Whose Bytes Were Hashed? An Audit Checklist for AI Verifiability Claims, with a DEUSPROOF Case

Services that advertise "verifiable AI output" do not always say which bytes are actually covered. This note turns that question into a six-item checklist - external anchoring, content hashing and its published normalization rules, score reproducibility, identity custody, governance records, and data retention - and permits only three verdicts: reproducible, not reproducible, or inconsistent with the published figure. One case is examined: certificate 46c2ac75 (DEUSPROOF). Its ledger entry can be recomputed by anyone from the published preimage (SHA-256 = a29dc96f...), while the certificate output_hash cannot: the signed text was removed from the record on 20 October 2026 (a public field, content_removed_at), so the same published rule applied to the text the platform API returns today yields 54463ae5... rather than 9bfdd072.... Both halves are reported together. The sample covers a single service at a single point in time, and two checklist items rest only on the written statements of the operator.