coderifts-verifier 0.1.0__py3-none-any.whl

coderifts_verifier/__init__.py

@@ -0,0 +1,62 @@
+"""CodeRifts offline verifier for Python.
+
+Verify a CodeRifts chain receipt, or a DSSE / in-toto envelope carrying one,
+without calling CodeRifts. Offline Ed25519 against a keyring you pin.
+
+    from coderifts_verifier import unwrap, verify_receipt
+
+    token = unwrap(whatever_arrived)        # compact token, or DSSE -> compact
+    result = verify_receipt(token, {"keyring": my_keyring})
+    if result["valid"]:
+        ...
+
+UNWRAPPING IS NOT VERIFICATION. ``unwrap`` / ``from_dsse`` check no signature: a
+DSSE envelope wrapping a bad receipt unwraps cleanly and then fails
+``verify_receipt``, exactly as that compact token would have. The DSSE proves
+exactly what the compact receipt proves -- a standard container does not
+strengthen a claim.
+
+The verification core (``_verify.py``) is VENDORED from the reference JS/Python
+verifier rather than reimplemented, so there is one definition of what a valid
+receipt is. Its signed-bytes reconstruction is byte-identical to ``verify.js``;
+the cross-language tests pin that against shared vectors.
+"""
+
+from ._verify import (  # noqa: F401
+    canonical_json,
+    derive_status,
+    keyring_from_document,
+    reconstruct_signed_input,
+    verify_chain,
+    verify_receipt,
+)
+from .dsse import (  # noqa: F401
+    FORM_ATTESTATION,
+    FORM_RECEIPT,
+    PAYLOAD_TYPE,
+    PREDICATE_TYPE,
+    STATEMENT_TYPE,
+    DsseError,
+    from_dsse,
+    looks_like_dsse,
+    unwrap,
+)
+
+__all__ = [
+    "verify_receipt",
+    "verify_chain",
+    "from_dsse",
+    "unwrap",
+    "looks_like_dsse",
+    "DsseError",
+    "keyring_from_document",
+    "canonical_json",
+    "derive_status",
+    "reconstruct_signed_input",
+    "PAYLOAD_TYPE",
+    "STATEMENT_TYPE",
+    "PREDICATE_TYPE",
+    "FORM_RECEIPT",
+    "FORM_ATTESTATION",
+]
+__version__ = "0.1.0"

coderifts_verifier/_from_commit.py

@@ -0,0 +1,96 @@
+"""1961 TAG 1 -- finding the receipt that belongs to a commit (Python side).
+
+Byte-for-byte the same convention as ``receipt-verifier/receipt-from-commit.js``: the
+``CodeRifts-Receipt`` git trailer, or ``.coderifts/receipts/<full-sha>.json``. See
+``receipt-verifier/docs/receipt-commit-binding.md`` for why both exist and why the trailer wins.
+
+WARNING -- THE CARRIER PROVES NOTHING. Whichever one delivers the token, the token is then
+verified exactly as if it had been pasted on the command line. A forged sidecar yields
+INVALID_SIGNATURE, not a false pass. The sidecar is a POINTER; the signature is the authority.
+"""
+
+import json
+import os
+import pathlib
+import subprocess
+
+TRAILER_KEY = "CodeRifts-Receipt"
+SIDECAR_DIR = os.path.join(".coderifts", "receipts")
+
+
+def _git(args, cwd):
+    return subprocess.run(
+        ["git", *args], cwd=cwd, capture_output=True, text=True, check=True,
+    ).stdout.strip()
+
+
+def resolve_sha(ref, cwd):
+    """Abbreviations collide, and a verifier resolving one itself would be guessing which commit
+    the operator meant. Git knows; ask it."""
+    return _git(["rev-parse", ref + "^{commit}"], cwd)
+
+
+def receipt_from_trailer(sha, cwd):
+    raw = _git(["log", "-1", "--format=%%(trailers:key=%s,valueonly)" % TRAILER_KEY, sha], cwd)
+    if not raw:
+        return None
+    # Unfold: git wraps long trailer values, and a receipt token is long. A token has no
+    # whitespace in it, so joining the trimmed lines is lossless.
+    token = "".join(line.strip() for line in raw.splitlines())
+    return token or None
+
+
+def receipt_from_sidecar(sha, cwd):
+    """A MALFORMED SIDECAR IS NOT "NO SIDECAR".
+
+    Treating it as absent would let a corrupted pointer fall through to the trailer, or to
+    "nothing found" -- both of which read as an innocent absence rather than the broken file it is.
+    """
+    path = pathlib.Path(cwd) / SIDECAR_DIR / (sha + ".json")
+    if not path.exists():
+        return None
+    try:
+        doc = json.loads(path.read_text())
+    except Exception as e:
+        raise ValueError("sidecar %s is not valid JSON: %s" % (path, e))
+    token = (doc or {}).get("receipt") or (doc or {}).get("token")
+    if not token:
+        raise ValueError('sidecar %s has no "receipt" field' % path)
+    return {"token": str(token), "envelope": (doc or {}).get("envelope"), "file": str(path)}
+
+
+def receipt_for_commit(ref, cwd=None):
+    """Returns {sha, token, envelope, carrier}. Raises on anything that is not a clean find.
+
+    WARNING -- TRAILER WINS, BUT A DISAGREEMENT IS REFUSED RATHER THAN RESOLVED. The trailer is
+    inside the commit object and the sidecar is a file anyone can edit, so where both exist the
+    immutable one is authoritative. When they DISAGREE, silently preferring the trailer would hide
+    precisely the tampering the precedence rule exists to make visible.
+    """
+    cwd = cwd or os.getcwd()
+    try:
+        sha = resolve_sha(ref, cwd)
+    except subprocess.CalledProcessError as e:
+        raise ValueError("cannot resolve %s in %s: %s" % (ref, cwd, (e.stderr or "").splitlines()[:1]))
+
+    trailer = receipt_from_trailer(sha, cwd)
+    sidecar = receipt_from_sidecar(sha, cwd)
+
+    if trailer and sidecar:
+        if trailer != sidecar["token"]:
+            raise ValueError(
+                "receipt conflict for %s: the commit trailer and %s carry DIFFERENT receipts. "
+                "The trailer is covered by the commit SHA and the sidecar is not, so they should "
+                "never disagree -- resolve it deliberately rather than letting one win silently."
+                % (sha, sidecar["file"])
+            )
+        return {"sha": sha, "token": trailer, "envelope": sidecar["envelope"], "carrier": "both"}
+    if trailer:
+        return {"sha": sha, "token": trailer, "envelope": None, "carrier": "trailer"}
+    if sidecar:
+        return {"sha": sha, "token": sidecar["token"], "envelope": sidecar["envelope"], "carrier": "sidecar"}
+
+    raise ValueError(
+        "no receipt attached to %s: no %s trailer and no %s/%s.json. That means no receipt was "
+        "ATTACHED -- it does not mean none exists." % (sha, TRAILER_KEY, SIDECAR_DIR, sha)
+    )

