Verifying an RCO record

• verify() — TypeScript, Python and Go reference implementations under MIT: github.com/allooloo/rco-records. Recompute hash and id, check sig against kid. A pure function.
• The key — /.well-known/jwks.json. Signing kid rco-allooloo-2026-10; the historical kids stay so every earlier receipt still verifies.
• The chain tip — RCO Anchor: after each nightly chain check passes, the day's tip (seq, id, hash, time, signature) is written as an anchor file and its sha256 is timestamped on the public OpenTimestamps calendars, outside Allooloo's infrastructure. The anchor file and its timestamp proofs are given to a firm or its auditor on request. Walk the firm's receipts forward from a verified receipt to an anchored tip: every prev_hash is the hash before it.
• The firm's export — each night, the day's receipts for the firm's customer key land in the firm's own bucket as JSON Lines, with a manifest signed by Allooloo: key id, day, first seq, last seq, day tip, the sha256 of the file. The firm holds it; Allooloo cannot change it after the fact.
• The statement — monthly, and on demand: the period, the count, first and last seq, a digest over the slice's receipt hashes in seq order, the chain tip at issue, signed by Allooloo. Recompute the digest from the export and check the signature with verify()'s key.
• Read access — a firm can issue its auditor a read-only sub-key on its own slice (issue_auditor_key); the sub-key can list the slice and pull statements, nothing else.

{ "type": "rco-statement", "v": 1, "issuer": "Allooloo Technologies Corp.", "key_id": "k…", "caller": "sha256:…",
  "period": { "from": "2026-10-01", "to": "2026-11-01" },
  "receipts": { "count": …, "first_seq": …, "last_seq": …, "first_id": "rco:…", "last_id": "rco:…", "slice_digest": "sha256:…" },
  "chain_tip_at_issue": { "seq": …, "hash": "sha256:…" }, "issued_at": "…", "kid": "rco-allooloo-2026-10",
  "id": "rcs:…", "hash": "sha256:…", "sig": "…" }