verifier says the receipt still matches on 81 of the rest; the fixed one, on none. The signed lie in the film still passes any check that trusts the liar's key, and only the true answers catch it; the fix does not change that. The film, its numbers and the lab are left as measured against f04ef26.
The lab: the receipt
The real bundle, checked from scratch in this page. Flip any byte of any file and check again, or try a cheater's edits. In the film's sweep, all 2,892 flips of the rows file were caught, and 5,663 of 5,744 in the receipt.
The bundle is checked on your computer, in this page, with your browser's own SHA-256 and Ed25519. Nothing is sent anywhere.
Everything the film says
A score that carries its receipt
Case study: a score that carries its receipt.
In lesson E24 we saw a check that could be fooled. Tonight Rerun opens a score that comes with its own evidence, checks it from scratch, and finds out exactly what that evidence proves.
A claim and its receipt
Flywheel is our evaluation tool. In this demonstration a data owner runs an approved job on private questions, and the job writes one row per question: the answer given and whether it was right.
The result says 40 of 50. Beside it sits a receipt: a hash of the rows, a tree of hashes over every row, the hash of the approved job, a hash of the approval record, and a signature over the whole body.
Check it yourself
A hash is a fingerprint of bytes: change one byte and the fingerprint changes completely.
So we counted the rows ourselves: 40 of 50. Then we recomputed, in this page's own code, every fingerprint the files let us check, nine in all. Each matched the published value exactly. The approval record's hash and the model and data commitments cannot be recomputed from the bundle.
Flip any one byte of the rows file. Does the check catch every flip, most of them, or few? (the film pauses here)
One byte at a time
We flipped every byte of every file, one at a time, 10,960 tampered copies in all. In the rows file, all 2,892 of 2,892 were caught.
In the receipt itself, 5,663 of 5,744. The 81 missed bytes sit in two fields outside the signed body, the envelope's schema name and the signature's key name, which Flywheel's verifier never reads. The permissions file was caught 0 times in 108: the job's hash leaves it out on purpose.
Same score, different rows
A sneakier edit: swap the right and wrong marks on two rows. The count is still 40, so a check on the score alone passes.
The fingerprints do not. The rows' hash and the tree both change, and the receipt no longer matches.
What the receipt cannot see
Now the hard case. Someone signs a lie: they mark one wrong row as right, rebuild every fingerprint and sign again.
If we accept their key, every hash check passes, and the receipt is perfectly consistent. If we insist on a key we trusted before, the signature check catches the swap. But if the liar holds that trusted key, only the true answers, revealed afterwards, catch it.
A receipt proves the bytes have not changed since they were signed, and which key signed them. It cannot prove the rows were true when they were written. That needs a check against the truth, like the exact checker in lesson E24.
Found while checking
One more thing turned up. Flywheel's verifier never recomputes the receipt's own identifier. Flywheel's own test of a consistent lie rebuilds and signs everything except that identifier, and its verifier still says the receipt matches until the answers are revealed.
Our page checks the identifier too. That is a gap worth closing in Flywheel's verifier, and it is the point of a receipt anyone can recheck: an outside check found it.
Goodnight
Recount the rows, recompute the fingerprints, and remember what a signature cannot see.
Goodnight.
Sources
Every claim in the film, with where it comes from and what that source does not prove. The numbers about the model are computed from its weights, which you can load and check: facts.json, receipt.json, results.jsonl.
Flywheel: the PySyft result receipt. HarperZ9/flywheel at f04ef26, docs/features/pysyft-result-receipt.md. https://github.com/HarperZ9/flywheel/blob/f04ef26fda8e36e3f73521ebbc5e03c4220da72d/docs/features/pysyft-result-receipt.md
Used for: What the receipt binds (rows by hash and Merkle root, the approved job by its hash, an Ed25519 signature over the canonical body) and what a stranger can and cannot check.
Does not prove: That the hidden model or data were what the parties said (attestation is UNVERIFIABLE in the fixture).
Flywheel: the PySyft receipt fixture. HarperZ9/flywheel at f04ef26, tests/fixtures/pysyft_receipt/ (last changed at 7d47b8f), copied unchanged to media/school/receipts/. https://github.com/HarperZ9/flywheel/blob/f04ef26fda8e36e3f73521ebbc5e03c4220da72d/tests/fixtures/pysyft_receipt
Used for: A demonstration job: 50 questions, 40 marked correct; the receipt's published hashes and signature.
Does not prove: Anything about a real model; the job is a demonstration with a toy adder.
Flywheel's verifier. HarperZ9/flywheel at f04ef26, harness/job_result_verify.py. https://github.com/HarperZ9/flywheel/blob/f04ef26fda8e36e3f73521ebbc5e03c4220da72d/harness/job_result_verify.py
Used for: Which checks the verifier runs; it does not recompute receipt_id.
Does not prove: How the verifier behaves on other receipt types.
Night School's re-derivation and tamper sweep. media/school/receipts/facts.json, written by tools/school/fill_receipts.mjs from system/school/receipts*.mjs: every derived field recomputed with WebCrypto SHA-256, canonical JSON and an RFC 6962 Merkle tree; every byte of every file flipped once; four false-success controls; verdicts compared with Flywheel's own verifier on 8,636 tampers. https://github.com/HarperZ9/HarperZ9.github.io/tree/main/media/school/receipts
Used for: All derived fields reproduce byte for byte; 40 of 50 re-derived; sweep counts per file; the consistent cheater passes every hash check and fails only against the revealed answers or a pinned honest key.
Does not prove: Resistance to multi-byte edits by someone without the key beyond what hashes and signatures give by construction.
What this lesson leaves out
The receipt is Flywheel's demonstration fixture with a toy job, not a real model's evaluation.
A receipt proves the bytes have not changed since they were signed and which key signed them; it does not prove the rows were true, or that the run was the only one.
The sweep flips one byte at a time; edits by someone who holds the key are the signed lie the film shows.
Before this: When the check can be fooled (E24) and Evaluating a language model (L16). Earlier on this beach: The denoiser's tensor-core parity (K25).