VERSIONPASS

A file fingerprint, designated reviewer and previous version identify a delivery commitment. A separate approval commits to that exact revision. Delivery alone never means approval.

In the synthetic-file test, versionpass-sample-v1.txt matched the receipt when it contained the original bytes. A file with the same name and changed content was rejected. This check was repeated on the deployed public app.

The browser computes SHA-256 locally and binds the fingerprint, reviewer and preceding version. A reviewer signs a separate approval of the exact version. The official Memo program records these commitments on Solana devnet. A fresh check asks the named public RPC for the exact Memo, expected signer, signature, matching slot and finalized status. An imported receipt remains unverified until checked; unavailable evidence stays unverified. Read-only checking does not resend a transaction.

The real public-devnet receipt was exported and imported in a fresh tab. The original file matched its fingerprint. Both delivery and approval passed fresh read-only devnet checks on the deployed public website. No new transaction was sent during that public-site check. The product screenshot is an actual capture, not an illustrative mock-up.

Delivery finalized at slot 517729534; approval finalized at slot 517729891. Original bytes matched; changed bytes with the same name were rejected. The application passed 42 deterministic tests and its static build. Later wording-only changes left application JavaScript unchanged and did not rerun those tests. The two temporary keypairs were generated in one browser; they are not two independently verified people. The public UI was checked in English, Traditional Chinese and Japanese on desktop and mobile. No user study, adoption or revenue is claimed.

The app does not upload original file bytes, filenames, local notes or signing keys. Public commitments, test addresses and transactions can be linkable. The named public RPC is a trust dependency; this is not an offline consensus verifier. Existing Cloudflare hosting, RPC and Google Fonts receive ordinary request metadata. The app includes no analytics or advertising code; Cloudflare may independently add an analytics script.

There are no mainnet payments, durable key recovery, real-wallet integration or production multi-user workflow. Refreshing discards temporary keys. A fingerprint proves neither authorship nor ownership; a public key does not prove legal identity. Devnet may be unavailable or reset. Use synthetic files.

Live app · Narrated demo, about 2 minutes 55 seconds, with English captions · Public source.

Future work includes real-wallet UX, durable receipts and independently tested multi-user review. These are planned improvements, not current capabilities. OpenAI Codex assisted implementation, tests, writing and demo preparation. The project uses the existing Solana SDK and Memo program and existing MICRO USADA hosting.