Tools for subscribers, beyond the three-wheel kit. Every one left the estate through the same gate as the kit itself: scanned for anything that must not ship, signed over its exact bytes by the build signer, and re-verified by this service before it is listed. The catalogue, the signatures and the manifests are public. The bytes need a credential.
.f8sig sidecar — an F8AID resource attestation chaining to the F8Sec tenant CA.F8Sec-Install-Token, from register.f8sec.net) or a fleet token. Every serve carries a signed bundle envelope bound to you.f8koach verify-artifact <file> checks the sidecar's chain to the F8Sec tenant CA, the release signer and the digest — or plain sha256sum against the manifest. The seal at the bottom-right verifies this page itself in your browser.curl -H "F8Sec-Install-Token: $TOKEN" -O https://toolbox.j0l1.com/v1/tools/<slug>/<version>/<file> curl -O https://toolbox.j0l1.com/v1/tools/<slug>/<version>/<file>.manifest.json curl -O https://toolbox.j0l1.com/v1/tools/<slug>/<version>/<file>.f8sig sha256sum <file> # must equal "digest" in the manifest f8koach verify-artifact <file> # sidecar chain → F8Sec tenant CA, release signer, digest