aer1-verify 0.1.0__tar.gz

aer1_verify-0.1.0/PKG-INFO

@@ -0,0 +1,133 @@
+Metadata-Version: 2.4
+Name: aer1-verify
+Version: 0.1.0
+Summary: Offline verifier for AER-1 verifiable execution receipts. No network, no trust in any server.
+License: MIT
+Keywords: aer-1,receipt,verification,ai-agents,audit
+Classifier: Programming Language :: Python :: 3
+Classifier: Topic :: Security
+Classifier: Topic :: Security :: Cryptography
+Requires-Python: >=3.9
+Description-Content-Type: text/markdown
+
+# aer1-verify
+
+Verify an AER-1 verifiable execution receipt **completely offline**. No network. No trust in any server, including ours.
+
+## Why this exists
+
+A verifiable receipt says: this AI did this work, and the record was not changed afterward. That claim should not require you to trust the company that issued it. `aer1-verify` rechecks the cryptography locally, from the receipt data alone. If the math holds, the receipt is intact. If it does not, the receipt is forged or corrupt.
+
+The honest boundary, stated plainly: this tool proves the recorded result **was not changed**. It does not prove the recorded result **is correct**. Integrity, not truth. That is what AER-1 receipts claim, and it is all this tool checks.
+
+## Install
+
+Single file, standard library only. No dependencies.
+
+```bash
+# Option 1: copy the file, nothing else needed
+curl -O https://gitlab.com/rambozambodotdev/zambo/-/raw/main/aer1-verifier/aer1_verify.py
+
+# Option 2: pip install
+pip install .
+```
+
+## Use
+
+Get a receipt as JSON. From zambo.dev, the verify endpoint returns one:
+
+```bash
+curl -s "https://zambo.dev/api/v2/receipt/<receipt-id>/verify" -o receipt.json
+```
+
+Then verify it offline (unplug your network if you want to prove the point):
+
+```bash
+python3 aer1_verify.py receipt.json
+```
+
+Output:
+
+```
+aer1-verify 0.1.0
+receipt: c5dadb0a-8f99-40f6-b30a-40852435b752
+  [PASS] input shape recognized (envelope.receipt)
+  [PASS] required fields present (id, canonical_bytes, output_hash)
+  [PASS] canonical_bytes is strict base64 -- 740 bytes
+  [PASS] decoded bytes are strict UTF-8 (fail closed)
+  [PASS] canonical_byte_length matches decoded length -- field=740 actual=740
+  [PASS] canonical JSON parses
+  [PASS] canonical form re-encodes byte-exactly
+  [PASS] output_hash is sha256: + 64 lowercase hex chars
+  [PASS] hash_algorithm agrees with sha256 -- got: 'sha256'
+  [PASS] sha256(canonical_bytes) equals output_hash
+  [PASS] created_at/timestamp is a real calendar date
+  [PASS] timestamp is not in the future
+  [PASS] verification_status (server claim, informational only) -- server said: 'verified'; offline verdict rests on the math above
+VERDICT: PASS: fingerprint matches, receipt intact
+```
+
+Machine-readable output for CI:
