diff --git a/.gitignore b/.gitignore
index dad73ecbb..94e3db919 100644
--- a/.gitignore
+++ b/.gitignore
@@ -85,10 +85,8 @@ secrets.json
 
 # Artifacts that should never be tracked
 *.zip
-# ...except the public proof bundles the frontend serves. These are
-# intentionally tracked fixtures (the audit-bundle pair backs the public
-# /api/v1/proof/verify demo, including the deliberately tampered one), and
-# the bare *.zip rule above was silently covering them (#2873).
+# ...except any public bundles the frontend serves from these folders (#2873).
+# None are published at the moment.
 !frontend/public/proof/*.zip
 login_resp.json
 frontend/build_log.txt
diff --git a/frontend/public/proof/audit-bundle-tampered.zip b/frontend/public/proof/audit-bundle-tampered.zip
deleted file mode 100644
index 50e02e82f..000000000
Binary files a/frontend/public/proof/audit-bundle-tampered.zip and /dev/null differ
diff --git a/frontend/public/proof/audit-bundle.zip b/frontend/public/proof/audit-bundle.zip
deleted file mode 100644
index 062a233a6..000000000
Binary files a/frontend/public/proof/audit-bundle.zip and /dev/null differ
diff --git a/frontend/public/proof/epcis-sample.jsonld b/frontend/public/proof/epcis-sample.jsonld
deleted file mode 100644
index c107be48a..000000000
--- a/frontend/public/proof/epcis-sample.jsonld
+++ /dev/null
@@ -1,88 +0,0 @@
-{
-  "_comment": "SYNTHETIC — Sample EPCIS 2.0 JSON-LD payload for the RegEngine /proof page. Three Critical Tracking Events covering harvesting, initial packing, and shipping for a single lot of romaine lettuce. Modeled on services/ingestion/app/epcis/. Not a real grower, lot, or shipment.",
-  "@context": [
-    "https://ref.gs1.org/standards/epcis/2.0.0/epcis-context.jsonld",
-    {
-      "fsma": "urn:fsma:traceability:"
-    }
-  ],
-  "type": "EPCISDocument",
-  "schemaVersion": "2.0",
-  "creationDate": "2026-02-08T17:00:10Z",
-  "epcisBody": {
-    "eventList": [
-      {
-        "type": "ObjectEvent",
-        "eventTime": "2026-02-05T13:42:00Z",
-        "eventTimeZoneOffset": "-08:00",
-        "epcList": [
-          "urn:epc:id:sgtin:0614141.107346.SV-20240115-001"
-        ],
-        "action": "ADD",
-        "bizStep": "urn:fsma:traceability:harvesting",
-        "disposition": "urn:epcglobal:cbv:disp:active",
-        "readPoint": {
-          "id": "urn:epc:id:sgln:0614141.00001.0"
-        },
-        "bizLocation": {
-          "id": "urn:epc:id:sgln:0614141.00001.0"
-        },
-        "fsma:traceabilityLotCode": "SV-20240115-001",
-        "fsma:foodCommodity": "Romaine Lettuce, fresh-cut",
-        "fsma:harvestDate": "2026-02-05",
-        "fsma:growingArea": "Field 7B, Salinas Valley, CA"
-      },
-      {
-        "type": "ObjectEvent",
-        "eventTime": "2026-02-06T08:15:00Z",
-        "eventTimeZoneOffset": "-08:00",
-        "epcList": [
-          "urn:epc:id:sgtin:0614141.107346.SV-20240115-001"
-        ],
-        "action": "OBSERVE",
-        "bizStep": "urn:fsma:traceability:initial_packing",
-        "disposition": "urn:epcglobal:cbv:disp:in_progress",
-        "readPoint": {
-          "id": "urn:epc:id:sgln:0614141.00002.0"
-        },
-        "bizLocation": {
-          "id": "urn:epc:id:sgln:0614141.00002.0"
-        },
