The receipts.

A live Hachure TrustBundle from a real producer, rendered straight from /trust/latest.json by the <hachure-trust-panel> web component. The panel shows the subject and version it loaded — this page hard-codes neither, so it tracks each release on its own.

The producer here is the specification itself: hachure-org/spec ↗ opens external site attesting its own package content, using nothing but its own bundled implementation. The checks captured in this one: npm test (pass/fail counts as evidence), the conformance vectors ↗ opens external site each derived by the bundled implementation (per-vector results), the declared statusFunctionVersion, and the npm tarball integrity hash anchored as the integrity reference — so the attestation is about exact package content, not a mutable branch. Nothing on this page is specific to any producer: the record shapes, the status function, and the verification below are the format, and any conforming producer emits the same bundle.

A bundle is a point-in-time record — it declares the schemaVersion and statusFunctionVersion it was produced under, and stays a faithful record of what was knowable then. The panel below reflects the producer's declared versions, which may run ahead of the latest published npm release between releases. That gap being visible instead of hidden is the point of the format.