+
+```bash
+python3 aer1_verify.py receipt.json --json
+```
+
+Exit codes: `0` = PASS, `1` = FAIL, `2` = usage or input error.
+
+## What it checks
+
+1. **Required fields**: the receipt carries `id`, `canonical_bytes`, `output_hash`.
+2. **Strict base64**: the committed bytes decode cleanly, no leniency.
+3. **Strict UTF-8**: the bytes are valid UTF-8. Anything else fails closed.
+4. **Byte length agreement**: the declared length matches the decoded bytes.
+5. **Canonical round-trip**: the JSON re-encodes to byte-identical bytes (sorted keys, compact separators, UTF-8). The fingerprint covers exactly what you see; nothing hides outside it.
+6. **Fingerprint shape**: `output_hash` is `sha256:` plus 64 lowercase hex chars.
+7. **Algorithm agreement**: the declared hash algorithm is sha256.
+8. **The core check**: `SHA-256(canonical_bytes)` equals the committed `output_hash`. This is the whole proof.
+9. **Timestamp sanity**: the issue time is a real calendar date and not in the future.
+
+The server's `verification_status` field is **reported, never trusted**. An offline verifier checks math, not the issuer's word. That is the point.
+
+## Try breaking it
+
+```bash
+# Take a real receipt, change one character in the recorded result,
+# keep the old fingerprint, and watch verification fail:
+python3 - <<'EOF'
+import json, base64
+r = json.load(open('receipt.json'))['receipt']
+raw = base64.b64decode(r['canonical_bytes']).decode('utf-8')
+raw = raw.replace('164.00', '164.01', 1)  # one character
+r['canonical_bytes'] = base64.b64encode(raw.encode()).decode()
+r['canonical_byte_length'] = len(raw.encode())
+json.dump({'receipt': r}, open('forged.json', 'w'))
+EOF
+python3 aer1_verify.py forged.json   # -> VERDICT: FAIL
+```
+
+One character. The fingerprint no longer matches. That is the security property, demonstrated negatively.
+
+## Input shapes
+
+Liberal on input, strict on math. Accepts:
+
+- the bare receipt object (`canonical_bytes` / `output_hash` present),
+- the `{"receipt": {...}}` envelope from the zambo.dev verify endpoint,
+- the MCP `_receipt` shape returned with tool calls.
+
+## Tests
+
+```bash
+python3 tests/test_verifier.py
+```
+
+Fixtures include real receipts issued by zambo.dev plus adversarial mutations (tampered bytes, bad base64, wrong digest, non-UTF-8 bytes). The real-receipt fixtures must keep passing: they pin this tool to production.
+
+## Relation to AER-1
+
+AER-1 is the AI Agent Execution Receipt specification (IETF Internet-Draft `draft-zambo-aer1`). This verifier implements the receipt-integrity checks from the draft's canonicalization and fingerprint rules. It is a verifier, not an issuer: it cannot create receipts, only judge them.
+
+## License
+
+Same as the parent repository.

