Three steps, no AirIndex servers required after step 1.
curl /api/provenance/record?table=AixIdentifier&id=aix%3Asir%3A3GKPQP74
Extract identity columns (id, assetType, internalTable, internalId, mintedAt) from the AixIdentifier row for aix:sir:3GKPQP74. Canonicalize as JSON: sorted keys, no whitespace, ISO 8601 dates, explicit nulls. Prefix with AixIdentifier:. SHA-256 → hex. Must equal leaf.hash in the JSON.
Base64-decode anchor.tsa.signature_base64 and run:
openssl ts -verify -in tsr.der -CAfile <DigiCert TSA root cert>
Or, for the trustless path (once Bitcoin has confirmed):
ots verify proof.ots
Full identity anchored. This SIR’s identity columns — report number, citations (citedAixIds), methodology hash, committed pdfHash + jsonHash, sealedAt — are part of the daily Merkle batch above. Once committed, the SIR row is immutable; revisions mint a successor (predecessorAixId chain). Each cited aix:hp:* is independently anchored — click any to verify its own chain.
Full verification methodology → — canonical hashing, Merkle proof construction, openssl + ots verification commands.
Raw JSON proof: /api/provenance/record?table=AixIdentifier&id=aix%3Asir%3A3GKPQP74