coderifts_verifier/_verify.py

@@ -0,0 +1,604 @@
+#!/usr/bin/env python3
+"""CodeRifts chain-receipt verifier -- Python 3.10+, depends only on `cryptography`.
+
+Verify the receipt yourself — offline, no live CodeRifts API call needed.
+The reference format is frozen in ./RECEIPT_FORMAT.md.
+
+Usage:
+  python3 verify.py <receipt> [--key pub.pem | --keys <url|file>] [--kid <kid>] [--fetch <url>]
+                    [--envelope <file>] [--audience <a>] [--environment <e>]
+  python3 verify.py --chain receipts.txt [--key pub.pem | --keys <url|file>] [--kid <kid>] [--fetch <url>]
+
+Key discovery: with no --key/--keys, keys are fetched from
+  https://app.coderifts.com/.well-known/coderifts-keys.json  (override with --fetch <url>).
+The fetch-and-resolve path accepts BOTH the registry array (active + retired)
+and the legacy single-key body from /api/v1/attestation/public-key.
+--keys resolves each receipt's key by kid from a registry
+  ({keys: [{kid, public_key_pem, status, valid_from, retired_at}]}); accepts a URL or file.
+
+Output: JSON { valid, status, reason?, payload?, chain? } to stdout — byte-identical to verify.js.
+Exit codes: 0 valid, 1 invalid, 2 usage error.
+
+Verification order: structure -> json -> kid -> signature -> delimiter guard -> envelope binding
+-> taxonomy status. Statuses (12): VERIFIED_CURRENT, VERIFIED_EXPIRED, VERIFIED_WRONG_AUDIENCE,
+VERIFIED_WRONG_ENVIRONMENT, VERIFIED_SUPERSEDED, VERIFIED_SCOPE_MISMATCH, UNKNOWN_KEY,
+RETIRED_KEY_VALID_AT_ISSUE, INVALID_SIGNATURE, MALFORMED, UNSUPPORTED_VERSION, REGISTRY_UNREACHABLE.
+"""
+
+import base64
+import hashlib
+import json
+import math
+import os
+import pathlib
+import sys
+import urllib.request
+from datetime import datetime, timezone
+
+from cryptography.exceptions import InvalidSignature
+from cryptography.hazmat.primitives.serialization import load_pem_public_key
+from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PublicKey
+
+DEFAULT_FETCH_URL = "https://app.coderifts.com/.well-known/coderifts-keys.json"
+# P-2 (2026-09-23) -- THE NO-FLAG DEFAULT IS OFFLINE, matching verify.js.
+#
+# WARNING -- THIS CHANGED, AND THE OLD BEHAVIOUR IS WORTH NAMING. Until now, running this verifier
+# with no --key/--keys/--fetch FETCHED the live registry, while verify.js with no flags read a
+# VENDORED SNAPSHOT. So "no flags" meant two different things in two implementations of the same
+# format: one made a network call, the other did not. The previous round measured that divergence
+# and refused to resolve it on its own authority -- which default is correct is a product decision,
+# not something a status helper may decide. Peter chose OFFLINE for both, and this is that change.
+#
+# WHY OFFLINE IS THE RIGHT DEFAULT rather than merely the agreed one: a verifier's first promise
+# is "you can check this yourself, without us". A default that phones home makes the quiet case --
+# someone verifying a receipt on a laptop with no network, or inside a sealed build -- the one that
+# needs a flag. Fetching is still one flag away, and it is the case that deserves to be explicit.
+VENDORED_KEYS_PATH = str(pathlib.Path(__file__).resolve().parent / "keys" / "coderifts-keys.json")
+SIGNING_PREFIX = "crchain.v1"
+MAX_SUPPORTED_V = 4
+SIGNED_FIELDS = ["kid", "fp", "prev", "caller", "ts", "reg", "ir", "expires_at", "bh"]
+# ID104 — verification expiry leeway (ms). exp + leeway < now → VERIFIED_EXPIRED.
+CLOCK_SKEW_LEEWAY_MS = 30_000
+
+
+def expiry_leeway_ms(context=None):
+    """0s grace only when context DECLARES destructive AND production.
+
+    This surface has envelope.environment / --environment; no destructive /
+    operation_class field — never guess from operation labels.
+    """
+    return CLOCK_SKEW_LEEWAY_MS
+
+
+def _is_finite_number(value):
+    """Match JS Number.isFinite: real int/float only, not bool, not coerced strings."""
+    if isinstance(value, bool) or not isinstance(value, (int, float)):
+        return False
+    return math.isfinite(value)
+
+
+def is_expired_at(expires_at_ms, now_ms, context=None):
+    if not _is_finite_number(expires_at_ms) or not _is_finite_number(now_ms):
+        return False
+    return (float(expires_at_ms) + expiry_leeway_ms(context)) < float(now_ms)
+USAGE = (
+    "usage: python3 verify.py <receipt> [--key pub.pem | --keys <url|file>] [--kid <kid>] [--fetch <url>]\n"
+    "       python3 verify.py --from-commit <sha> [--repo <path>] [--key pub.pem | --keys <url|file>]\n"
+    "                   reads the CodeRifts-Receipt trailer or .coderifts/receipts/<sha>.json\n"
+    "                  [--envelope <file>] [--audience <a>] [--environment <e>]\n"
+    "       python3 verify.py --chain receipts.txt [--key pub.pem | --keys <url|file>] [--kid <kid>] [--fetch <url>]\n"
+)
+
+
+def b64url_decode(seg):
+    pad = "=" * (-len(seg) % 4)
+    return base64.urlsafe_b64decode(seg + pad)
+
+
+def sha256hex(text):
+    return hashlib.sha256(text.encode("utf-8")).hexdigest()
+
+
+def canonical_json(value):
+    """RFC 8785 (JCS) canonical JSON for our data domain — byte-identical to verify.js canonicalJson
+    and the issuer's src/canonical-json.js (ASCII keys, JSON scalars, sorted keys, no whitespace)."""
+    if value is None:
+        return "null"
+    if isinstance(value, bool):
+        return "true" if value else "false"
+    if isinstance(value, str):
+        return json.dumps(value, ensure_ascii=False)
+    if isinstance(value, (int, float)):
+        if isinstance(value, float) and (value != value or value in (float("inf"), float("-inf"))):
+            raise ValueError("canonical_json: non-finite number")
+        return json.dumps(value)
+    if isinstance(value, list):
+        return "[" + ",".join(canonical_json(v) for v in value) + "]"
+    if isinstance(value, dict):
+        keys = sorted(value.keys())
+        return "{" + ",".join(json.dumps(k, ensure_ascii=False) + ":" + canonical_json(value[k]) for k in keys) + "}"
+    raise TypeError("canonical_json: unsupported type")
+
+
+def reconstruct_signed_input(payload):
+    """Byte-identical to verify.js reconstructSignedInput.
+
+    v1: base ; v2: base|reg ; v3: base|reg|ir ; v4: base|reg|ir|expires_at|bh
+    (field order matches the CodeRifts issuer, chain-attestation.js signingInputV4).
+    """
+    base = "{p}|{kid}|{fp}|{prev}|{caller}|{ts}".format(
+        p=SIGNING_PREFIX,
+        kid=payload["kid"],
+        fp=payload["fp"],
+        prev=payload["prev"],
+        caller=payload["caller"],
+        ts=payload["ts"],
+    )
+    if payload.get("v") == 4:
+        return base + "|" + str(payload["reg"]) + "|" + str(payload["ir"]) + "|" + str(payload["expires_at"]) + "|" + str(payload["bh"])
+    if payload.get("v") == 3:
+        return base + "|" + str(payload["reg"]) + "|" + str(payload["ir"])
+    if payload.get("v") == 2:
+        return base + "|" + str(payload["reg"])
+    return base
+
+
+def resolve_entry(ctx, payload):
+    """Resolve the key entry for a payload; None => unknown_kid. Returns {public_key, status, retired_at}."""
+    kid = payload.get("kid")