-        "fsma:traceabilityLotCode": "SV-20240115-001",
-        "fsma:packDate": "2026-02-06",
-        "fsma:packingFacility": "Salinas Valley Cooling & Pack, Salinas, CA",
-        "fsma:quantity": {
-          "value": 480,
-          "uom": "case"
-        }
-      },
-      {
-        "type": "ObjectEvent",
-        "eventTime": "2026-02-07T05:30:00Z",
-        "eventTimeZoneOffset": "-08:00",
-        "epcList": [
-          "urn:epc:id:sgtin:0614141.107346.SV-20240115-001"
-        ],
-        "action": "OBSERVE",
-        "bizStep": "urn:fsma:traceability:shipping",
-        "disposition": "urn:epcglobal:cbv:disp:in_transit",
-        "readPoint": {
-          "id": "urn:epc:id:sgln:0614141.00002.0"
-        },
-        "bizLocation": {
-          "id": "urn:epc:id:sgln:0614141.00002.0"
-        },
-        "destinationList": [
-          {
-            "type": "urn:epcglobal:cbv:sdt:location",
-            "destination": "urn:epc:id:sgln:0614141.00099.0"
-          }
-        ],
-        "fsma:traceabilityLotCode": "SV-20240115-001",
-        "fsma:shipDate": "2026-02-07",
-        "fsma:shipToEntity": "DC-099, Tracy, CA",
-        "fsma:carrier": "Reefer Logistics Inc."
-      }
-    ]
-  }
-}
diff --git a/frontend/public/proof/fsma-204-sample.csv b/frontend/public/proof/fsma-204-sample.csv
deleted file mode 100644
index daa15cd42..000000000
--- a/frontend/public/proof/fsma-204-sample.csv
+++ /dev/null
@@ -1,11 +0,0 @@
-Traceability Lot Code (TLC),Product Description,Quantity,Unit of Measure,Event Type,Event Date,Event Time,Facility Name,Facility GLN,Facility Address,Confidence Score
-SV-20240115-001,Romaine Lettuce,500,cases,SHIPPING,2024-01-15,14:00:00,Sunny Valley Farms,1234567890128,"123 Farm Road, Salinas CA",0.98
-SV-20240115-001,Romaine Lettuce,500,cases,RECEIVING,2024-01-16,08:00:00,Fresh Cut Co,2345678901234,"456 Processing Lane, Fresno CA",0.97
-FC-20240116-A,Chopped Romaine,250,cases,TRANSFORMATION,2024-01-16,10:00:00,Fresh Cut Co,2345678901234,"456 Processing Lane, Fresno CA",0.95
-FC-20240116-B,Romaine Hearts,250,cases,TRANSFORMATION,2024-01-16,11:00:00,Fresh Cut Co,2345678901234,"456 Processing Lane, Fresno CA",0.95
-FC-20240116-A,Chopped Romaine,100,cases,SHIPPING,2024-01-17,06:00:00,Fresh Cut Co,2345678901234,"456 Processing Lane, Fresno CA",0.96
-FC-20240116-A,Chopped Romaine,100,cases,RECEIVING,2024-01-17,10:00:00,Metro Foods,3456789012340,"789 Distribution Dr, Oakland CA",0.94
-FC-20240116-B,Romaine Hearts,150,cases,SHIPPING,2024-01-17,07:00:00,Fresh Cut Co,2345678901234,"456 Processing Lane, Fresno CA",0.96
-FC-20240116-B,Romaine Hearts,150,cases,RECEIVING,2024-01-17,11:00:00,Valley Wholesale,4567890123456,"321 Wholesale Ave, Stockton CA",0.93
-FC-20240116-A,Chopped Romaine,50,cases,SHIPPING,2024-01-18,05:00:00,Metro Foods,3456789012340,"789 Distribution Dr, Oakland CA",0.95
-FC-20240116-A,Chopped Romaine,50,cases,RECEIVING,2024-01-18,08:00:00,SuperMart #42,5678901234562,"100 Retail St, San Jose CA",0.92
diff --git a/frontend/public/sdk/verify_chain.py b/frontend/public/sdk/verify_chain.py
index 48bbf2ad7..5daf64d6c 100644
--- a/frontend/public/sdk/verify_chain.py
+++ b/frontend/public/sdk/verify_chain.py
@@ -17,7 +17,7 @@
     odd-node padding: duplicate the last node
 
