# How to verify a GH0ST answer

Every answer GH0ST gives here comes with a proof bundle (`proofs/<n>.json`).
You can check it yourself without trusting us, our server or our RPC relay.

## What the claim is (and is not)

- **It is:** the answer was computed by GH0ST's own smart contracts and weights, as deployed on Robinhood Chain:
  - the runtime `0x69996912a59a241763c71810193cf1021ddbb8c0`;
  - its kernel and index contracts;
  - the 495 weight contracts.
- **How:** the computation ran on a local fork of Robinhood Chain at a fixed block, paid with fake ETH. The run is fully reproducible.
- **It is not:** the answer was not recorded on Robinhood mainnet. A mainnet inference costs real ETH.

## What is in a bundle

| Field | Meaning |
|---|---|
| `chain.forkBlock`, `chain.forkBlockHash` | The mainnet block the fork started from. |
| `chain.runtimeAtFork` | The runtime had no session and no deposit at that block. |
| `pins` | keccak256 of the code of the runtime, kernel, index and each of the 495 weight contracts, plus an aggregate hash. |
| `pins` (continued) | The runtime's own `WEIGHTS_SHA256`, `KERNEL_HASH` and `INDEX_HASH`. |
| `tokenizer` | The pinned Falcon tokenizer (model, revision, chat template) and the sha256 of `tokenizer.json`. |
| `question`, `promptIds`, `generatedIds`, `decoded` | What was asked and what came back. |
| `layerCheckpoints` | Every `LayerComputed(id, position, layer, stateHash)` event the contracts emitted, in order, plus the sha256 of that list. |
| `run` | Transactions, gas and wall time of the run. |

The `stateHash` is the keccak of each layer's fixed-point state vector. GH0ST's own validation compares the same values against its reference.

## Verify it

You need:
- Node.js 20 or later;
- [Foundry](https://getfoundry.sh) (`anvil`);
- Python 3 with `tokenizers`;
- an **archive** RPC for Robinhood Chain (chain id 4663) that you trust.

Some public RPCs keep only a few minutes of history; they cannot serve a fork at an older block.

```bash
node creature/ghost_verify.mjs creature/data/gh0st/proofs/1.json --rpc https://<your-archive-rpc>
```

The script prints PASS or FAIL for each check:

1. **Tokenizer**
   - `tokenizer.json` matches the pinned sha256.
   - The question re-encodes to the same prompt ids with the official chat template.
   - The generated ids decode to the recorded text.
2. **Contracts**
   - The script reads the code of the runtime, kernel, index and all 495 weight contracts from mainnet through your RPC.
   - Every keccak256 must match the bundle. Contract code never changes, so reading it at `latest` is enough.
3. **Fork block**
   - Its hash must match the bundle.
   - The runtime must have had no session and no deposit at that block.
4. **Replay**
   - A fresh `anvil` fork of your RPC runs the same prompt through the same contracts.
   - The generated ids and every `LayerComputed` stateHash must match.

`--fast` is optional. It puts a local caching relay in front of your RPC. The relay answers zero for the runtime's empty session and deposit storage, which check 3 proves is empty. Without `--fast`, anvil talks to your RPC directly: it is slower, but there is nothing in between.

`--skip-replay` runs only checks 1 to 3, which take a few minutes.

A full replay takes about as many transactions as the original run (listed in `run.transactions`). Count from tens of minutes to a few hours, depending on your RPC.

## Notes

- **Posting fee.** On a fork the L1 posting-fee precompile (`ArbGasInfo` at `0x6c`) does not exist. It is replaced by a stub that returns 0 fees, as in GH0ST's own local tests. It affects only payment accounting, not the computation.
- **GH0ST is a third-party research project.** See [github.com/8tk8m2kv9f-lang/GH0ST](https://github.com/8tk8m2kv9f-lang/GH0ST). We use its public contracts; we are not its authors.