Build Provenance
This site can prove how it was built. Every page is generated by a static-site generator written in Coherence Language, verified by automated gates, and hashed so you can check that what you are reading is what was built.
The pipeline
The generator (pipeline/ssg/src/build.cl) is compiled and run by the Coherence Language toolchain: it assembles every page, the curve figures computed in-language, the feeds, and the sitemap. A post-build step then renders binary assets, and runs two kinds of gates: banned-copy checks (retired claims, dead evidence paths, and the em-dash character fail the build) and required-content checks (if load-bearing copy or pages go missing, the build fails instead of shipping). Only output that passes both gates is deployed.
Build stamped: 2026-08-27 11:57 UTC
Signed release
This release is Ed25519-signed. The signature covers the canonical manifest, so every hash in it, and therefore every deployed byte, is bound to one signed release: change any file without re-signing and verification fails.
Pinned release key: a64d4af965fe220ce1c881f70ebabe5355ab9abbf17f7f3d8fb71ee911d2c493
This release’s signature: eb5672f6583a2f6cd0d05e156de965f00f91…918a5c5f9a0d
Re-verify it yourself, offline, against the pinned key (not the key the file carries):
python -c "import json,urllib.request as u;from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PublicKey as K;q=u.Request('https://coherenceenergylabs.com/build-manifest.json',headers={'User-Agent':'CEL-Release-Verifier/1'});m=json.load(u.urlopen(q));r=m.pop('receipt');b=json.dumps(m,sort_keys=True,separators=(',',':')).encode();K.from_public_bytes(bytes.fromhex('a64d4af965fe220ce1c881f70ebabe5355ab9abbf17f7f3d8fb71ee911d2c493')).verify(bytes.fromhex(r['signature']),b);print('RELEASE SIGNATURE VALID')"Get the key from somewhere we do not control
Do not trust the key printed on this page. A signature checked against a key served by the same origin as the thing it signs proves only internal consistency: whoever controls this origin could replace the page, the key, the manifest and the signature together, and verification would still pass. To check authenticity rather than consistency, fetch the public key from a location this website does not control:
- The public evidence repository, entry
claims/site-release-key, on GitHub. - The DNS TXT record at
_release-key.coherenceenergylabs.com, which is served by the domain's authoritative nameservers rather than by this site.
If the key you fetch out of band does not match the one shown above, the release you are looking at is not ours. That is the check we would want a hostile reviewer to run, so we are telling you how to run it.
What the manifest covers, and on which hosts
The manifest lists paths from one asset store, and that store is served on two hosts by design: coherenceenergylabs.com for the corporate site, and demos.coherenceenergylabs.com for the interactive demos, which run on a separate origin so their relaxed policy can never reach the main site. A path listed as /demos/gauntlet/index.html is therefore the same signed bytes you get at demos.coherenceenergylabs.com/gauntlet/; the demos are canonical on the subdomain, and the apex /demos/* paths 301 there so older links keep working. Everything else in the manifest is canonical on the apex.
Every artifact hashed
Every deployed artifact, HTML, CSS, JavaScript, images, and demo proof fixtures alike, is listed with the SHA-256 hash of its exact bytes in the signed manifest at /build-manifest.json. Fetch any file and hash it; the values must match. The table below is a readable excerpt.
curl -s https://coherenceenergylabs.com/about/ | sha256sumThe signed manifest covers every deployed artifact except itself and this page; a document cannot contain its own hash.