+    if ctx.get("keyring") is not None:
+        entry = ctx["keyring"].get(kid)
+        if entry is None:
+            return None
+        if ctx.get("expected_kid") is not None and kid != ctx["expected_kid"]:
+            return None
+        return entry
+    if ctx.get("expected_kid") is not None and kid != ctx["expected_kid"]:
+        return None
+    return {"public_key": ctx["public_key"], "status": None, "retired_at": None, "revoked_at": None, "compromised_at": None}
+
+
+def _parse_iso(ts):
+    try:
+        return datetime.fromisoformat(str(ts).replace("Z", "+00:00")).timestamp() * 1000
+    except Exception:
+        return None
+
+
+def derive_status(payload, entry, opts):
+    """The 12-status taxonomy verdict for a signature-valid receipt (mirrors verify.js deriveStatus)."""
+    v = payload.get("v")
+    if isinstance(v, int) and v > MAX_SUPPORTED_V:
+        return "UNSUPPORTED_VERSION"
+    # FAIL CLOSED ON A STATUS WE DO NOT UNDERSTAND — mirrors verify.js deriveStatus.
+    #
+    # MEASURED 2026-08-26: status "revoked" returned valid/VERIFIED_CURRENT here. The status was
+    # read for "retired" and otherwise ignored, so an operator marking a stolen key revoked would
+    # have believed they had acted while this verifier kept accepting it. The app kernel and the
+    # attest/toolset verifiers already reject an unknown status; these two did not.
+    #
+    # This is only the DIRECTION of the unknown case, not revocation: the rule (compromised_at,
+    # REVOKED_KEY / REVOKED_KEY_UNDECIDABLE) is a separate change across eight verifiers.
+    if entry.get("status") not in ("active", "retired", "revoked", None):
+        return "UNKNOWN_KEY_STATUS"
+    # 1079 B — OPTIONAL timestamps, additive. Absent both fields → continue as before.
+    # Signing time is payload.ts (receipts have no iat). revoked_at kills history;
+    # retired_at only rejects ts >= retired_at.
+    revoked_at = entry.get("revoked_at")
+    if isinstance(revoked_at, str) and revoked_at:
+        return "KEY_REVOKED"
+    retired_at = entry.get("retired_at")
+    if isinstance(retired_at, str) and retired_at and payload.get("ts"):
+        issued = _parse_iso(payload.get("ts"))
+        retired = _parse_iso(retired_at)
+        if issued is not None and retired is not None and issued >= retired:
+            return "KEY_RETIRED_AFTER_SIGNING"
+    # REVOKED — RECEIPT_FORMAT.md 7.1 (normative); mirrors verify.js deriveStatus exactly.
+    # Both outcomes are valid:false. UNDECIDABLE is not a softer valid.
+    if entry.get("status") == "revoked":
+        at = entry.get("compromised_at")
+        if not isinstance(at, str) or not at:
+            return "REVOKED_KEY_UNDECIDABLE"
+        boundary = _parse_iso(at)
+        issued = _parse_iso(payload.get("ts"))
+        if boundary is None or issued is None:
+            return "REVOKED_KEY_UNDECIDABLE"
+        return "REVOKED_KEY" if issued >= boundary else "REVOKED_KEY_UNDECIDABLE"
+    if entry.get("status") == "retired":
+        issued = _parse_iso(payload.get("ts"))
+        retired = _parse_iso(entry.get("retired_at"))
+        if retired is not None and issued is not None and issued < retired:
+            return "RETIRED_KEY_VALID_AT_ISSUE"
+        return "INVALID_SIGNATURE"
+    now = opts["now"] if opts.get("now") is not None else (datetime.now(timezone.utc).timestamp() * 1000)
+    if v == 4 and isinstance(payload.get("expires_at"), str):
+        exp = _parse_iso(payload["expires_at"])
+        context = opts.get("envelope") or {"environment": opts.get("expected_environment")}
+        if exp is not None and is_expired_at(exp, now, context):
+            return "VERIFIED_EXPIRED"
+    env = opts.get("envelope")
+    if env:
+        if opts.get("expected_audience") is not None and env.get("audience") is not None and env["audience"] != opts["expected_audience"]:
+            return "VERIFIED_WRONG_AUDIENCE"
+        if opts.get("expected_environment") is not None and env.get("environment") is not None and env["environment"] != opts["expected_environment"]:
+            return "VERIFIED_WRONG_ENVIRONMENT"
+    return "VERIFIED_CURRENT"
+
+
+def verify_receipt(token, ctx=None, opts=None):
+    from .arity import split3
+    c, o = split3("verify_receipt", ctx, opts)
+    return _verify_receipt(token, c, o)
+
+
+def _verify_receipt(token, ctx, opts=None):
+    """Return an ordered dict {valid, status, reason?, payload?} matching verify.js key-for-key."""
+    opts = opts or {}
+    # 1. structure
+    if not isinstance(token, str) or len(token) == 0:
+        return {"valid": False, "status": "MALFORMED", "reason": "malformed_structure"}
+    segments = token.split(".")
+    if len(segments) != 2 or any(len(s) == 0 for s in segments):
+        return {"valid": False, "status": "MALFORMED", "reason": "malformed_structure"}
+
+    # 2. json
+    try:
+        payload = json.loads(b64url_decode(segments[0]).decode("utf-8"))
+    except Exception:
+        return {"valid": False, "status": "MALFORMED", "reason": "bad_json"}
+    if not isinstance(payload, dict):
+        return {"valid": False, "status": "MALFORMED", "reason": "bad_json"}
+
+    # 3. kid
+    entry = resolve_entry(ctx, payload)
+    if entry is None:
+        return {"valid": False, "status": "UNKNOWN_KEY", "reason": "unknown_kid", "payload": payload}
+
+    # 4. signature (raw Ed25519 over the reconstructed UTF-8 bytes)
+    message = reconstruct_signed_input(payload).encode("utf-8")
+    try:
+        sig = b64url_decode(segments[1])
+    except Exception:
+        return {"valid": False, "status": "INVALID_SIGNATURE", "reason": "signature_error", "payload": payload}
+    try:
+        entry["public_key"].verify(sig, message)
+    except InvalidSignature:
+        return {"valid": False, "status": "INVALID_SIGNATURE", "reason": "signature_mismatch", "payload": payload}
+    except Exception:
+        return {"valid": False, "status": "INVALID_SIGNATURE", "reason": "signature_error", "payload": payload}
+
+    # 5. anti-downgrade delimiter guard
+    for k in SIGNED_FIELDS:
+        if isinstance(payload.get(k), str) and "|" in payload[k]:
+            return {"valid": False, "status": "INVALID_SIGNATURE", "reason": "delimiter_in_field", "payload": payload}
+
+    # 6. envelope binding (v4)
+    if opts.get("envelope") and payload.get("v") == 4:
+        rest = dict(opts["envelope"])
+        rest.pop("receipt", None)
+        rest.pop("decision_body_hash", None)
+        recomputed = "sha256:" + sha256hex(canonical_json(rest))
+        if recomputed != payload.get("bh"):
+            return {"valid": False, "status": "INVALID_SIGNATURE", "reason": "body_hash_mismatch", "payload": payload}
+
+    # 7. taxonomy status
+    status = derive_status(payload, entry, opts)
+    if status == "KEY_REVOKED":
+        return {"valid": False, "status": status, "reason": "KEY_REVOKED", "payload": payload}
+    if status == "KEY_RETIRED_AFTER_SIGNING":
+        return {"valid": False, "status": status, "reason": "KEY_RETIRED_AFTER_SIGNING", "payload": payload}