aer1_verify-0.1.0/README.md

@@ -0,0 +1,121 @@
+# aer1-verify
+
+Verify an AER-1 verifiable execution receipt **completely offline**. No network. No trust in any server, including ours.
+
+## Why this exists
+
+A verifiable receipt says: this AI did this work, and the record was not changed afterward. That claim should not require you to trust the company that issued it. `aer1-verify` rechecks the cryptography locally, from the receipt data alone. If the math holds, the receipt is intact. If it does not, the receipt is forged or corrupt.
+
+The honest boundary, stated plainly: this tool proves the recorded result **was not changed**. It does not prove the recorded result **is correct**. Integrity, not truth. That is what AER-1 receipts claim, and it is all this tool checks.
+
+## Install
+
+Single file, standard library only. No dependencies.
+
+```bash
+# Option 1: copy the file, nothing else needed
+curl -O https://gitlab.com/rambozambodotdev/zambo/-/raw/main/aer1-verifier/aer1_verify.py
+
+# Option 2: pip install
+pip install .
+```
+
+## Use
+
+Get a receipt as JSON. From zambo.dev, the verify endpoint returns one:
+
+```bash
+curl -s "https://zambo.dev/api/v2/receipt/<receipt-id>/verify" -o receipt.json
+```
+
+Then verify it offline (unplug your network if you want to prove the point):
+
+```bash
+python3 aer1_verify.py receipt.json
+```
+
+Output:
+
+```
+aer1-verify 0.1.0
+receipt: c5dadb0a-8f99-40f6-b30a-40852435b752
+  [PASS] input shape recognized (envelope.receipt)
+  [PASS] required fields present (id, canonical_bytes, output_hash)
+  [PASS] canonical_bytes is strict base64 -- 740 bytes
+  [PASS] decoded bytes are strict UTF-8 (fail closed)
+  [PASS] canonical_byte_length matches decoded length -- field=740 actual=740
+  [PASS] canonical JSON parses
+  [PASS] canonical form re-encodes byte-exactly
+  [PASS] output_hash is sha256: + 64 lowercase hex chars
+  [PASS] hash_algorithm agrees with sha256 -- got: 'sha256'
+  [PASS] sha256(canonical_bytes) equals output_hash
+  [PASS] created_at/timestamp is a real calendar date
+  [PASS] timestamp is not in the future
+  [PASS] verification_status (server claim, informational only) -- server said: 'verified'; offline verdict rests on the math above
+VERDICT: PASS: fingerprint matches, receipt intact
+```
+
+Machine-readable output for CI:
+
+```bash
+python3 aer1_verify.py receipt.json --json
+```
+
+Exit codes: `0` = PASS, `1` = FAIL, `2` = usage or input error.
+
+## What it checks
+
+1. **Required fields**: the receipt carries `id`, `canonical_bytes`, `output_hash`.
+2. **Strict base64**: the committed bytes decode cleanly, no leniency.
+3. **Strict UTF-8**: the bytes are valid UTF-8. Anything else fails closed.
+4. **Byte length agreement**: the declared length matches the decoded bytes.
+5. **Canonical round-trip**: the JSON re-encodes to byte-identical bytes (sorted keys, compact separators, UTF-8). The fingerprint covers exactly what you see; nothing hides outside it.
+6. **Fingerprint shape**: `output_hash` is `sha256:` plus 64 lowercase hex chars.
+7. **Algorithm agreement**: the declared hash algorithm is sha256.
+8. **The core check**: `SHA-256(canonical_bytes)` equals the committed `output_hash`. This is the whole proof.
+9. **Timestamp sanity**: the issue time is a real calendar date and not in the future.
+
+The server's `verification_status` field is **reported, never trusted**. An offline verifier checks math, not the issuer's word. That is the point.
+
+## Try breaking it
+
+```bash
+# Take a real receipt, change one character in the recorded result,
+# keep the old fingerprint, and watch verification fail:
+python3 - <<'EOF'
+import json, base64
+r = json.load(open('receipt.json'))['receipt']
+raw = base64.b64decode(r['canonical_bytes']).decode('utf-8')
+raw = raw.replace('164.00', '164.01', 1)  # one character
+r['canonical_bytes'] = base64.b64encode(raw.encode()).decode()
+r['canonical_byte_length'] = len(raw.encode())
+json.dump({'receipt': r}, open('forged.json', 'w'))
+EOF
+python3 aer1_verify.py forged.json   # -> VERDICT: FAIL
+```
+
+One character. The fingerprint no longer matches. That is the security property, demonstrated negatively.
+
+## Input shapes
+
+Liberal on input, strict on math. Accepts:
+
+- the bare receipt object (`canonical_bytes` / `output_hash` present),
+- the `{"receipt": {...}}` envelope from the zambo.dev verify endpoint,
+- the MCP `_receipt` shape returned with tool calls.
+
+## Tests
+
+```bash
+python3 tests/test_verifier.py
+```
+
+Fixtures include real receipts issued by zambo.dev plus adversarial mutations (tampered bytes, bad base64, wrong digest, non-UTF-8 bytes). The real-receipt fixtures must keep passing: they pin this tool to production.
+
+## Relation to AER-1
+
+AER-1 is the AI Agent Execution Receipt specification (IETF Internet-Draft `draft-zambo-aer1`). This verifier implements the receipt-integrity checks from the draft's canonicalization and fingerprint rules. It is a verifier, not an issuer: it cannot create receipts, only judge them.
+
+## License
+
+Same as the parent repository.