 Usage:
-    python verify_chain.py audit-bundle.zip
+    python verify_chain.py your-bundle.zip
 
 Copyright (c) 2024-2026 RegEngine LLC
 License: Apache License 2.0 (https://www.apache.org/licenses/LICENSE-2.0) —
@@ -260,7 +260,7 @@ def verify_bundle(zip_path: str) -> int:
 
 def main() -> int:
     parser = argparse.ArgumentParser(description="Verify a RegEngine audit bundle (zip with manifest.json).")
-    parser.add_argument("bundle", help="Path to audit-bundle.zip")
+    parser.add_argument("bundle", help="Path to an exported audit bundle ZIP")
     args = parser.parse_args()
     return verify_bundle(args.bundle)
 
diff --git a/frontend/src/__tests__/pages/proof-no-sample.test.tsx b/frontend/src/__tests__/pages/proof-no-sample.test.tsx
new file mode 100644
index 000000000..93d36fa3a
--- /dev/null
+++ b/frontend/src/__tests__/pages/proof-no-sample.test.tsx
@@ -0,0 +1,19 @@
+import { render, screen } from '@testing-library/react';
+import { describe, expect, it } from 'vitest';
+import ProofPage from '@/app/proof/page';
+
+// /proof must not offer synthetic downloads or made-up hashes and sizes.
+describe('/proof without sample data', () => {
+    it('shows an empty state and no artifact downloads', () => {
+        const { container } = render(<ProofPage />);
+        const text = container.textContent ?? '';
+
+        expect(screen.getByText(/no public artifacts are published yet/i)).toBeInTheDocument();
+        expect(text).not.toMatch(/fsma-204-sample|epcis-sample|audit-bundle/i);
+        expect(text).not.toMatch(/\b[0-9a-f]{12,}\b/i);
+        expect(container.querySelector('a[download]:not([href="/sdk/verify_chain.py"])')).toBeNull();
+        expect(container.querySelector('a[href="/sdk/verify_chain.py"][download]')).not.toBeNull();
+        expect(container.querySelector('a[href^="/proof/"]')).toBeNull();
+        expect(container.querySelector('a[href="/verify"]')).not.toBeNull();
+    });
+});
diff --git a/frontend/src/app/docs/page.tsx b/frontend/src/app/docs/page.tsx
index 89c851785..861cb3955 100644
--- a/frontend/src/app/docs/page.tsx
+++ b/frontend/src/app/docs/page.tsx
@@ -305,7 +305,7 @@ export default function DocsHomePage() {
         <footer className="flex flex-col items-start justify-between gap-4 border-t border-re-border-subtle pt-8 sm:flex-row sm:items-center">
           <div className="flex flex-wrap items-center gap-4">
             <code className="rounded-md border border-re-border-subtle bg-re-surface-inset px-4 py-2 font-mono text-[0.8125rem] text-re-text-secondary">
-              python verify_chain.py audit-bundle.zip
+              python verify_chain.py your-bundle.zip
             </code>
             <span className="text-ui text-re-text-tertiary">
               Don&apos;t trust, verify.
diff --git a/frontend/src/app/proof/page.tsx b/frontend/src/app/proof/page.tsx
index d6ef18bcc..4572178bb 100644
--- a/frontend/src/app/proof/page.tsx
+++ b/frontend/src/app/proof/page.tsx
@@ -1,250 +1,66 @@
 import type { Metadata } from "next";
 import Link from "next/link";
-import { ArrowRight, Download, FileJson, FileSpreadsheet, Hash, Terminal } from "lucide-react";
+import { Archive, Terminal } from "lucide-react";
 import { Container } from "@/components/layout/container";
 import { PageHeader } from "@/components/layout/page-header";
 import { Section } from "@/components/layout/section";
 import { Button } from "@/components/ui/button";
-import { Card, CardHeader } from "@/components/ui/card";
+import { EmptyState } from "@/components/ui/empty-state";
 
 export const metadata: Metadata = {
     title: "Proof | RegEngine",
     description:
-        "Download three verifiable sample artifacts generated by production code (FSMA 204 sortable spreadsheet, EPCIS 2.0 JSON-LD export (Preview), and a Merkle-rooted audit bundle) without signing up.",
+        "No public proof artifacts are published yet. Verify an audit bundle exported from your own RegEngine workspace with the open-source verifier.",
     openGraph: {
-        title: "Verify RegEngine without signing up",
+        title: "Verify RegEngine bundles yourself",
         description:
-            "Three downloadable artifacts: FSMA 204 spreadsheet, EPCIS 2.0 JSON-LD (Preview), and a Merkle-rooted audit bundle.",
+            "No public proof artifacts are published yet. Use the open-source verifier on your own exported bundle.",
         url: "https://regengine.co/proof",
         type: "website",
     },
 };
 
