Verify the model

Checking a receipt's signature proves the receipt is ours and untampered. It does not, by itself, prove the receipt is true: the model field is our signed claim, and no reseller can cryptographically prove which weights ran upstream. This page is the test that makes the claim falsifiable — you can check it yourself, against OpenAI directly, without trusting us.

The idea: logprobs are a fingerprint

Ask a model for one output token with logprobs: true, top_logprobs: 20 and you get its probability distribution over the next token — a direct readout of the weights. Two endpoints serving the same model produce nearly identical distributions on any prompt, differing only by small serving-stack noise (kernels, batching, numerics). A different model — even a close sibling — diverges by an order of magnitude more, on most prompts, in a way no gateway can mask. Academic work formalizes this as model equality testing: distinguishing same-weights from substituted-weights through an API is reliable with a few dozen probes.

Draftworks forwards logprobs and top_logprobs through to the upstream unmodified, and the logprobs in a response are part of the bytes covered by the receipt's response_sha256. That combination matters: to fake this test we would have to make a substitute model emit GPT-5.5's exact next-token distributions on prompts you choose — which is to say, run GPT-5.5 — and every faked response would be signed, permanent, per-request evidence against us.

Run the audit

The audit script is ~180 lines of Python with no dependencies outside the standard library. Read it before you run it; it is the whole method.

curl -O https://www.draftworks.dev/draftworks-audit.py

export OPENAI_API_KEY=sk-...          # baseline: OpenAI directly
export DRAFTWORKS_API_KEY=dw_live_... # the endpoint under test

python3 draftworks-audit.py

For each probe prompt it requests exactly one token from both endpoints (pinned snapshot, temperature: 0, reasoning_effort: "none") and compares the top-20 distributions:

[ 1/32] tv=0.0181  top1=match
[ 2/32] tv=0.0117  top1=match
[ 3/32] tv=0.0240  top1=match
...
probes=32 skipped=0
median total-variation distance: 0.0193
top-1 token agreement:           100.0%
signed receipts saved to:        audit-receipts.jsonl

VERDICT: CONSISTENT — fingerprints match the claimed model.

• Total variation distance is half the summed absolute difference between the two distributions over the union of reported tokens (mass outside each top-20 is treated as one residual bucket). Same weights land well under 0.10; a substituted model typically lands above 0.5.
• Top-1 agreement is whether both endpoints rank the same token first at temperature: 0.
• Every Draftworks response's signed receipt lands in audit-receipts.jsonl. If the verdict is ever INCONSISTENT, those receipts are the evidence — our signature on the claim, for each probe.
• A full run is 64 one-token requests; it costs a few cents on each side.

Use your own prompts

The built-in prompt set is published, which means a dishonest gateway could in principle special-case it. Defeat that with prompts only you know:

python3 draftworks-audit.py --prompts my-private-prompts.txt

One prompt per line. Fragments of your real production traffic are the strongest choice — special-casing arbitrary, private, production-shaped prompts requires answering them with the real model, which is the honest behavior the test exists to confirm.

Honest limits

• This is statistical, not cryptographic. Absolute per-request proof would require Azure signing its responses or attested (TEE) inference, and no provider offers either today. The test gives you a decision procedure with evidence, not a mathematical certificate.
• Expect small non-zero divergence. We serve through Azure's inference fleet and your baseline is OpenAI's; different serving stacks produce slightly different numerics on identical weights. The verdict thresholds account for this. If you have your own Azure OpenAI deployment, --baseline-url lets you run the strictest apples-to-apples comparison.
• Pin the snapshot. The script defaults to gpt-5.5-2026-04-24 on both sides. Comparing a floating alias against a pinned snapshot across providers can straddle a version boundary and produce honest mismatches.
• One probe proves that probe. The test establishes what the endpoint serves when tested. Continuous assurance comes from rerunning it — it's cheap, so schedule it — and from the fact that every production response you receive carries a signed receipt naming the model, retrievable forever at GET /v1/receipts/{id}.