+    if status == "INVALID_SIGNATURE":
+        return {"valid": False, "status": status, "reason": "retired_key_after_issue", "payload": payload}
+    valid = status in ("VERIFIED_CURRENT", "RETIRED_KEY_VALID_AT_ISSUE")
+    return {"valid": valid, "status": status, "payload": payload}
+
+
+def verify_chain(tokens, ctx=None, opts=None):
+    from .arity import split3
+    c, o = split3("verify_chain", ctx, opts)
+    return _verify_chain(tokens, c, o)
+
+
+def _verify_chain(tokens, ctx, opts=None):
+    links = []
+    all_valid = True
+    first = None
+
+    for i, token in enumerate(tokens):
+        res = _verify_receipt(token, ctx, opts)
+        link = {"index": i, "signature_valid": res["valid"]}
+        if not res["valid"] and "reason" in res:
+            link["reason"] = res["reason"]
+        prev = res.get("payload", {}).get("prev") if res.get("payload") else None
+        if res.get("payload"):
+            link["prev"] = prev
+
+        if i == 0:
+            first = "genesis" if prev == "null" else "continuation"
+            link["role"] = first
+            link["prev_ok"] = True if prev == "null" else None
+        else:
+            expected = "sha256:" + sha256hex(tokens[i - 1])
+            link["expected_prev"] = expected
+            link["prev_ok"] = prev == expected
+            if not link["prev_ok"]:
+                all_valid = False
+
+        if not res["valid"]:
+            all_valid = False
+        links.append(link)
+
+    return {"valid": all_valid, "chain": {"length": len(tokens), "first": first, "links": links}}
+
+
+def key_from_pem(pem_text):
+    key = load_pem_public_key(pem_text.encode("utf-8"))
+    if not isinstance(key, Ed25519PublicKey):
+        raise ValueError("public key is not Ed25519")
+    return key
+
+
+def keyring_from_document(doc, source):
+    """Build a kid -> entry map from a registry document. None when keys[] is missing/empty
+    so the caller can try the legacy single-key body."""
+    keys = doc.get("keys") if isinstance(doc, dict) else None
+    if not keys:
+        return None
+    keyring = {}
+    for k in keys:
+        if not k or not k.get("kid") or not k.get("public_key_pem"):
+            raise ValueError("registry entry missing kid/public_key_pem in " + source)
+        keyring[k["kid"]] = {
+            "public_key": key_from_pem(k["public_key_pem"]),
+            "status": k.get("status"),
+            "retired_at": k.get("retired_at"),
+            "revoked_at": k.get("revoked_at"),
+            # Carried through for the revoked rule (RECEIPT_FORMAT 7.1). Dropping it makes the
+            # rule inert: every revoked key would return UNDECIDABLE regardless of ts.
+            "compromised_at": k.get("compromised_at"),
+        }
+    return keyring
+
+
+def fetch_key_document(url):
+    """Fetch a key document. Accepts BOTH shapes: registry {keys:[...]} and
+    legacy {kid, public_key_pem}. Registry includes a keyring so retired kids resolve."""
+    req = urllib.request.Request(url, headers={"Accept": "application/json"})
+    with urllib.request.urlopen(req, timeout=15) as resp:  # noqa: S310 (explicit --fetch/default only)
+        info = json.loads(resp.read().decode("utf-8"))
+    keyring = keyring_from_document(info, url)
+    if keyring:
+        active_kid = None
+        active_entry = None
+        for kid, entry in keyring.items():
+            if entry.get("status") == "active":
+                active_kid, active_entry = kid, entry
+                break
+        if active_entry is None:
+            active_kid = next(iter(keyring))
+            active_entry = keyring[active_kid]
+        return {"public_key": active_entry["public_key"], "kid": active_kid, "keyring": keyring}
+    if not info or not info.get("public_key_pem"):
+        raise ValueError("no public_key_pem at " + url)
+    return {"public_key": key_from_pem(info["public_key_pem"]), "kid": info.get("kid")}
+
+
+def fetch_key_info(url):
+    """Legacy tuple (public_key, kid) of the active/single key — grant verifier unpacks this."""
+    info = fetch_key_document(url)
+    return info["public_key"], info.get("kid")
+
+
+def load_keyring(source):
+    """Build a {kid: {public_key, status, retired_at}} map from a CodeRifts key registry
+    ({keys: [{kid, public_key_pem, status, valid_from, retired_at}]}). Active + retired both load."""
+    if source.lower().startswith(("http://", "https://")):
+        req = urllib.request.Request(source, headers={"Accept": "application/json"})
+        with urllib.request.urlopen(req, timeout=15) as resp:  # noqa: S310 (explicit --keys only)
+            text = resp.read().decode("utf-8")
+    else:
+        with open(source, "r", encoding="utf-8") as fh:
+            text = fh.read()
+    doc = json.loads(text)
+    keyring = keyring_from_document(doc, source)
+    if not keyring:
+        raise ValueError("no keys[] in registry " + source)
+    return keyring
+
+
+def fail(msg):
+    sys.stderr.write(msg + "\n" + USAGE)
+    sys.exit(2)
+
+
+def registry_unreachable_verdict(source, err):
+    """1961/7.2 -- discovery failed is NOT "this key is not ours".
+
+    MEASURED 2026-09-23, before the fix: a discovery that could not complete left this CLI in
+    ``fail()`` -- free text on stderr, exit 2, the same shape as a mistyped flag. Nothing on
+    stdout, so a caller parsing the verdict document got no status at all. And where an empty or
+    stale keyring did reach the verifier, the receipt came back ``UNKNOWN_KEY``, which reads as
+    "signed by a key we do not publish" -- forgery-shaped -- when the truth was "we could not ask".
+
+    NOTHING IS LOOSENED. Both answers are ``valid: False``. What changes is where the operator is
+    sent: to their own network, or to the signer. ``REGISTRY_UNREACHABLE`` is already normative in
+    RECEIPT_FORMAT.md 7.1, so this is the code catching up with the published format.
+
+    Byte-identical in shape to cli.js ``registryUnreachableVerdict`` -- the two implementations
+    must not describe the same outage differently.
+    """
+    return {
+        "valid": False,
+        "status": "REGISTRY_UNREACHABLE",
+        "reason": "registry_unreachable",
+        "registry_unreachable": {
+            "source": source,
+            "why": "discovery was requested and could not be completed: " + str(err),
+            "remedy": (
+                "retry when the registry is reachable, or verify offline against a pinned keyring "
+                "(--keys <file>, or the vendored snapshot with no flags). An offline verdict is a "
+                "verdict about the keys you pinned, not about the registry as it stands now."
+            ),
+        },
+    }
+
+
+def discovery_was_mandatory(opts):
+    """Did the operator ask for the network? A file path did not.
+
+    WARNING -- THE DIVERGENCE THIS DOCSTRING USED TO RECORD IS NOW CLOSED (P-2, 2026-09-23). It
+    said that with no flags verify.js read a vendored snapshot while this module fetched, so the
+    no-flag default was mandatory discovery here and was not there. Peter chose OFFLINE for both;