-type Artifact = {
-    name: string;
-    href: string;
-    filename: string;
-    sizeBytes: number;
-    icon: typeof FileSpreadsheet;
-    summary: string;
-    why: string;
-    formatLabel: string;
-};
-
-const ARTIFACTS: Artifact[] = [
-    {
-        name: "FSMA 204 sortable spreadsheet",
-        href: "/proof/fsma-204-sample.csv",
-        filename: "fsma-204-sample.csv",
-        sizeBytes: 1524,
-        icon: FileSpreadsheet,
-        formatLabel: "CSV · sortable",
-        summary:
-            "A recall-lookback sample for one leafy-greens lot, exported in an FDA-oriented sortable layout.",
-        why: "FDA records requests may require records, including an electronic sortable spreadsheet under 21 CFR 1.1455(c)(3), unless an exemption or agreed alternative applies. This sample shows RegEngine's current column mapping and should be reviewed against the specific FDA request.",
-    },
-    {
-        name: "EPCIS 2.0 JSON-LD export (Preview)",
-        href: "/proof/epcis-sample.jsonld",
-        filename: "epcis-sample.jsonld",
-        sizeBytes: 3039,
-        icon: FileJson,
-        formatLabel: "EPCIS 2.0 JSON-LD (Preview)",
-        summary:
-            "A three-event payload covering harvesting, initial packing, and shipping for one traceability lot code.",
-        why: "Several major buyers are standardizing on EPCIS 2.0 for supplier ingest. Confirm that what RegEngine emits validates against your retailer's onboarding tests before you sign a contract.",
-    },
-    {
-        name: "Merkle-rooted audit bundle",
-        href: "/proof/audit-bundle.zip",
-        filename: "audit-bundle.zip",
-        sizeBytes: 2266,
-        icon: Hash,
-        formatLabel: "ZIP · SHA-256 + Merkle root",
-        summary:
-            "The CSV and EPCIS (Preview) payload plus a manifest.json with per-file SHA-256 hashes and a Merkle root computed by production code.",
-        why: "Compare each declared file's SHA-256 hash and the bundle's Merkle root with its included manifest. These checks establish internal consistency; they do not authenticate the issuer or establish that the source data is accurate.",
-    },
-];
-
-function formatSize(bytes: number): string {
-    if (bytes < 1024) return `${bytes} B`;
-    if (bytes < 1024 * 1024) return `${(bytes / 1024).toFixed(1)} KB`;
-    return `${(bytes / (1024 * 1024)).toFixed(2)} MB`;
-}
-
-/**
- * A terminal transcript. SPEC §5.1: code is a well - one surface step below the
- * card, bounded by a hairline rather than an inverted ink block. Result lines
- * keep a status colour, but never alone: each one carries its own word ("ok",
- * "matched", "FAILED"), so the meaning survives greyscale.
- */
-function Transcript({ title, meta, children }: { title: string; meta?: string; children: React.ReactNode }) {
-    return (
-        <Card className="flex flex-col overflow-hidden">
-            <CardHeader className="shrink-0 py-3">
-                <p className="font-mono text-label uppercase text-re-text-muted">{title}</p>
-                {meta && <p className="font-mono text-label uppercase text-re-text-muted">{meta}</p>}
-            </CardHeader>
-            <div className="flex-1 overflow-x-auto bg-re-surface-inset px-5 py-4 font-mono text-[0.8125rem] leading-6 text-re-text-secondary">
-                {children}
-            </div>
-        </Card>
-    );
-}
-
 export default function ProofPage() {
     return (
         <div className="re-page min-h-screen">
-            <Container className="grid gap-10 pb-14 pt-12 md:grid-cols-[0.85fr_1fr] md:pb-20 md:pt-16">
-                <div>
-                    <PageHeader
-                        size="hero"
-                        eyebrow={<span className="font-mono uppercase">Proof</span>}
-                        title="Verify RegEngine without signing up."
-                        description="Three artifacts. No email gate, no demo call. Download the files, open them in your tools, and check the hashes yourself. If the output does not match the claim, the product fails, and you have the receipts."
-                        className="mb-0 border-b-0 pb-0"
-                    />
-                    <div className="mt-8 flex flex-wrap gap-3">
-                        <Button asChild size="lg">
-                            <Link href="#artifacts">
-                                See the files <ArrowRight aria-hidden="true" strokeWidth={1.75} />
-                            </Link>
-                        </Button>
-                        <Button asChild variant="secondary" size="lg">
-                            <a href="/sdk/verify_chain.py" download>Get the verifier</a>
-                        </Button>
-                    </div>
-                </div>
-                <Transcript title="Verifier output">
-                    <p>$ unzip -p audit-bundle.zip manifest.json | jq .merkle.root</p>
-                    <p className="mt-3 break-all text-re-text-primary">&quot;a320428f40579ec9eaea1a640614d26649f2111a0cc6f6b379003d25278bb6d2&quot;</p>
-                    <p className="mt-3">$ python verify_chain.py audit-bundle.zip</p>
-                    <p className="mt-3 text-re-success">manifest: ok</p>
-                    <p className="text-re-success">files: 2 / 2 sha256 matches</p>
-                    <p className="text-re-success">merkle: root recomputed and matched</p>
-                    <p className="mt-3 text-re-text-primary">result: bundle intact</p>
-                </Transcript>
+            <Container className="pb-10 pt-12 md:pt-16">
+                <PageHeader
+                    size="hero"
+                    eyebrow={<span className="font-mono uppercase">Proof</span>}
+                    title="Verify RegEngine bundles yourself."
+                    description="RegEngine doesn't publish its own artifacts here. To check RegEngine's output, export an audit bundle from your own workspace and run the open-source verifier on it."
+                    className="mb-0 border-b-0 pb-0"
+                />
             </Container>
 