aer1_verify-0.1.0/aer1_verify.egg-info/PKG-INFO

@@ -0,0 +1,133 @@
+Metadata-Version: 2.4
+Name: aer1-verify
+Version: 0.1.0
+Summary: Offline verifier for AER-1 verifiable execution receipts. No network, no trust in any server.
+License: MIT
+Keywords: aer-1,receipt,verification,ai-agents,audit
+Classifier: Programming Language :: Python :: 3
+Classifier: Topic :: Security
+Classifier: Topic :: Security :: Cryptography
+Requires-Python: >=3.9
+Description-Content-Type: text/markdown
+
+# aer1-verify
+
+Verify an AER-1 verifiable execution receipt **completely offline**. No network. No trust in any server, including ours.
+
+## Why this exists
+
+A verifiable receipt says: this AI did this work, and the record was not changed afterward. That claim should not require you to trust the company that issued it. `aer1-verify` rechecks the cryptography locally, from the receipt data alone. If the math holds, the receipt is intact. If it does not, the receipt is forged or corrupt.
+
+The honest boundary, stated plainly: this tool proves the recorded result **was not changed**. It does not prove the recorded result **is correct**. Integrity, not truth. That is what AER-1 receipts claim, and it is all this tool checks.
+
+## Install
+
+Single file, standard library only. No dependencies.
+
+```bash
+# Option 1: copy the file, nothing else needed
+curl -O https://gitlab.com/rambozambodotdev/zambo/-/raw/main/aer1-verifier/aer1_verify.py
+
+# Option 2: pip install
+pip install .
+```
+
+## Use
+
+Get a receipt as JSON. From zambo.dev, the verify endpoint returns one:
+
+```bash
+curl -s "https://zambo.dev/api/v2/receipt/<receipt-id>/verify" -o receipt.json
+```
+
+Then verify it offline (unplug your network if you want to prove the point):
+
+```bash
+python3 aer1_verify.py receipt.json
+```
+
+Output:
+
+```
+aer1-verify 0.1.0
+receipt: c5dadb0a-8f99-40f6-b30a-40852435b752
+  [PASS] input shape recognized (envelope.receipt)
+  [PASS] required fields present (id, canonical_bytes, output_hash)
+  [PASS] canonical_bytes is strict base64 -- 740 bytes
+  [PASS] decoded bytes are strict UTF-8 (fail closed)
+  [PASS] canonical_byte_length matches decoded length -- field=740 actual=740
+  [PASS] canonical JSON parses
+  [PASS] canonical form re-encodes byte-exactly
+  [PASS] output_hash is sha256: + 64 lowercase hex chars
+  [PASS] hash_algorithm agrees with sha256 -- got: 'sha256'
+  [PASS] sha256(canonical_bytes) equals output_hash
+  [PASS] created_at/timestamp is a real calendar date
+  [PASS] timestamp is not in the future
+  [PASS] verification_status (server claim, informational only) -- server said: 'verified'; offline verdict rests on the math above
+VERDICT: PASS: fingerprint matches, receipt intact
+```
+
+Machine-readable output for CI:
+
+```bash
+python3 aer1_verify.py receipt.json --json
+```
+
+Exit codes: `0` = PASS, `1` = FAIL, `2` = usage or input error.
+
+## What it checks
+
+1. **Required fields**: the receipt carries `id`, `canonical_bytes`, `output_hash`.
+2. **Strict base64**: the committed bytes decode cleanly, no leniency.
+3. **Strict UTF-8**: the bytes are valid UTF-8. Anything else fails closed.
+4. **Byte length agreement**: the declared length matches the decoded bytes.
+5. **Canonical round-trip**: the JSON re-encodes to byte-identical bytes (sorted keys, compact separators, UTF-8). The fingerprint covers exactly what you see; nothing hides outside it.
+6. **Fingerprint shape**: `output_hash` is `sha256:` plus 64 lowercase hex chars.
+7. **Algorithm agreement**: the declared hash algorithm is sha256.
+8. **The core check**: `SHA-256(canonical_bytes)` equals the committed `output_hash`. This is the whole proof.
+9. **Timestamp sanity**: the issue time is a real calendar date and not in the future.
+
+The server's `verification_status` field is **reported, never trusted**. An offline verifier checks math, not the issuer's word. That is the point.
+
+## Try breaking it
+
+```bash
+# Take a real receipt, change one character in the recorded result,
+# keep the old fingerprint, and watch verification fail:
+python3 - <<'EOF'
+import json, base64
+r = json.load(open('receipt.json'))['receipt']
+raw = base64.b64decode(r['canonical_bytes']).decode('utf-8')
+raw = raw.replace('164.00', '164.01', 1)  # one character
+r['canonical_bytes'] = base64.b64encode(raw.encode()).decode()
+r['canonical_byte_length'] = len(raw.encode())
+json.dump({'receipt': r}, open('forged.json', 'w'))
+EOF
+python3 aer1_verify.py forged.json   # -> VERDICT: FAIL
+```
+
+One character. The fingerprint no longer matches. That is the security property, demonstrated negatively.
+
+## Input shapes
+
+Liberal on input, strict on math. Accepts:
+
+- the bare receipt object (`canonical_bytes` / `output_hash` present),
+- the `{"receipt": {...}}` envelope from the zambo.dev verify endpoint,
+- the MCP `_receipt` shape returned with tool calls.
+
+## Tests
+
+```bash
+python3 tests/test_verifier.py
+```
+
+Fixtures include real receipts issued by zambo.dev plus adversarial mutations (tampered bytes, bad base64, wrong digest, non-UTF-8 bytes). The real-receipt fixtures must keep passing: they pin this tool to production.
+
+## Relation to AER-1
+
+AER-1 is the AI Agent Execution Receipt specification (IETF Internet-Draft `draft-zambo-aer1`). This verifier implements the receipt-integrity checks from the draft's canonicalization and fingerprint rules. It is a verifier, not an issuer: it cannot create receipts, only judge them.
+
+## License
+
+Same as the parent repository.