+    the default now loads ``VENDORED_KEYS_PATH`` and makes no network call, so it is NOT mandatory
+    discovery in either implementation. Kept as a note rather than deleted: the next reader is
+    better served by knowing the two once disagreed than by finding a function that looks as
+    though it always agreed.
+    """
+    if opts.get("fetch_url"):
+        return True
+    source = opts.get("keys_source")
+    if isinstance(source, str) and (source.startswith("http://") or source.startswith("https://")):
+        return True
+    # No --key, no --keys, no --fetch: the vendored snapshot. Offline is not discovery.
+    return False
+
+
+def parse_args(argv):
+    opts = {"receipt": None, "chain_file": None, "key_file": None, "keys_source": None,
+            "kid": None, "fetch_url": None, "envelope_file": None, "audience": None,
+            "environment": None, "help": False, "from_commit": None, "repo": None}
+    i = 0
+    while i < len(argv):
+        a = argv[i]
+        if a == "--chain":
+            i += 1
+            opts["chain_file"] = argv[i] if i < len(argv) else None
+        elif a == "--key":
+            i += 1
+            opts["key_file"] = argv[i] if i < len(argv) else None
+        elif a == "--keys":
+            i += 1
+            opts["keys_source"] = argv[i] if i < len(argv) else None
+        elif a == "--kid":
+            i += 1
+            opts["kid"] = argv[i] if i < len(argv) else None
+        elif a == "--fetch":
+            i += 1
+            opts["fetch_url"] = argv[i] if i < len(argv) else None
+        # 1961 TAG 1 -- read the receipt off a commit instead of the command line.
+        elif a == "--from-commit":
+            i += 1
+            opts["from_commit"] = argv[i] if i < len(argv) else None
+        elif a == "--repo":
+            i += 1
+            opts["repo"] = argv[i] if i < len(argv) else None
+        elif a == "--envelope":
+            i += 1
+            opts["envelope_file"] = argv[i] if i < len(argv) else None
+        elif a == "--audience":
+            i += 1
+            opts["audience"] = argv[i] if i < len(argv) else None
+        elif a == "--environment":
+            i += 1
+            opts["environment"] = argv[i] if i < len(argv) else None
+        elif a in ("-h", "--help"):
+            opts["help"] = True
+        elif a.startswith("--"):
+            raise ValueError("unknown flag: " + a)
+        elif opts["receipt"] is None:
+            opts["receipt"] = a
+        else:
+            raise ValueError("unexpected argument: " + a)
+        i += 1
+    if opts["key_file"] and opts["keys_source"]:
+        raise ValueError("--key and --keys are mutually exclusive")
+    # A receipt from a commit AND one on the command line is an ambiguity, not a convenience:
+    # silently preferring one would verify a token the operator did not think they were asking
+    # about.
+    if opts["from_commit"] and opts["receipt"]:
+        raise ValueError("--from-commit and a positional receipt are mutually exclusive")
+    if opts["from_commit"] and opts["chain_file"]:
+        raise ValueError("--from-commit and --chain are mutually exclusive")
+    return opts
+
+
+def main():
+    try:
+        opts = parse_args(sys.argv[1:])
+    except ValueError as e:
+        fail(str(e))
+    if opts["help"]:
+        sys.stdout.write(USAGE)
+        sys.exit(2)
+    # 1961 TAG 1 -- resolve the receipt from a commit before anything else needs it.
+    #
+    # WARNING -- ANY FAILURE HERE IS A USAGE ERROR (exit 2), NOT A VERDICT. "no receipt is
+    # attached to this commit" is not a statement about a receipt: there is no receipt to have an
+    # opinion about. Emitting valid:false would be a verdict on a token never presented.
+    from_commit_envelope = None
+    if opts["from_commit"]:
+        try:
+            from ._from_commit import receipt_for_commit
+            found = receipt_for_commit(opts["from_commit"], cwd=opts["repo"] or os.getcwd())
+            opts["receipt"] = found["token"]
+            from_commit_envelope = found["envelope"]
+            sys.stderr.write("receipt for %s via %s\n" % (found["sha"], found["carrier"]))
+        except Exception as e:
+            fail(str(e))
+
+    if not opts["chain_file"] and not opts["receipt"]:
+        fail("no receipt provided")
+
+    # Resolve the verification key(s) + expected kid.
+    try:
+        if opts["keys_source"]:
+            ctx = {"keyring": load_keyring(opts["keys_source"]), "expected_kid": opts["kid"]}
+        elif opts["key_file"]:
+            with open(opts["key_file"], "r", encoding="utf-8") as fh:
+                public_key = key_from_pem(fh.read())
+            ctx = {"public_key": public_key, "expected_kid": opts["kid"]}
+        elif opts["fetch_url"]:
+            # Opt-in live discovery. Explicit, because it is the case that makes a network call.
+            info = fetch_key_document(opts["fetch_url"])
+            if info.get("keyring"):
+                ctx = {"keyring": info["keyring"], "expected_kid": opts["kid"]}
+            else:
+                ctx = {"public_key": info["public_key"], "expected_kid": opts["kid"] or info.get("kid")}
+        else:
+            # P-2: default = vendored snapshot, no network. Same as verify.js with no flags.
+            ctx = {"keyring": load_keyring(VENDORED_KEYS_PATH), "expected_kid": opts["kid"]}
+    except Exception as e:
+        # A FAILED MANDATORY DISCOVERY IS A VERDICT, NOT A USAGE ERROR: structured status on
+        # stdout and the verdict exit code, so a machine can tell an outage from a mistyped flag.
+        # An unreadable LOCAL file stays a usage error -- dressing an operator's own bad path as a
+        # registry outage would send them to the network to debug a filename.
+        if discovery_was_mandatory(opts):
+            source = opts["fetch_url"] or opts["keys_source"] or DEFAULT_FETCH_URL
+            sys.stdout.write(json.dumps(registry_unreachable_verdict(source, e)) + "\n")
+            sys.exit(1)
+        fail("could not load public key: " + str(e))
+
+    envelope = from_commit_envelope
+    if opts["envelope_file"]:
+        try:
+            with open(opts["envelope_file"], "r", encoding="utf-8") as fh:
+                envelope = json.loads(fh.read())
+        except Exception as e:
+            fail("could not read --envelope: " + str(e))
+    verify_opts = {"envelope": envelope, "expected_audience": opts["audience"], "expected_environment": opts["environment"]}
+
+    if opts["chain_file"]:
+        with open(opts["chain_file"], "r", encoding="utf-8") as fh:
+            tokens = [ln.strip() for ln in fh.read().split("\n") if ln.strip()]
+        if not tokens:
+            fail("chain file is empty")
+        result = verify_chain(tokens, ctx, verify_opts)
+    else:
+        result = _verify_receipt(opts["receipt"], ctx, verify_opts)
+
+    sys.stdout.write(json.dumps(result, separators=(",", ":")) + "\n")
+    sys.exit(0 if result["valid"] else 1)
+
+
+if __name__ == "__main__":
+    main()