-            <Section
-                id="artifacts"
-                width="marketing"
-                eyebrow={<span className="font-mono uppercase">Downloads</span>}
-                title="Three artifacts. Open them in your own tools."
-            >
-                <div className="grid gap-5 md:grid-cols-3">
-                    {ARTIFACTS.map(({ name, href, filename, sizeBytes, icon: Icon, summary, why, formatLabel }) => (
-                        <article key={filename} className="h-full">
-                        <Card className="flex h-full flex-col p-6">
-                            <Icon className="mb-6 h-6 w-6 text-re-text-muted" strokeWidth={1.75} aria-hidden="true" />
-                            <h3 className="text-subheading text-re-text-primary">{name}</h3>
-                            <p className="mt-3 flex-1 text-ui text-re-text-secondary">{summary}</p>
-                            <dl className="mt-5 grid grid-cols-2 gap-3 border-t border-re-border-subtle pt-4">
-                                <div>
-                                    <dt className="font-mono text-label uppercase text-re-text-muted">Format</dt>
-                                    <dd className="mt-1 text-ui text-re-text-secondary">{formatLabel}</dd>
-                                </div>
-                                <div>
-                                    <dt className="font-mono text-label uppercase text-re-text-muted">Size</dt>
-                                    <dd className="mt-1 font-mono text-[0.8125rem] tabular-nums text-re-text-secondary">{formatSize(sizeBytes)}</dd>
-                                </div>
-                            </dl>
-                            <Button asChild variant="secondary" size="lg" className="mt-6 w-full">
-                                <a href={href} download={filename}>
-                                    <Download aria-hidden="true" strokeWidth={1.75} /> Download {filename}
-                                </a>
-                            </Button>
-                            <div className="mt-5 border-t border-re-border-subtle pt-4">
-                                <p className="font-mono text-label uppercase text-re-text-muted">Why this matters</p>
-                                <p className="mt-2 text-ui text-re-text-secondary">{why}</p>
-                            </div>
-                        </Card>
-                        </article>
-                    ))}
-                </div>
-            </Section>
-
-            <Section width="marketing">
-                <div className="grid gap-8 md:grid-cols-[0.75fr_1fr]">
-                    <div>
-                        <p className="mb-4 font-mono text-label uppercase text-re-text-muted">Run it yourself</p>
-                        <h2 className="font-display text-heading-lg text-re-text-primary">
-                            Inspect the Python verifier.
-                        </h2>
-                        <p className="mt-5 text-ui text-re-text-secondary">
-                            <code className="font-mono text-[0.8125rem]">verify_chain.py</code> reads the manifest, recomputes each declared file&apos;s SHA-256, and rebuilds the Merkle root using the same algorithm RegEngine ships in <code className="font-mono text-[0.8125rem]">services/shared/merkle_tree.py</code>. If those values disagree with the included manifest, the script exits non-zero.
-                        </p>
-                        <Button asChild variant="secondary" size="lg" className="mt-6">
-                            <a href="/sdk/verify_chain.py" download>
-                                <Terminal aria-hidden="true" strokeWidth={1.75} /> Open verify_chain.py
-                            </a>
+            <Section id="artifacts" width="marketing">
+                <EmptyState
+                    icon={Archive}
+                    title="No public artifacts are published yet."
+                    titleAs="h2"
+                    description="When real, reviewable artifacts are available they will be listed here. Until then, verify a bundle you exported yourself."
+                    action={
+                        <Button asChild variant="secondary">
+                            <Link href="/verify">Verify your own bundle</Link>
                         </Button>
-                    </div>
-                    <Transcript title="Three-step verify">
-                        <p className="text-re-text-tertiary"># 1. Download the bundle and the verifier</p>
-                        <p className="break-all">curl -O https://regengine.co/proof/audit-bundle.zip</p>
-                        <p className="break-all">curl -O https://regengine.co/sdk/verify_chain.py</p>
-                        <p className="mt-3 text-re-text-tertiary"># 2. Run it</p>
-                        <p>python verify_chain.py audit-bundle.zip</p>
-                        <p className="mt-3 text-re-text-tertiary"># 3. (Optional) Recompute the leaf yourself</p>
-                        <p>shasum -a 256 fsma-204-sample.csv</p>
-                    </Transcript>
-                </div>
+                    }
+                />
             </Section>
 
