Metadata-Version: 2.4
Name: psi-verifier
Version: 1.3.0
Summary: MIT-licensed verifier for the PSI-SEAL/1 canonical seal schema. Verification is free forever; enforcement is on by default, and since 1.3.0 rule R11 (Ed25519 over the ASCII seal_hash) is actually checked against caller-supplied public keys.
Author: APEX Infrastructure
License: MIT
Project-URL: Homepage, https://ai-governance-standard.com/license
Project-URL: Specification, https://ai-governance-standard.com/spec
Project-URL: Schema, https://ai-governance-standard.com/.well-known/psi-schema.json
Keywords: psi,apex,verification,ai-governance,eu-ai-act,sha256,merkle
Classifier: License :: OSI Approved :: MIT License
Classifier: Programming Language :: Python :: 3
Classifier: Topic :: Security :: Cryptography
Classifier: Intended Audience :: Developers
Requires-Python: >=3.8
Description-Content-Type: text/markdown
License-File: LICENSE
Provides-Extra: signature
Requires-Dist: cryptography>=41; extra == "signature"
Dynamic: license-file

# psi-verifier (Python)

> Apex PSI is not a tool and not a product. It is the verification substrate — the layer beneath proof. It does not judge. It does not certify. It only remembers.

**MIT. Free forever.** Verify any APEX PSI seal. Zero dependencies, Python 3.8+.

```python
from psi_verifier import verify, PsiSealInvalidError

try:
    result = verify(seal)          # enforce=True by default (v1.2.0)
except PsiSealInvalidError as e:
    print(e)                       # tells you exactly where to get a valid seal
```

## v1.2.0 — enforcement release with cross-language parity

`verify()` now **rejects** non-conformant seals instead of merely reporting them.
Invalid input raises `PsiSealInvalidError` with the canonical schema digest and a
fix URL. Report-only inspection remains available:

```python
from psi_verifier import verify_seal, is_conformant

verify(seal, enforce=False)   # legacy data only
verify_seal(seal)             # ConformanceResult, never raises
is_conformant(seal)           # bool
```

## What it checks

The PSI-SEAL/1 canonical schema, byte for byte: closed field set (R2/R3),
64-char lowercase hex SHA-256 (R4/R5), RFC 3339 UTC with exactly three
fractional digits (R6), exact octet length (R7), domain-separated leaf
`SHA-256("PSI1:" + hash)` and promoted-odd Merkle assembly (R8/R9),
`seal_hash = SHA-256(JCS(core envelope))` (R10), and matching `schema_digest` (R12).

## Licensing

- **This verifier: MIT.** Check seals forever, no cost, no permission.
- **The generator (sealing engine): proprietary.** Free for personal /
  non-commercial use; commercial sealing is licensed under PSI-05 royalty terms.
  Generate a conformant seal at <https://ai-governance-standard.com/seal>.

Schema: © 2026 APEX Infrastructure. Specification: <https://ai-governance-standard.com/spec>