coderifts_verifier/arity.py

@@ -0,0 +1,29 @@
+"""1129 — unified (token, opts) with opts['ctx'] / opts['intended']."""
+import warnings
+
+_warned = set()
+
+
+def warn_once(name):
+    if name in _warned:
+        return
+    _warned.add(name)
+    warnings.warn(
+        f"DEPRECATION: {name}(token, ctx, opts) is deprecated; use {name}(token, {{'ctx': ..., 'intended': ...}}). "
+        "This warning is emitted once.",
+        DeprecationWarning,
+        stacklevel=3,
+    )
+
+
+def split3(name, ctx, opts):
+    if opts is not None:
+        warn_once(name)
+        return ctx or {}, opts or {}
+    if isinstance(ctx, dict) and ("ctx" in ctx or "intended" in ctx or "envelope" in ctx):
+        return ctx.get("ctx") or {}, ctx
+    return ctx or {}, {}
+
+
+def reset_warned_for_test():
+    _warned.clear()

coderifts_verifier/dsse.py

@@ -0,0 +1,181 @@
+"""DSSE / in-toto envelope unwrapping for CodeRifts artifacts.
+
+Mirrors ``receipt-verifier/to-dsse.js`` ``fromDSSE``. The format is specified in
+``RECEIPT_FORMAT.md`` section 9, which is the source of truth for both
+implementations; the constants below are byte-exact to it.
+
+WHAT THIS DOES
+    It unwraps. ``from_dsse`` returns the compact token that was wrapped, byte
+    for byte, and ``verify_receipt`` then decides.
+
+WHAT IT DOES NOT DO
+    It does not verify. No signature is checked while reading an envelope. An
+    envelope wrapping a receipt with a bad signature unwraps cleanly and then
+    FAILS verification, exactly as that compact token would have -- the
+    signature is over the compact bytes. A DSSE envelope in hand is a container,
+    not a verdict.
+
+WHY THE PAYLOAD SEGMENT IS PRESERVED
+    ``predicate.compact.encoded_payload`` carries the ORIGINAL base64url
+    segment, not a re-serialisation of ``predicate.fields``. A signature is over
+    bytes, and re-encoding JSON is not byte-stable -- key order and whitespace
+    are free -- so a rebuilt payload would fail to verify for a reason that has
+    nothing to do with authenticity. Section 9.4.
+"""
+
+from __future__ import annotations
+
+import base64
+import binascii
+import json
+
+#: Section 9.1. Byte-exact with to-dsse.js; a divergence here breaks
+#: interoperability silently, so tests pin both against the spec.
+PAYLOAD_TYPE = "application/vnd.in-toto+json"
+STATEMENT_TYPE = "https://in-toto.io/Statement/v1"
+PREDICATE_TYPE = "https://coderifts.com/attestations/agent-action-authorization/v1"
+
+#: The compact forms an envelope may carry (section 9.3).
+FORM_RECEIPT = "crchain.v1"
+FORM_ATTESTATION = "cr.exec.attest.v1"
+
+
+class DsseError(Exception):
+    """Named refusal. ``code`` is one of MALFORMED / UNSUPPORTED / PREDICATE_MISMATCH."""
+
+    def __init__(self, message: str, code: str):
+        super().__init__(message)
+        self.code = code
+
+
+def _b64url_decode(segment: str) -> bytes:
+    pad = "=" * (-len(segment) % 4)
+    try:
+        return base64.urlsafe_b64decode(segment + pad)
+    except (binascii.Error, ValueError) as exc:
+        raise DsseError(f"payload segment is not base64url: {exc}", "MALFORMED") from exc
+
+
+def _decode_payload(encoded: str) -> dict:
+    try:
+        obj = json.loads(_b64url_decode(encoded).decode("utf-8"))
+    except DsseError:
+        raise
+    except (ValueError, UnicodeDecodeError) as exc:
+        raise DsseError(f"payload segment is not base64url JSON: {exc}", "MALFORMED") from exc
+    if not isinstance(obj, dict):
+        raise DsseError("payload is not a JSON object", "MALFORMED")
+    return obj
+
+
+def _sort_deep(value):
+    """Stable key order for the consistency comparison. Lists keep their order."""
+    if isinstance(value, list):
+        return [_sort_deep(v) for v in value]
+    if isinstance(value, dict):
+        return {k: _sort_deep(value[k]) for k in sorted(value)}
+    return value
+
+
+def looks_like_dsse(candidate) -> bool:
+    """Is this a DSSE envelope rather than a compact token?
+
+    Keyed on ``payloadType``, which is the envelope's own discriminator -- not on
+    "does it look like JSON". A compact receipt is ``<b64url>.<b64url>`` and a
+    compact attestation is pipe-delimited; neither can be mistaken for a mapping
+    carrying an in-toto payloadType.
+    """
+    if isinstance(candidate, dict):
+        return candidate.get("payloadType") == PAYLOAD_TYPE
+    if isinstance(candidate, (str, bytes)):
+        text = candidate.decode("utf-8", "replace") if isinstance(candidate, bytes) else candidate
+        if not text.lstrip().startswith("{"):
