Delete Bonis Systems today. The receipts still prove themselves in 2075.

A self-contained Docker bundle for federal air-gap demonstration. Includes the zero-dep verifier, a Dockerfile and docker-compose, a snapshot of the OFAC Specially Designated Nationals list (18,772 records, 5.48 MB), the FAR 889 covered-entity list, and a current Bitcoin chain tip. Builds on any machine with Docker; runs without internet. Intended for SCIF / federal-evaluator review where outbound network is not available.

curl -fsSL https://bonissystems.com/legal-kit/bonis-airgap-docker-bundle.zip -o bundle.zip
unzip bundle.zip && cd air-gap
docker compose up --build

curl -fsSL https://bonissystems.com/legal-kit/bonis-verify.mjs -o bonis-verify.mjs
node bonis-verify.mjs --help

No npm install. No node_modules. No package manifest. The script uses only Node.js standard library modules (crypto, https, fs).

A reproducible Knox record bundle with a real 4-leaf Merkle tree, a valid inclusion proof, and a canonical event hash. Download the JSON, feed it to --record, watch all four steps pass with zero network calls. Then download the generator to confirm the bundle is not a magic fixture — every hash is recomputable from the declared inputs using only Node's stdlib SHA-256.

# Fetch the verifier + the sample bundle
curl -fsSL https://bonissystems.com/legal-kit/bonis-verify.mjs -o bonis-verify.mjs
curl -fsSL https://bonissystems.com/legal-kit/sample-record.json -o sample-record.json

# Air-gapped verification — disconnect your network and run:
node bonis-verify.mjs --record sample-record.json
# → [PASS] event-hash · [PASS] chain-continuity · [PASS] merkle-inclusion · [PASS] OTS-delegation

# Optional: regenerate the bundle and compare byte-for-byte
curl -fsSL https://bonissystems.com/legal-kit/generate-sample-record.mjs -o gen.mjs
node gen.mjs regenerated.json
shasum -a 256 sample-record.json regenerated.json

1. Event-hash integrity. The declared payload hash is recomputed using the canonical Knox hashing function documented in the public TLA+ spec. Any alteration of the payload after sealing produces a different hash — detected.
2. Hash-chain linkage. The previous-hash field on each event is confirmed to be a well-formed SHA-256 digest. Full chain continuity is verifiable by requesting the surrounding event range.
3. Merkle inclusion. When a record bundle includes a Merkle inclusion proof, the script walks the proof from the leaf to the declared root and confirms the event is included.
4. Bitcoin-anchor delegation. The Merkle root is timestamped via OpenTimestamps and committed to a Bitcoin block. This script does not perform the Bitcoin-block check directly — it delegates to the OpenTimestamps client, which is maintained independently of Bonis Systems.

A reasonable concern when any compliance vendor is relied upon for record integrity:

"What happens if you disappear — acquired, bankrupt, out of business, under litigation hold, or just offline?"

The answer for Knox records is that nothing happens to the records. Every Knox record's integrity depends on:

• The SHA-256 cryptographic hash function (published 2001, part of the Node.js standard library).
• The Bitcoin blockchain (independent of Bonis Systems; thousands of node operators worldwide).
• The OpenTimestamps protocol (independent open-source client, independent calendar servers).
• This verifier script (under 12 KB, public, forkable, redistributable).

None of those depends on Bonis Systems being online, solvent, or in existence. This script is the tangible form of that guarantee — hand it to any skeptical engineer, lawyer, or auditor. They can prove the integrity of any Knox record without our cooperation.