# How to verify the NTM chain

NTM provides a public, machine-verifiable audit trail of AI activity on websites. Any external system (bot, script, auditor) can independently verify the integrity of the NTM AI activity chain, without trusting the Netmeios server operator.

The verification is based on:

- Append-only blocks (`block_*.json`) generated by `ai-sealer.php`. Each file contains exactly the JSON used as input to the SHA256 hash.
- Public summary endpoint: `https://netmeios.com/ntm-trust.php`
- Public blocks index endpoint: `https://netmeios.com/api-blocks.php`
- Public dataset manifest used in the economic layer: `https://netmeios.com/llms.json`

## 1. Fetch public state (summary)

Request:

- `GET https://netmeios.com/ntm-trust.php`

The response contains, among others:

- `summary.blocks_generated` – total number of blocks currently in the chain.
- `latest_block.hash` – identifier of the last block.
- `latest_block.prev_hash` – SHA256 hash of the previous block’s JSON.
- Optionally, a `verification` object with references to this document and the audit sitemap.

The verifier should keep these values as the “promised” public state.

## 2. Fetch block index

Request:

- `GET https://netmeios.com/api-blocks.php`

The response is a JSON object:

- `blocks` – array of entries, each with at least:
  - `timestamp`
  - `hash` (the block identifier, e.g. `20260308_075001`)
  - `prev_hash` (the SHA256 of the previous block’s JSON)
- `count` – number of blocks returned.

The verifier should check that `count` matches `summary.blocks_generated` from `ntm-trust.php`.

Note: the `hash` field is the block ID (derived from the filename), not the SHA256 of the block content.

## 3. Order blocks

Blocks must be processed in strict chain order.

- Sort the `blocks` array by block identifier / filename order (`block_YYYYMMDD_HHMMSS.json`) or by the internal timestamp if present.
- For each entry in `blocks`, the corresponding file on disk (and over HTTP) is:  
  `https://netmeios.com/blockchain/blocks/block_<hash>.json`  
  where `<hash>` is the block identifier (e.g. `20260308_075001`).

The goal is to reconstruct the exact original sequence of block files.

## 4. Recompute hashes and check linkage

For each block in order:

1. Download the block file using its identifier, for example:  
   `GET https://netmeios.com/blockchain/blocks/block_<hash>.json`
2. Let `raw_json` be the exact response body of that file.
3. Compute `computed_hash = SHA256(raw_json)`.
4. For the **first** effective link in the chain, compare `computed_hash` of block 1 with the `prev_hash` value reported for block 2 (the chain conceptually starts from an all-zero hash, so the first real check is between block 1 and block 2).
5. For every subsequent block, verify that the `prev_hash` of the current block equals the SHA256 of the previous block’s JSON (`computed_hash` of the previous block).

If any mismatch occurs, the verifier must treat the chain as corrupted or reordered.

## 5. Match last block with public summary

After processing all blocks:

- Let `last_prev_hash` be the `prev_hash` value of the last block (SHA256 of the previous block’s JSON).
- Alternatively, let `last_computed_hash` be the SHA256 of the last block’s JSON.
- Verify that these values are consistent with the public state exposed in `ntm-trust.php` (for example, by comparing with `latest_block.prev_hash` and/or any published anchor value).
- Verify that the number of processed blocks equals `summary.blocks_generated`.

If all checks succeed and all hashes/linkages are valid, the NTM chain is cryptographically consistent and matches the public state.

## 6. Link to datasets (llms.json)

The economic layer of NTM (companies, total supply, market cap, price) is derived from the public dataset manifest:

- Manifest URL: `https://netmeios.com/llms.json`
- `companiescount` exposed by `ntm-trust.php` is computed from the number of datasets/entities in this manifest.
- The `ai-sealer.php` script reads `llms.json` to include `companiescount` and related economic fields inside each block’s JSON.

An external auditor can therefore:

- Fetch `llms.json`, count the entries, and confirm that this matches the `companiescount` in `ntm-trust.php` and in the most recent block.
- Confirm that changes in the manifest are reflected consistently in subsequent blocks.

## 7. Example verifier (pseudo-code)

```text
trust  = GET("https://netmeios.com/ntm-trust.php")
index  = GET("https://netmeios.com/api-blocks.php")
chain  = index.blocks

sort(chain)  # by block identifier / creation order

if len(chain) != trust.summary.blocks_generated:
    FAIL("count mismatch")

previous_json_hash = null

for i, entry in enumerate(chain):
    block_id = entry.hash        # e.g. 20260308_075001
    prev_hash = entry.prev_hash  # SHA256 of previous block JSON

    # 1. Fetch raw JSON for this block
    url      = "https://netmeios.com/blockchain/blocks/block_" + block_id + ".json"
    raw_json = GET(url).body

    # 2. Compute hash of this block's JSON
    current_hash = SHA256(raw_json)

    # 3. Check linkage from previous block
    if i > 0:
        if prev_hash != previous_json_hash:
            FAIL("chain linkage broken at block " + block_id)

    # 4. Store hash for next iteration
    previous_json_hash = current_hash

# Optional: compare with latest_block.prev_hash or other anchor from trust
# Example:
# if trust.latest_block.prev_hash != previous_json_hash:
#     FAIL("latest prev_hash mismatch with public summary")

OK("NTM chain verified successfully")