gemmozero/phoenix-objects

PHOENIX objects - LEGION

Do not trust LEGION: verify.

Issuer continuity (v0.2)

python3 phoenix_verify2.py --keyring keyring.jsonl --pin <sha256 of the key, obtained from an independent source>

Flags: CONTENT_INTACT SIGNATURE_VALID EVIDENCE_INTACT ISSUER_KEY_PINNED KEY_REVOKED_AFTER/BEFORE_SIGNING. Rotations are signed by old and new key; revocations are append-only. signed_at is not covered by the v0.1 signature: date proof comes from the LEGION empire ledger anchoring.

pip install cryptography
python3 phoenix_verify.py

Verdicts: VALID_FULL | VALID_SIGNATURE_ONLY | INVALID. Change one character in objects/ or one byte in evidence/ -> INVALID. Released 2026-10-03T05:50:02+00:00 - 63 objects.

The dataset viewer is disabled (2026-10-21): the files do not share one schema. Verify the files with the commands above.

Key pinning

A signature only proves consistency with the bundled key. Check the key fingerprint against independent sources:

sha256(raw public key) = a7c6a35b1c2c81d589a30c2ad628679bdea9da4139d49aa3c42cdde6e1c65036

• https://huggingface.co/datasets/gemmozero/state-of-ai-infra-bulletins/blob/main/legion-receipt-key.json
• https://legion-api.com/.well-known/legion-receipt-key.json (browser or curl)

python3 -c "import json,base64,hashlib;print(hashlib.sha256(base64.b64decode(json.load(open('legion-receipt-key.json'))['key'])).hexdigest())"

Retractions (2026-10-12)

9 evidence files were retracted because they attributed scores, risk tiers, amounts or premiums to named real companies without a source URL, or carried "measured": true without a source. Each one is replaced by a signed tombstone (status: RETRACTED, SHA-256 of the original) and listed in the signed note retractions/2026-10-12_evidence-retraction.json. The 63 objects and tlog/ are unchanged. Objects whose evidence was retracted verify as VALID_SIGNATURE_ONLY (EVIDENCE_RETRACTED in phoenix_verify2.py), never VALID_FULL.