Drop in an OpenChainGraph artifact (or an export-profile output of one). This page runs the applicable subset of the SPEC.md §15 gate suite entirely in your browser and shows a point-in-time verdict: which gates passed, which failed, and why, with the evidence to reproduce the run independently.
Bucket A runs on every submission. §1 envelope well-formed (validated against the published openchain-graph-v0.4.schema.json, embedded verbatim in this page); §4 canonical execution_hash recomputation (ported byte-for-byte from chaingraph/kernels/_hash.mjs lines 19 to 59, the ONE canonical JCS path, no ad-hoc re-derivation); §16 proof binding (ported from chaingraph/kernels/_proof.mjs's eddsa-jcs-2022 sign/verify pipeline, lines ~2961 to 3171, Ed25519 via WebCrypto only). An artifact with no audit_signature.proof is unsigned and conformant; §16 shows "not applicable," not a fail.
Bucket B runs only when the relevant member is present in the submission. §PPH-1 policy_parameters_hash (full recompute, ported from the same _hash.mjs); §20 anchor bindings (shape validation plus anchored_hash === execution_hash equality check; Merkle-root reconstruction from merkle_inclusion is not yet ported in this build); §1.4/§28 clause bindings (pointer resolution plus citation-object shape); §25 private-input declarations (pointer resolution plus commitment-string equality, a partial plaintext-exclusion check); §22 Work Mandate and §27 human-accountability records (schema shape plus validity-window/expiry sanity plus reuse of the §16 proof check); §21.4 decision-gate static forward-only routing, when the submission is chain-shaped. §17 kernel identity, §18 compute-integrity (BN254 Groth16 seal), and §23 input attestations are shape-checked only in this build, since deeper cryptographic verification of those three was not ported: Groth16 pairing verification and embedded-credential proof chasing are out of scope for this build, and a false FAIL from an under-tested port is a worse outcome than a plain "shape only" label. §13.11 to 13.14 SD-JWT and xBRL export checks apply only to that export's own serialization, not to a plain artifact JSON submission, and are marked not applicable here.
Bucket C can never be checked from a submitted artifact, and is listed here rather than silently omitted. Repo-internal checks that run over our own working tree, not artifact-shaped (kernel-coverage.mjs, spec-version-consistency.mjs, spec-page-parity.mjs, surface-parity.mjs, catalog-parity.mjs, check-tool-names.mjs, linear-hash-freeze.mjs, spec-gate-coverage.mjs); checks needing a live deployed server (hash-sweep.mjs, verify-mcp-registered.mjs, smoke-mcp.mjs, the round-trip half of smoke-compute.mjs); §24.6.2 seed-replay.test.mjs (needs the submitter's kernel source executing, not just its output); and gate-parity.test.mjs's cross-implementation byte-parity assertion (needs two implementations to compare, this checker has one).
Gate suite version, this run's timestamp, and a SHA-256 digest of the exact submitted bytes are stamped on every verdict (§7) so a FAIL is independently reproducible: pull this exact page source, feed it the artifact matching that digest, and you get the same result. A FAIL that can't reproduce this way is a checker bug, not a finding.
Source: this whole checker is one static HTML file, viewable on GitHub. No coverage percentage is ever computed or shown, only per-gate pass/fail.