Metadata-Version: 2.4
Name: aqta-verify-receipt
Version: 1.0.4
Summary: Offline CLI and library for Seal ATTESTATION-v1 receipts. Ed25519 check of a signed model call; no account, no Aqta server required.
Author: Aqta Technologies Ltd
License: Apache-2.0
Project-URL: Homepage, https://aqta.ai/verify
Project-URL: Repository, https://github.com/Aqta-ai/attestation-spec
Project-URL: Documentation, https://github.com/Aqta-ai/attestation-spec/blob/main/spec/ATTESTATION-v1.md
Project-URL: Issues, https://github.com/Aqta-ai/attestation-spec/issues
Project-URL: Public Key, https://api.aqta.ai/v1/attestation/public-key
Keywords: seal,aqta,attestation-v1,ed25519,offline-verification,ai-receipts,model-call,tamper-evident,cli
Classifier: Development Status :: 5 - Production/Stable
Classifier: Intended Audience :: Developers
Classifier: Intended Audience :: Legal Industry
Classifier: License :: OSI Approved :: Apache Software License
Classifier: Programming Language :: Python :: 3
Classifier: Programming Language :: Python :: 3.9
Classifier: Programming Language :: Python :: 3.10
Classifier: Programming Language :: Python :: 3.11
Classifier: Programming Language :: Python :: 3.12
Classifier: Topic :: Security :: Cryptography
Requires-Python: >=3.9
Description-Content-Type: text/markdown
License-File: LICENSE
Requires-Dist: cryptography>=42.0.0
Dynamic: license-file

# aqta-verify-receipt

[![PyPI](https://img.shields.io/pypi/v/aqta-verify-receipt.svg)](https://pypi.org/project/aqta-verify-receipt/)
[![npm](https://img.shields.io/npm/v/aqta-verify-receipt.svg)](https://www.npmjs.com/package/aqta-verify-receipt)
[![Licence](https://img.shields.io/badge/licence-Apache--2.0-blue.svg)](LICENSE)

Offline verifier for **Seal** receipts ([ATTESTATION-v1](https://github.com/Aqta-ai/attestation-spec/blob/main/spec/ATTESTATION-v1.md)).

Seal signs the model call at runtime. This package checks that signature
without contacting Aqta. No account. Same algorithm as the npm package.

## 30-second check

```bash
pip install aqta-verify-receipt
aqta-verify-receipt receipt.json \
  --key gUoUhIvptKAoLTnry3VrDtOQEWggGQveLrHFVrfNqmE
```

Or pipe:

```bash
curl -sS https://api.aqta.ai/r/YOUR_RECEIPT_ID | aqta-verify-receipt - \
  --key gUoUhIvptKAoLTnry3VrDtOQEWggGQveLrHFVrfNqmE
```

`ok` + exit `0` means the Ed25519 signature verifies against the pinned key.
Production key id: `aqta-att-0a18c7c16bc18a12`
([`/v1/attestation/public-key`](https://api.aqta.ai/v1/attestation/public-key)).

Pin that string. Do not re-fetch it inside a verify loop.

## Library

```python
from aqta_verify_receipt import verify_receipt, fetch_published_public_key

# Once per environment: fetch, then pin somewhere you control.
trusted = fetch_published_public_key()

result = verify_receipt(receipt, trusted_public_key=trusted)
if not result.valid:
    raise ValueError(result.reason)
```

## CLI

```
aqta-verify-receipt <file|-> --key <base64url> [--no-strict] [-q]
aqta-verify-receipt <file|-> --integrity-only [--no-strict] [-q]
```

Pinning is required by default. Without `--key`, pass `--integrity-only`
(embedded key only; anyone can self-sign; result is marked untrusted).

## Dependencies

`cryptography` (>= 42) for constant-time Ed25519. Nothing else.

## What this is not

Not a governance dashboard. Not a cost router. A small verifier for one
signed model-call receipt.

## Licence

Apache-2.0. Aqta Technologies Limited.