aer1_verify-0.1.0/aer1_verify.egg-info/SOURCES.txt

@@ -0,0 +1,9 @@
+README.md
+aer1_verify.py
+pyproject.toml
+aer1_verify.egg-info/PKG-INFO
+aer1_verify.egg-info/SOURCES.txt
+aer1_verify.egg-info/dependency_links.txt
+aer1_verify.egg-info/entry_points.txt
+aer1_verify.egg-info/top_level.txt
+tests/test_verifier.py

aer1_verify-0.1.0/aer1_verify.egg-info/dependency_links.txt

@@ -0,0 +1 @@
+

aer1_verify-0.1.0/aer1_verify.egg-info/entry_points.txt

@@ -0,0 +1,2 @@
+[console_scripts]
+aer1-verify = aer1_verify:main

aer1_verify-0.1.0/aer1_verify.egg-info/top_level.txt

@@ -0,0 +1 @@
+aer1_verify

aer1_verify-0.1.0/aer1_verify.py

@@ -0,0 +1,267 @@
+#!/usr/bin/env python3
+"""aer1-verify: offline verifier for AER-1 verifiable execution receipts.
+
+Verifies a receipt's cryptographic fingerprint with zero network access and
+zero trust in any server. Single file, standard library only.
+
+What it proves: the receipt bytes hash to exactly the committed fingerprint,
+so the recorded result was not changed after issuance.
+
+What it does NOT prove: that the recorded result is correct. A verifiable
+receipt is proof of integrity, not proof of truth. That is the honest
+boundary of AER-1, and this tool enforces it by checking math, not meaning.
+
+Usage:
+    python3 aer1_verify.py receipt.json
+    python3 aer1_verify.py receipt.json --json     # machine-readable output
+    cat receipt.json | python3 aer1_verify.py -
+
+Exit codes: 0 = PASS, 1 = FAIL, 2 = usage/input error.
+
+Accepted input shapes (liberal on input, strict on math):
+    - the bare receipt object (has canonical_bytes / output_hash)
+    - {"receipt": {...}} envelope (zambo.dev verify endpoint shape)
+    - the MCP _receipt shape (has canonical_bytes / output_hash / timestamp)
+
+Checks performed:
+    1. required fields present (id, canonical_bytes, output_hash)
+    2. canonical_bytes is strict base64
+    3. decoded bytes are strict UTF-8 (fail closed)
+    4. canonical_byte_length matches decoded length (when present)
+    5. canonical JSON re-encodes byte-exactly (sorted keys, compact
+       separators, UTF-8): the fingerprint covers exactly what is shown
+    6. output_hash is well-formed (sha256: + 64 lowercase hex chars)
+    7. hash_algorithm agrees with sha256 (when present)
+    8. sha256(canonical_bytes) equals output_hash  <- the core check
+    9. created_at/timestamp is a real calendar date (when present)
+
+verification_status (the server's own claim) is reported, not trusted:
+an offline verifier checks the math, not the issuer's word.
+"""
+
+import sys
+import json
+import base64
+import binascii
+import hashlib
+import re
+from datetime import datetime, timezone
+
+VERSION = "0.1.0"
+
+HASH_RE = re.compile(r"^sha256:[0-9a-f]{64}$")
+B64_RE = re.compile(r"^[A-Za-z0-9+/]*={0,2}$")
+RFC3339_RE = re.compile(r"^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(\.\d+)?(Z|[+-]\d{2}:\d{2})$")
+
+
+def canonical_bytes_of(obj):
+    """AER-1 canonical form: sorted keys, compact separators, UTF-8."""
+    return json.dumps(obj, sort_keys=True, separators=(",", ":"),
+                      ensure_ascii=False).encode("utf-8")
+
+
+def unwrap_envelope(doc):
+    """Accept the verify-endpoint envelope, the bare receipt, or _receipt."""
+    if isinstance(doc, dict) and isinstance(doc.get("receipt"), dict):
+        return doc["receipt"], "envelope.receipt"
+    return doc, "bare"
+
+
+def check_calendar(ts):
+    """True only if ts is RFC 3339 shaped AND a real calendar date/time."""
+    if not isinstance(ts, str) or not RFC3339_RE.match(ts):
+        return False
+    try:
+        iso = ts.replace("Z", "+00:00")
+        dt = datetime.fromisoformat(iso)
+        # fromisoformat is lenient about some things; require tz awareness
+        # and a round-trip through a strict parse to fail closed.
