# Public Reseals & Redacted Verification

URL: https://docs.nexart.io/docs/public-reseals-and-redacted-verification

A reseal is a new public artifact, not the original record. It is independently signed and does not weaken the original's integrity.

##### Reseal in one sentence

A reseal is a new, independently signed CER covering a redacted view of an original execution. It has its own certificateHash, its own node signature, and a provenance pointer back to the original. The original record remains valid for any holder.

## Why reseals exist

Original CERs often contain content the publisher cannot expose publicly: raw prompts, customer data, internal tool calls. The public verifier cannot show that content. Instead, it returns a redacted reseal: a new bundle that covers only what is safe to publish, signed by the node.

This preserves three properties at once: the original record stays intact and locally verifiable, the public artifact is independently verifiable, and sensitive content never appears in the public surface.

## Reseal artifact shape

```
{
  "bundleType": "signed-redacted-reseal",
  "certificateHash": "sha256:<NEW_RESEALED_HASH>",
  "provenance": {
    "originalCertificateHash": "sha256:<ORIGINAL_HASH>",
    "reason": "public-redaction"
  },
  "receipt": {
    "alg": "Ed25519",
    "kid": "node-key-2026-01",
    "sig": "base64..."
  }
}
```

## Requested hash vs returned public hash

- Requested hash: the hash you put in the URL or query (often the original certificateHash).
- Returned public hash: the `certificateHash` of the artifact the verifier actually displays. For redacted resources, this is the resealed hash, not the original.
- These two hashes MAY differ. The verifier surfaces both, with their roles labelled. A difference is expected behavior, not a failure.

## What is being verified in the public verifier

- The public artifact's integrity: the resealed bundle's certificateHash, signature, and node receipt are cryptographically validated.
- The original certificateHash is preserved as a provenance pointer. The verifier does not re-verify the original bundle, because the original content is not present.
- Anyone who holds the original (unredacted) bundle can still verify it locally with `verifyCer()`.

## What provenance preserves

- The original certificateHash, so the reseal is traceable to its source.
- The reason for redaction (e.g. `"public-redaction"`).
- A clear bundleType (`signed-redacted-reseal`) so verifiers do not confuse it with an original.

## Supplemental signals

A reseal MAY carry supplemental `context.signals` that are not bound by the new certificateHash. This is reported as `VERIFIED (supplemental)` and is not a failure. See Verification Semantics.

## What this is NOT

- Not a failure of the original artifact. The original is still valid for any holder.
- Not a hash collision or re-signing of the original. It is a new artifact.
- Not a way to alter execution history. Reseals can only redact, not modify.

## Related

- Verification Semantics
- verify.nexart.io
- Verification Statuses & Errors
- Attestation Node