             <Section width="marketing">
-                <div className="grid gap-8 md:grid-cols-[0.75fr_1fr]">
-                    <div>
-                        <p className="mb-4 font-mono text-label uppercase text-re-text-muted">Watch it fail</p>
-                        <h2 className="font-display text-heading-lg text-re-text-primary">
-                            A tampered bundle is published next to the real one.
-                        </h2>
-                        <p className="mt-5 text-ui text-re-text-secondary">
-                            <code className="font-mono text-[0.8125rem]">audit-bundle-tampered.zip</code> contains a changed CSV while the manifest&apos;s declared hash remains unchanged. Run the verifier against it and watch it exit non-zero. This demonstrates detection of changed file bytes against an unchanged manifest; replacing both the file and manifest is outside this check.
-                        </p>
-                        <Button asChild variant="secondary" size="lg" className="mt-6">
-                            <a href="/proof/audit-bundle-tampered.zip" download>
-                                <Download aria-hidden="true" strokeWidth={1.75} /> Download audit-bundle-tampered.zip
-                            </a>
-                        </Button>
-                    </div>
-                    <Transcript title="Tampered output">
-                        <p>$ python verify_chain.py audit-bundle-tampered.zip</p>
-                        <p className="mt-3 text-re-success">manifest: ok</p>
-                        <p className="text-re-danger">verify: FAILED: fsma-204-sample.csv sha256 mismatch</p>
-                        <p className="text-re-danger">result: bundle TAMPERED</p>
-                        <p className="mt-3">$ echo $?</p>
-                        <p>1</p>
-                    </Transcript>
-                </div>
-            </Section>
-
-            <Section width="marketing" eyebrow={<span className="font-mono uppercase">Changelog</span>}>
-                <Card className="p-6">
-                    <p className="font-mono text-label uppercase text-re-text-secondary">2026-05-09: verifier mismatch found and fixed</p>
-                    <p className="mt-3 text-ui text-re-text-secondary">
-                        A reader running the recipe on this page got an argparse error instead of a verification. The verifier we&apos;d shipped didn&apos;t match the bundle we&apos;d shipped. The hashes were correct, but the script next to them read JSON, not the zip the page describes.
-                    </p>
-                    <p className="mt-3 text-ui text-re-text-secondary">
-                        Replaced with a verifier that opens the zip, recomputes every per-file SHA-256, and rebuilds the Merkle root using the same algorithm RegEngine ships in <code className="font-mono text-[0.8125rem]">services/shared/merkle_tree.py</code>. Added the EPCIS payload to <code className="font-mono text-[0.8125rem]">manifest.json</code>, added a <code className="font-mono text-[0.8125rem]">build</code> block (commit, generated_at, release), and published <code className="font-mono text-[0.8125rem]">audit-bundle-tampered.zip</code> so anyone can watch the new verifier fail closed.
-                    </p>
-                    <p className="mt-3 text-ui text-re-text-secondary">
-                        If you found the original bug before we did, thank you. That&apos;s the system working.
+                <div>
+                    <p className="mb-4 font-mono text-label uppercase text-re-text-muted">Run it yourself</p>
+                    <h2 className="font-display text-heading-lg text-re-text-primary">Inspect the Python verifier.</h2>
+                    <p className="mt-5 max-w-[68ch] text-ui text-re-text-secondary">
+                        <code className="font-mono text-[0.8125rem]">verify_chain.py</code> reads the manifest, recomputes each declared file&apos;s SHA-256, and rebuilds the Merkle root using the same algorithm RegEngine ships in <code className="font-mono text-[0.8125rem]">services/shared/merkle_tree.py</code>. If those values disagree with the included manifest, the script exits non-zero. These checks establish internal consistency; they do not authenticate the issuer or establish that the source data is accurate.
                     </p>
-                </Card>
+                    <Button asChild variant="secondary" size="lg" className="mt-6">
+                        <a href="/sdk/verify_chain.py" download>
+                            <Terminal aria-hidden="true" strokeWidth={1.75} /> Open verify_chain.py
+                        </a>
+                    </Button>
+                </div>
             </Section>
-
-            <div className="sticky bottom-0 z-[3] border-t border-re-border-subtle bg-re-surface-card/95 backdrop-blur">
-                <Container className="flex flex-wrap items-center justify-between gap-3 py-3 text-small text-re-text-tertiary">
-                    <span>
-                        All artifacts are synthetic. They are regenerated by production code on every release.
-                    </span>
-                    <code className="font-mono text-[0.8125rem] text-re-text-secondary">
-                        python verify_chain.py audit-bundle.zip
-                    </code>
-                </Container>
-            </div>
         </div>
     );
 }
diff --git a/frontend/src/app/verify/page.tsx b/frontend/src/app/verify/page.tsx
index e2a267d17..27dac191d 100644
--- a/frontend/src/app/verify/page.tsx
+++ b/frontend/src/app/verify/page.tsx
@@ -29,7 +29,7 @@ import { cn } from '@/lib/utils';
 
 const PROOF_VERIFY_ENDPOINT = '/api/ingestion/api/v1/proof/verify';
 