+            return False
+        try:
+            parsed = json.loads(text)
+        except ValueError:
+            return False
+        return isinstance(parsed, dict) and parsed.get("payloadType") == PAYLOAD_TYPE
+    return False
+
+
+def from_dsse(envelope) -> str:
+    """Reassemble the compact token from a DSSE envelope.
+
+    Refuses rather than guesses. Every refusal below is a case where returning a
+    token anyway would hand the caller bytes that do not correspond to the
+    envelope they read.
+
+    :raises DsseError: MALFORMED | UNSUPPORTED | PREDICATE_MISMATCH
+    """
+    if isinstance(envelope, (str, bytes)):
+        text = envelope.decode("utf-8", "replace") if isinstance(envelope, bytes) else envelope
+        try:
+            envelope = json.loads(text)
+        except ValueError as exc:
+            raise DsseError(f"from_dsse: envelope is not JSON: {exc}", "MALFORMED") from exc
+    if not isinstance(envelope, dict):
+        raise DsseError("from_dsse: envelope must be an object", "MALFORMED")
+
+    if envelope.get("payloadType") != PAYLOAD_TYPE:
+        raise DsseError(
+            f"from_dsse: unsupported payloadType {json.dumps(envelope.get('payloadType'))}",
+            "UNSUPPORTED",
+        )
+
+    raw = envelope.get("payload")
+    try:
+        statement = json.loads(base64.b64decode(str(raw), validate=True).decode("utf-8"))
+    except (binascii.Error, ValueError, UnicodeDecodeError) as exc:
+        raise DsseError(f"from_dsse: payload is not base64 JSON: {exc}", "MALFORMED") from exc
+    if not isinstance(statement, dict) or statement.get("predicateType") != PREDICATE_TYPE:
+        got = statement.get("predicateType") if isinstance(statement, dict) else None
+        raise DsseError(f"from_dsse: unsupported predicateType {json.dumps(got)}", "UNSUPPORTED")
+
+    predicate = statement.get("predicate") or {}
+    compact = predicate.get("compact") or {}
+    signatures = envelope.get("signatures")
+    signatures = signatures if isinstance(signatures, list) else []
+    if len(signatures) != 1 or not isinstance(signatures[0], dict) or not signatures[0].get("sig"):
+        raise DsseError("from_dsse: exactly one signature with a sig is required", "MALFORMED")
+
+    encoded = compact.get("encoded_payload")
+    if not isinstance(encoded, str) or not encoded:
+        raise DsseError("from_dsse: predicate.compact.encoded_payload missing", "MALFORMED")
+
+    # The predicate carries the payload twice -- preserved bytes and decoded
+    # fields. If they disagree, the readable half describes something the signed
+    # half does not contain, and a reader without a CodeRifts verifier would
+    # believe the readable half. Refuse instead (section 9.7).
+    decoded = _decode_payload(encoded)
+    if _sort_deep(decoded) != _sort_deep(predicate.get("fields") or {}):
+        raise DsseError(
+            "from_dsse: predicate.fields does not match predicate.compact.encoded_payload -- "
+            "the readable half of this envelope disagrees with the signed half",
+            "PREDICATE_MISMATCH",
+        )
+
+    sig = signatures[0]["sig"]
+    form = compact.get("form")
+    if form == FORM_ATTESTATION:
+        if not compact.get("tag") or not compact.get("kid"):
+            raise DsseError(
+                "from_dsse: attestation form needs compact.tag and compact.kid", "MALFORMED"
+            )
+        return "|".join([compact["tag"], compact["kid"], encoded, sig])
+    if form == FORM_RECEIPT:
+        return f"{encoded}.{sig}"
+    raise DsseError(f"from_dsse: unknown compact form {json.dumps(form)}", "UNSUPPORTED")
+
+
+def unwrap(candidate) -> str:
+    """Accept either form and return the compact token.
+
+    A caller that does not know which form it received can hand it here. A
+    compact token passes through untouched; an envelope is unwrapped.
+    """
+    if looks_like_dsse(candidate):
+        return from_dsse(candidate)
+    if isinstance(candidate, str) and candidate:
+        return candidate
+    raise DsseError("unwrap: neither a compact token nor a DSSE envelope", "MALFORMED")

coderifts_verifier/keys/coderifts-keys.json

@@ -0,0 +1 @@
+{"keys":[{"kid":"2026-07-k1","public_key_pem":"-----BEGIN PUBLIC KEY-----\nMCowBQYDK2VwAyEAJh8xDXLaOCpQ+bBC9d2I+zG1qVsCpeCuWbtH+aGjC7A=\n-----END PUBLIC KEY-----\n","status":"active","valid_from":null,"retired_at":null}]}

coderifts_verifier/keys/coderifts-keys.json.sha256

@@ -0,0 +1 @@
+bfe0c898cda3c3a4c8141726d0adb4cdb7eb9762de6264e430eff6469b90422e  coderifts-keys.json