+        if dt.tzinfo is None:
+            return False
+        return True
+    except ValueError:
+        return False
+
+
+def verify(receipt):
+    """Run every check. Returns (passed: bool, checks: list of dicts)."""
+    checks = []
+
+    def record(name, ok, detail=""):
+        checks.append({"check": name, "ok": bool(ok), "detail": detail})
+
+    # 0. unwrap + required fields
+    receipt, shape = unwrap_envelope(receipt)
+    if not isinstance(receipt, dict):
+        record("input is a JSON object", False, "top-level value is %s" % type(receipt).__name__)
+        return False, checks
+    record("input shape recognized (%s)" % shape, True)
+    missing = [k for k in ("id", "canonical_bytes", "output_hash") if k not in receipt]
+    record("required fields present (id, canonical_bytes, output_hash)",
+           not missing, "missing: %s" % ", ".join(missing) if missing else "")
+
+    raw = None
+    if missing:
+        return False, checks
+
+    # 1+2. strict base64, then strict UTF-8
+    cb = receipt["canonical_bytes"]
+    if not isinstance(cb, str) or not B64_RE.match(cb):
+        record("canonical_bytes is strict base64", False)
+    else:
+        try:
+            raw = base64.b64decode(cb, validate=True)
+        except (binascii.Error, ValueError):
+            record("canonical_bytes is strict base64", False)
+        else:
+            record("canonical_bytes is strict base64", True, "%d bytes" % len(raw))
+            try:
+                raw.decode("utf-8")
+            except UnicodeDecodeError:
+                record("decoded bytes are strict UTF-8 (fail closed)", False)
+                raw = None
+            else:
+                record("decoded bytes are strict UTF-8 (fail closed)", True)
+
+    # 3. byte length agreement
+    if raw is not None and "canonical_byte_length" in receipt:
+        want_len = receipt["canonical_byte_length"]
+        record("canonical_byte_length matches decoded length",
+               want_len == len(raw),
+               "field=%s actual=%d" % (want_len, len(raw)))
+    elif raw is not None:
+        record("canonical_byte_length matches decoded length", True,
+               "field absent, skipped")
+
+    # 4. canonical JSON round-trip: the fingerprint must cover exactly
+    #    what a re-parse shows. Any hidden or mis-encoded field fails here.
+    if raw is not None:
+        try:
+            obj = json.loads(raw.decode("utf-8"))
+        except (ValueError, UnicodeDecodeError):
+            record("canonical JSON parses", False)
+            obj = None
+        else:
+            record("canonical JSON parses", True)
+            try:
+                re_encoded = canonical_bytes_of(obj)
+            except (TypeError, ValueError):
+                record("canonical form re-encodes byte-exactly", False,
+                       "value not JSON-serializable")
+            else:
+                record("canonical form re-encodes byte-exactly",
+                       re_encoded == raw,
+                       "re-encoded %d bytes vs committed %d bytes"
+                       % (len(re_encoded), len(raw)) if re_encoded != raw else "")
+
+    # 5. output_hash shape
+    oh = receipt["output_hash"]
+    record("output_hash is sha256: + 64 lowercase hex chars",
+           isinstance(oh, str) and bool(HASH_RE.match(oh)),
+           "" if isinstance(oh, str) and HASH_RE.match(oh or "") else "got: %r" % (oh,))
+
+    # 6. hash algorithm agreement
+    algo = receipt.get("hash_algorithm")
+    if algo is None:
+        record("hash_algorithm agrees with sha256", True, "field absent, skipped")
+    else:
+        record("hash_algorithm agrees with sha256", algo == "sha256",
+               "got: %r" % (algo,))
+
+    # 7. THE core check
+    if raw is not None and isinstance(oh, str) and HASH_RE.match(oh):