-const TERMINAL_OUTPUT = `$ python verify_chain.py audit-bundle.zip
+const TERMINAL_OUTPUT = `$ python verify_chain.py your-bundle.zip
 manifest: ok
 files: N / N sha256 matches
 merkle: root recomputed and matched
@@ -42,7 +42,7 @@ from pathlib import Path
 import subprocess
 import sys
 
-bundle = Path("audit-bundle.zip")
+bundle = Path("your-bundle.zip")
 result = subprocess.run(
     [sys.executable, "verify_chain.py", str(bundle)],
     check=False,
@@ -69,7 +69,7 @@ const INSTALL_STEPS = [
     },
     {
         title: 'Verify the bundle',
-        code: 'python verify_chain.py audit-bundle.zip',
+        code: 'python verify_chain.py your-bundle.zip',
         desc: 'Works entirely offline. No RegEngine account required.',
     },
 ];
diff --git a/scripts/build_audit_bundle.sh b/scripts/build_audit_bundle.sh
deleted file mode 100755
index 97f61042d..000000000
--- a/scripts/build_audit_bundle.sh
+++ /dev/null
@@ -1,94 +0,0 @@
-#!/usr/bin/env bash
-# Build the public /proof audit bundle ZIP.
-#
-# Packages:
-#   - fsma-204-sample.csv  (the FSMA 204 sortable sample)
-#   - manifest.json        (per-file SHA-256 + Merkle root over those leaves)
-#
-# Merkle algorithm matches services/shared/merkle_tree.py:
-#   leaf = sha256("leaf|" + sha256(file_bytes).hexdigest())
-#   node = sha256(left + "|" + right)
-#   odd-leaf-out: duplicate the last leaf (standard Merkle padding)
-#   single-leaf tree: root = leaf hash
-#
-# Usage:
-#   scripts/build_audit_bundle.sh
-#
-# Output: frontend/public/proof/audit-bundle.zip
-#
-# The companion sample-regenerator PR can invoke this to refresh the bundle
-# whenever the underlying CSV is regenerated from production code.
-
-set -euo pipefail
-
-ROOT="$(cd "$(dirname "$0")/.." && pwd)"
-PROOF_DIR="$ROOT/frontend/public/proof"
-CSV="$PROOF_DIR/fsma-204-sample.csv"
-OUT="$PROOF_DIR/audit-bundle.zip"
-
-if [[ ! -f "$CSV" ]]; then
-  echo "error: $CSV not found" >&2
-  exit 1
-fi
-
-WORK="$(mktemp -d)"
-trap 'rm -rf "$WORK"' EXIT
-
-cp "$CSV" "$WORK/fsma-204-sample.csv"
-
-python3 - "$WORK" <<'PY'
-import hashlib
-import json
-import sys
-from pathlib import Path
-
-work = Path(sys.argv[1])
-csv_path = work / "fsma-204-sample.csv"
-
-def sha256_hex(data: bytes) -> str:
-    return hashlib.sha256(data).hexdigest()
-
-def hash_leaf(event_hash: str) -> str:
-    return hashlib.sha256(f"leaf|{event_hash}".encode("utf-8")).hexdigest()
-
-def hash_pair(left: str, right: str) -> str:
-    return hashlib.sha256(f"{left}|{right}".encode("utf-8")).hexdigest()
-
-def merkle_root(hashes: list[str]) -> str:
-    if not hashes:
-        return hashlib.sha256(b"empty").hexdigest()
-    layer = [hash_leaf(h) for h in hashes]
-    if len(layer) == 1:
-        return layer[0]
-    while len(layer) > 1:
-        if len(layer) % 2 == 1:
-            layer.append(layer[-1])
-        layer = [hash_pair(layer[i], layer[i + 1]) for i in range(0, len(layer), 2)]
-    return layer[0]
-
-csv_bytes = csv_path.read_bytes()
-csv_hash = sha256_hex(csv_bytes)
-
-files = [{"path": "fsma-204-sample.csv", "size": len(csv_bytes), "sha256": csv_hash}]
-root = merkle_root([csv_hash])
-
-manifest = {
-    "_comment": "SYNTHETIC — RegEngine /proof audit bundle. Hashes are real; data is not.",
-    "version": "1.0",
-    "merkle": {
-        "algorithm": "sha256",
-        "leaf_prefix": "leaf|",
-        "node_separator": "|",
-        "padding": "duplicate-last",
-        "leaves": [csv_hash],
-        "root": root,
-    },
-    "files": files,
-    "verifier": "frontend/public/sdk/verify_chain.py",
-}
-(work / "manifest.json").write_text(json.dumps(manifest, indent=2) + "\n")
-print(f"merkle_root={root}")
-PY
-
-(cd "$WORK" && zip -q -X "$OUT" fsma-204-sample.csv manifest.json)
-echo "wrote $OUT"
diff --git a/scripts/copy-lint/baseline.json b/scripts/copy-lint/baseline.json
index 224e3d54c..d155391f2 100644
--- a/scripts/copy-lint/baseline.json
+++ b/scripts/copy-lint/baseline.json
@@ -96,10 +96,6 @@
   "frontend/src/app/product/page.tsx": {
     "sandbox": 2
   },
-  "frontend/src/app/proof/page.tsx": {
-    "epcis-unlabeled": 2,
-    "sample-demo": 5
-  },
   "frontend/src/app/records/page.tsx": {
     "dash-placeholder": 3,
     "empty-render": 1,
diff --git a/services/ingestion/tests/test_proof_verify_router.py b/services/ingestion/tests/test_proof_verify_router.py
index 4b23bb3b6..0e760c9f8 100644
--- a/services/ingestion/tests/test_proof_verify_router.py
+++ b/services/ingestion/tests/test_proof_verify_router.py
@@ -574,32 +574,35 @@ def test_unsupported_content_type_rejected(self, client: TestClient):
 # ---------------------------------------------------------------------------
 # Happy path — round-trip a real ZIP
 # ---------------------------------------------------------------------------
-class TestZipRoundTrip:
-    def test_checked_in_public_audit_bundle_verifies(self, client: TestClient):
-        """The ZIP linked from /proof must verify through the public API."""
-        bundle = (REPO_ROOT / "frontend/public/proof/audit-bundle.zip").read_bytes()
+def _sdk_merkle_root(file_hashes: list[str]) -> str:
+    sdk = runpy.run_path(str(REPO_ROOT / "frontend/public/sdk/verify_chain.py"))
+    return sdk["_merkle_root"](file_hashes)
 
