Don't trust the page. Don't trust us. Trust the math.

Read what the endpoint actually returns. No rendering.

Public, no key. Every signature result, every lineage link, every ledger timestamp — machine-readable.

Run the standalone verifier. Rubric is not in the trust path.

The tool's only baked trust is a pointer to one message on the public Hedera ledger (topic 0.0.10416909, seq 276123) that only Rubric's operator account could have written. It derives the federation's signing keys from that ledger entry, checks every ML-DSA-65 signature itself, walks the lineage, and cross-checks every record against its on-chain anchor. Hand it records from a hostile source — every cross-reference is hash-bound, so the source cannot lie undetected: --dir ./records verifies local files with the same rigor.

Rebuild the Merkle chain yourself. Forty lines, no Rubric code.

Records are anchored in two hops: leaf to batch root, batch root to the aggregate root published on Hedera. This verifier reimplements both from the published specification — it shares no code with the node that produced the anchor — then reads the on-chain value directly from Hedera's public mirror node and compares. The only Rubric input is the proof package, which anyone holding an attestation can hand you.

It also refuses to overstate. Anchors written before 2026-07-30 under tree version 2 bind the number of batches rather than their contents (RUBRIC-SEC-2026-001, found by writing this very tool). The verifier reports those as partial and exits non-zero rather than showing a green check. A verifier that cannot fail is not a verifier.

If Rubric disappeared tomorrow, everything still verifies.

The signing keys are committed to a public ledger. The attestations are anchored to it with consensus timestamps no operator can rewrite. The verifier is open source. Nothing in the verification path requires Rubric to exist — that is what generator-independent means, and it is the entire point.