+        want = "sha256:" + hashlib.sha256(raw).hexdigest()
+        record("sha256(canonical_bytes) equals output_hash",
+               oh == want,
+               "" if oh == want else "committed=%s recomputed=%s" % (oh, want))
+    else:
+        record("sha256(canonical_bytes) equals output_hash", False,
+               "skipped: earlier decode or format check failed")
+
+    # 8. timestamp sanity (informational strictness: a receipt from the
+    #    future or with an impossible date is suspicious)
+    ts = receipt.get("created_at", receipt.get("timestamp"))
+    if ts is None:
+        record("created_at/timestamp is a real calendar date", True,
+               "field absent, skipped")
+    else:
+        ok = check_calendar(ts)
+        record("created_at/timestamp is a real calendar date", ok,
+               "" if ok else "got: %r" % (ts,))
+        if ok:
+            try:
+                dt = datetime.fromisoformat(str(ts).replace("Z", "+00:00"))
+                if dt > datetime.now(timezone.utc):
+                    record("timestamp is not in the future", False,
+                           "got: %r" % (ts,))
+                else:
+                    record("timestamp is not in the future", True)
+            except ValueError:
+                record("timestamp is not in the future", False,
+                       "unparseable: %r" % (ts,))
+
+    # Server's own claim: reported, never trusted by an offline verifier.
+    status = receipt.get("verification_status")
+    checks.append({"check": "verification_status (server claim, informational only)",
+                   "ok": True,
+                   "detail": "server said: %r; offline verdict rests on the math above"
+                             % (status,)})
+
+    passed = all(c["ok"] for c in checks)
+    return passed, checks
+
+
+def main(argv=None):
+    if argv is None:
+        argv = sys.argv
+    args = [a for a in argv[1:] if a != "--json"]
+    as_json = "--json" in argv[1:]
+    if len(args) != 1:
+        print("usage: python3 aer1_verify.py receipt.json [--json]", file=sys.stderr)
+        print("       cat receipt.json | python3 aer1_verify.py -", file=sys.stderr)
+        return 2
+    src = args[0]
+    try:
+        if src == "-":
+            text = sys.stdin.read()
+        else:
+            with open(src, "r", encoding="utf-8") as f:
+                text = f.read()
+    except OSError as e:
+        print("error: cannot read %s: %s" % (src, e), file=sys.stderr)
+        return 2
+    try:
+        doc = json.loads(text)
+    except ValueError as e:
+        print("error: input is not valid JSON: %s" % e, file=sys.stderr)
+        return 2
+
+    passed, checks = verify(doc)
+    receipt_id = None
+    try:
+        r = doc.get("receipt", doc) if isinstance(doc, dict) else {}
+        receipt_id = r.get("id") if isinstance(r, dict) else None
+    except Exception:
+        receipt_id = None
+
+    if as_json:
+        print(json.dumps({"verdict": "PASS" if passed else "FAIL",
+                          "receipt_id": receipt_id,
+                          "checks": checks}, indent=2))
+    else:
+        print("aer1-verify %s" % VERSION)
+        print("receipt: %s" % (receipt_id or "(unknown id)"))
+        for c in checks:
+            mark = "PASS" if c["ok"] else "FAIL"
+            line = "  [%s] %s" % (mark, c["check"])
+            if c["detail"]:
+                line += " -- %s" % c["detail"]
+            print(line)
+        print("VERDICT: %s" % ("PASS: fingerprint matches, receipt intact"
+                               if passed else
+                               "FAIL: fingerprint does not match, do not trust this receipt"))
+    return 0 if passed else 1
+
+
+if __name__ == "__main__":
+    sys.exit(main(sys.argv))

