Metadata-Version: 2.4
Name: verigate-verify
Version: 0.1.0
Summary: Offline verifier for Verigate authority proofs: check a portable proof with only the issuer's public key.
Author: rudimentall1
License-Expression: MIT
Project-URL: Homepage, https://github.com/rudimentall1/verigate
Project-URL: Source, https://github.com/rudimentall1/verigate/tree/main/packaging/verigate-verify
Project-URL: Issues, https://github.com/rudimentall1/verigate/issues
Project-URL: Proof format, https://github.com/rudimentall1/verigate/blob/main/docs/verigate-authority-proof-v1.md
Project-URL: Threat model, https://github.com/rudimentall1/verigate/blob/main/docs/threat-model.md
Keywords: ai-agents,authorization,verification,ed25519,audit,x402
Classifier: Development Status :: 3 - Alpha
Classifier: Intended Audience :: Developers
Classifier: Programming Language :: Python :: 3
Classifier: Topic :: Security :: Cryptography
Requires-Python: >=3.9
Description-Content-Type: text/markdown
License-File: LICENSE
Requires-Dist: cryptography<51,>=48.0.1
Dynamic: license-file

# verigate-verify

Offline verifier for [Verigate](https://github.com/rudimentall1/verigate) authority proofs.

Verigate decides, per action, whether an AI agent had the authority to act, issues a one-time signed
authorization, and exports a portable proof. This package is the standalone verifier for that proof:
**you need only the proof file and the issuer's Ed25519 public key.** No Verigate server, database or API.

## Install

```bash
pip install verigate-verify
```

## Use

```bash
verigate-verify proof.json --public-key issuer.pub
verigate-verify proof.json --public-key issuer.pub --format json
# or
python -m verigate_verify proof.json --public-key issuer.pub
```

The result is `VALID` or `INVALID` with a reason (for example `proof package digest mismatch` if the
evidence was altered). Exit code is 0 for a valid proof and non-zero otherwise.

A sample proof and issuer key are in the repository under `examples/authority-proof/`.

## What it does and does not tell you

It checks the package digest, the evidence manifest, the issuer signature against the public key you trust,
the evidence graph and the authority protocol assertions. It does not decide whether the issuer's key is the
right one to trust (you must obtain the public key through a channel you trust), and it does not prove that no
other actions were taken. See the [threat model](https://github.com/rudimentall1/verigate/blob/main/docs/threat-model.md).

## Source

This is the same code as `tools/verigate_proof_verifier.py` in the main repository. MIT licensed.
