Check the receipt.
Verify signatures, content hashes, and names in your browser. Choose any bridge.
① Verify computerun · then your browser checks the receipt
The default capsule adds 1 to each byte, so hello becomes ifmmp.
Your browser re-derives the signed bytes, checks the provider's ed25519 signature, and binds the output and your input to their CIDs.
② Inspect contentfetch by CID · your browser re-hashes it
③ Verify a nameresolve @key/name · check the author's signature
A name → content binding is a signed record. Your browser checks the author actually signed it (the Nostr model) — the bridge can map a name to content, but cannot forge whose name it is.
④ The meshmeasured by the bridge · not cryptographically verified
Verified in your browser: the ed25519 signature, the BLAKE3 content-ids,
the name → value binding, and that a receipt is for your input. Still trusted: liveness, completeness of
listings, RTT/metadata (self-reported), the bridge's re-run verdict, the capsule_cid, whether a record is the highest
seq, and that ed25519 binds a key, not a person.