coderifts_verifier-0.1.0.dist-info/METADATA

@@ -0,0 +1,124 @@
+Metadata-Version: 2.4
+Name: coderifts-verifier
+Version: 0.1.0
+Summary: Offline verifier for CodeRifts chain receipts and DSSE/in-toto envelopes. Ed25519, no network.
+License-Expression: MIT
+Project-URL: Homepage, https://github.com/coderifts/receipt-verifier
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: cryptography>=41
+Dynamic: license-file
+
+# coderifts-verifier (Python)
+
+Verify a CodeRifts chain receipt — or a DSSE / in-toto envelope carrying one —
+offline, in Python, without calling CodeRifts.
+
+```python
+from coderifts_verifier import unwrap, verify_receipt, keyring_from_document
+
+keyring = keyring_from_document(registry_json, "my-registry.json")
+token = unwrap(whatever_arrived)              # compact token, or DSSE -> compact
+result = verify_receipt(token, {"keyring": keyring})
+
+if result["valid"]:
+    ...
+else:
+    handle(result["status"])                  # INVALID_SIGNATURE, UNKNOWN_KEY, ...
+```
+
+Ed25519 via `cryptography`. No network on the verify path.
+
+## This is not the CodeRifts SDK
+
+Two different packages, on purpose:
+
+| | `coderifts` (SDK) | `coderifts-verifier` (this) |
+| --- | --- | --- |
+| does | calls the API to get a decision | verifies evidence you already hold |
+| crypto | none — deliberately | Ed25519 |
+| network | yes, that is the point | none on the verify path |
+
+A dependency on `cryptography` is correct here: this package checks signatures.
+The SDK stays crypto-free.
+
+## Unwrapping is not verification
+
+`unwrap` and `from_dsse` check **no signature**. An envelope wrapping a receipt
+with a bad signature unwraps cleanly and then fails `verify_receipt`, exactly as
+that compact token would have — the signature is over the compact bytes.
+
+The DSSE envelope proves **exactly what the compact receipt proves**. A standard
+container does not strengthen a claim.
+
+```python
+token = from_dsse(envelope)                   # succeeds — nothing checked yet
+verify_receipt(token, {"keyring": keyring})   # this is the verdict
+```
+
+## Cross-language agreement
+
+The signed-bytes reconstruction is byte-identical to the JavaScript verifier —
+`verify.js` says so in its own source, and `tests/xlang-vectors.json` holds
+receipts produced and verified by that implementation. The test suite asserts
+Python reaches the **same verdict on the same bytes**, for a passing receipt and
+for two distinct failure modes.
+
+Two implementations disagreeing about whether a receipt is valid is the failure
+a multi-language verifier exists to avoid, so the agreement is pinned rather than
+assumed.
+
+The verification core (`coderifts_verifier/_verify.py`) is **vendored** from the
+reference verifier, not reimplemented. The only edit is the import path for the
+vendored `arity` helper; the file is otherwise byte-identical, so there is one
+definition of what a valid receipt is rather than two that can drift.
+
+## Refusals are named
+
+`from_dsse` raises `DsseError` with a `code`:
+
+| code | when |
+| --- | --- |
+| `MALFORMED` | not an envelope; unreadable payload; zero, two, or signature-less entries; missing `encoded_payload` |
+| `UNSUPPORTED` | a `payloadType`, `predicateType`, or compact `form` this version does not implement |
+| `PREDICATE_MISMATCH` | the decoded `predicate.fields` disagree with the preserved payload segment |
+
+That last one matters: the predicate carries the payload twice, once as bytes and
+once decoded for a reader. If they disagree, the readable half describes
+something the signed half does not contain — refuse rather than hand back bytes
+that do not match the envelope someone read.
+
+## What a valid verdict proves
+
+* a holder of a key in **the keyring you supplied** signed this receipt;
+* the receipt's signed fields are unmodified;
+* per `status`: whether it is current, or was issued while a now-retired key was
+  still valid.
+
+## What it does NOT prove
+
+* **That anything happened.** A receipt is a signed statement about a decision,
+  not an observation of an effect.
+* **That the key is uncompromised.** Everything reduces to "a holder of this key
+  signed this". Custody is yours.
+* **That the receipt is the right one for what you are about to do.** Scope
+  matching — does this receipt cover THIS operation on THIS target — is the
+  caller's check, against the decision envelope. This verifies the receipt.
+* **That a human saw anything.**
+
+## Format
+
+`RECEIPT_FORMAT.md` in the reference verifier is the specification; section 9
+covers the DSSE / in-toto export. The constants here are byte-exact to it and
+pinned by a test.
+
+## Tests
+
+```bash
+python3 -m pytest tests/ -q
+```
+
+## License
+
+MIT

coderifts_verifier-0.1.0.dist-info/RECORD

@@ -0,0 +1,12 @@
+coderifts_verifier/__init__.py,sha256=Cwmzp_zULHwao6ynRVBpABfUL9SVW5lKTHDaFUV8ypI,1782
+coderifts_verifier/_from_commit.py,sha256=dI_4Wdda1n_1AKaV4jG3Mt7ZpAGGHs4lu1j-2BTA6B0,4158
+coderifts_verifier/_verify.py,sha256=YmHIa8M24wB7cW3LPSbzUXpDk7bMfV_DIVxfgnSJ3bM,27747
+coderifts_verifier/arity.py,sha256=s9KgFqSFNNgoGe1vE4dTtwxtMNDtcVnTZur7gczjfSQ,749
+coderifts_verifier/dsse.py,sha256=3VHp7Ch8eBPIOMndqcwu4mmqCQQo6perW37ESVHZhB4,7645
+coderifts_verifier/keys/coderifts-keys.json,sha256=v-DImM2jw6TIFBcm0K20zbfrl2LeYmTkMO_2RpuQQi4,221
+coderifts_verifier/keys/coderifts-keys.json.sha256,sha256=CkyftXHWs9wITq6votBQziPyjRVQEJubfnX9-zujJzg,86
+coderifts_verifier-0.1.0.dist-info/licenses/LICENSE,sha256=LCpDJxtKbo95q7AySzxWz7EosZLSBfgE5uDxePqRq0g,1066
+coderifts_verifier-0.1.0.dist-info/METADATA,sha256=nbnnhym9fw8-oydAW3StM-z_1t_E4W_oeBHFOD5u5So,4629
+coderifts_verifier-0.1.0.dist-info/WHEEL,sha256=aeYiig01lYGDzBgS8HxWXOg3uV61G9ijOsup-k9o1sk,91
+coderifts_verifier-0.1.0.dist-info/top_level.txt,sha256=hauGkn-B2KvjzMT45hmX0QuX5sYb64hjM_AZAnebqW4,19
+coderifts_verifier-0.1.0.dist-info/RECORD,,

coderifts_verifier-0.1.0.dist-info/WHEEL

@@ -0,0 +1,5 @@
+Wheel-Version: 1.0
+Generator: setuptools (82.0.1)
+Root-Is-Purelib: true
+Tag: py3-none-any
+

coderifts_verifier-0.1.0.dist-info/licenses/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 CodeRifts
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

coderifts_verifier-0.1.0.dist-info/top_level.txt

@@ -0,0 +1 @@
+coderifts_verifier