aer1_verify-0.1.0/pyproject.toml

@@ -0,0 +1,23 @@
+[build-system]
+requires = ["setuptools>=61"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "aer1-verify"
+version = "0.1.0"
+description = "Offline verifier for AER-1 verifiable execution receipts. No network, no trust in any server."
+readme = "README.md"
+requires-python = ">=3.9"
+license = { text = "MIT" }
+keywords = ["aer-1", "receipt", "verification", "ai-agents", "audit"]
+classifiers = [
+    "Programming Language :: Python :: 3",
+    "Topic :: Security",
+    "Topic :: Security :: Cryptography",
+]
+
+[project.scripts]
+aer1-verify = "aer1_verify:main"
+
+[tool.setuptools]
+py-modules = ["aer1_verify"]

aer1_verify-0.1.0/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+

aer1_verify-0.1.0/tests/test_verifier.py

@@ -0,0 +1,81 @@
+"""Tests for aer1_verify.py. Run: python3 -m pytest tests/  (or python3 tests/test_verifier.py)
+
+Fixtures are real receipts issued by zambo.dev on 2026-10-06, plus
+adversarial mutations. The two PASS fixtures must keep passing: they pin
+the verifier to live production receipts.
+"""
+import json
+import os
+import subprocess
+import sys
+
+HERE = os.path.dirname(os.path.abspath(__file__))
+FIX = os.path.join(HERE, "fixtures")
+VERIFIER = os.path.join(HERE, "..", "aer1_verify.py")
+
+
+def run_verifier(fixture):
+    p = subprocess.run([sys.executable, VERIFIER, os.path.join(FIX, fixture), "--json"],
+                       capture_output=True, text=True)
+    return p.returncode, json.loads(p.stdout)
+
+
+def test_real_receipt_envelope_passes():
+    code, out = run_verifier("receipt-real-1.json")
+    assert code == 0, out
+    assert out["verdict"] == "PASS"
+    assert out["receipt_id"] == "c5dadb0a-8f99-40f6-b30a-40852435b752"
+    assert all(c["ok"] for c in out["checks"])
+
+
+def test_real_receipt_mcp_shape_passes():
+    code, out = run_verifier("receipt-real-2.json")
+    assert code == 0, out
+    assert out["verdict"] == "PASS"
+    assert out["receipt_id"] == "f2815391-ebc0-4a51-bbe3-613434371534"
+
+
+def test_tampered_receipt_fails():
+    # One character changed in the statement ($86,164.00 -> $86,164.01).
+    # The fingerprint must not match anymore.
+    code, out = run_verifier("receipt-tampered.json")
+    assert code == 1, out
+    assert out["verdict"] == "FAIL"
+    failed = [c["check"] for c in out["checks"] if not c["ok"]]
+    assert any("sha256(canonical_bytes) equals output_hash" in f for f in failed), failed
+
+
+def test_bad_base64_fails():
+    code, out = run_verifier("receipt-bad-b64.json")
+    assert code == 1
+    assert out["verdict"] == "FAIL"
+
+
+def test_wrong_hash_fails():
+    code, out = run_verifier("receipt-wrong-hash.json")
+    assert code == 1
+    assert out["verdict"] == "FAIL"
+
+
+def test_non_utf8_fails_closed():
+    # Valid base64, invalid UTF-8: must fail closed, never pass on bytes
+    # it cannot read.
+    code, out = run_verifier("receipt-bad-utf8.json")
+    assert code == 1
+    assert out["verdict"] == "FAIL"
+
+
+def test_usage_error():
+    p = subprocess.run([sys.executable, VERIFIER], capture_output=True, text=True)
+    assert p.returncode == 2
+
+
+if __name__ == "__main__":
+    test_real_receipt_envelope_passes()
+    test_real_receipt_mcp_shape_passes()
+    test_tampered_receipt_fails()
+    test_bad_base64_fails()
+    test_wrong_hash_fails()
+    test_non_utf8_fails_closed()
+    test_usage_error()
+    print("all aer1-verify tests passed")