-        resp = client.post(
-            "/api/v1/proof/verify",
-            files={"bundle": ("audit-bundle.zip", bundle, "application/zip")},
-        )
 
-        assert resp.status_code == 200, resp.text
-        data = resp.json()
-        assert data["verified"] is True, data
-        names = {c["name"]: c for c in data["checks"]}
-        assert names["manifest_files_present"]["passed"] is True
-        assert names["file_hashes_match_manifest"]["passed"] is True
-        assert names["merkle_root_matches_declared"]["passed"] is True
-        assert len(data["merkle_root_recomputed"]) == 64
+def _make_generic_files_bundle() -> bytes:
+    """Build a files[]/merkle-style bundle in-test (no checked-in fixture)."""
+    payload = b"generic-bundle-test-file\n"
+    file_hash = hashlib.sha256(payload).hexdigest()
+    manifest = {
+        "version": "1.0",
+        "files": [{"path": "evidence.txt", "size": len(payload), "sha256": file_hash}],
+        "merkle": {"leaves": [file_hash], "root": _sdk_merkle_root([file_hash])},
+    }
+    buf = io.BytesIO()
+    with zipfile.ZipFile(buf, "w", zipfile.ZIP_DEFLATED) as zf:
+        zf.writestr("manifest.json", json.dumps(manifest))
+        zf.writestr("evidence.txt", payload)
+    return buf.getvalue()
+
 
+class TestZipRoundTrip:
     def test_generic_bundle_may_use_unrelated_verification_metadata(
         self,
         client: TestClient,
         tmp_path: Path,
     ):
         """Only FDA markers activate persisted-chain status semantics."""
-        original = (REPO_ROOT / "frontend/public/proof/audit-bundle.zip").read_bytes()
+        original = _make_generic_files_bundle()
         modified = io.BytesIO()
         with zipfile.ZipFile(io.BytesIO(original), "r") as source:
             with zipfile.ZipFile(modified, "w", zipfile.ZIP_DEFLATED) as target:
@@ -624,21 +627,6 @@ def test_generic_bundle_may_use_unrelated_verification_metadata(
         bundle_path.write_bytes(bundle)
         assert sdk_verify_bundle(str(bundle_path)) == 0
 
-    def test_checked_in_tampered_public_audit_bundle_fails(self, client: TestClient):
-        """The tampered ZIP linked from /proof must fail verification."""
-        bundle = (REPO_ROOT / "frontend/public/proof/audit-bundle-tampered.zip").read_bytes()
-
-        resp = client.post(
-            "/api/v1/proof/verify",
-            files={"bundle": ("audit-bundle-tampered.zip", bundle, "application/zip")},
-        )
-
-        assert resp.status_code == 200, resp.text
-        data = resp.json()
-        assert data["verified"] is False, data
-        names = {c["name"]: c for c in data["checks"]}
-        assert names["file_hashes_match_manifest"]["passed"] is False
-
     def test_zip_bundle_verified_end_to_end(self, client: TestClient):
         hashes = _make_event_hashes(8)
         root = MerkleTree(hashes).root