governanceos 0.1.0__tar.gz

governanceos-0.1.0/LICENSE

@@ -0,0 +1,176 @@
+Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS

governanceos-0.1.0/NOTICE

@@ -0,0 +1,4 @@
+GovernanceOS
+Copyright 2026 GovernanceOS
+
+The Ed25519 verification in src/governanceos/verify.py follows the reference code in RFC 8032, section 6.

governanceos-0.1.0/PKG-INFO

@@ -0,0 +1,69 @@
+Metadata-Version: 2.4
+Name: governanceos
+Version: 0.1.0
+Summary: Open-source tools from GovernanceOS. First: gos-verify, the offline verifier for GovernanceOS evidence packs.
+Author: GovernanceOS
+License-Expression: Apache-2.0
+Project-URL: Homepage, https://governanceos.si
+Project-URL: Source, https://github.com/GovernanceOS/governanceos
+Project-URL: Verify a pack, https://governanceos.si/verify
+Keywords: ai governance,evidence pack,offline verification,ed25519,model risk
+Classifier: Development Status :: 4 - Beta
+Classifier: Environment :: Console
+Classifier: Intended Audience :: Financial and Insurance Industry
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3
+Classifier: Topic :: Security :: Cryptography
+Requires-Python: >=3.8
+Description-Content-Type: text/markdown
+License-File: LICENSE
+License-File: NOTICE
+Dynamic: license-file
+
+# GovernanceOS
+
+Open-source tools from [GovernanceOS](https://governanceos.si), under the Apache License 2.0. They run on your own machine with Python 3 and nothing else installed, and they make no network calls.
+
+```
+pip install governanceos
+```
+
+## gos-verify: verify an evidence pack offline
+
+An institution that keeps its AI governance records in GovernanceOS can share an evidence pack with an examiner. `gos-verify` checks that pack on the examiner's own machine:
+
+1. It recomputes the SHA-256 hash of every record, checks that each links to the one before it, and checks that the positions run without a gap.
+2. It checks the Ed25519 signature over the whole pack: the header, every record and the summaries.
+3. It prints the signing key's hash and compares it with the one the institution sent you by another route (`--key`), and compares the head with a head it sent you (`--expect`).
+4. It says plainly that the public anchor was not checked, because that needs a network.
+
+```
+gos-verify PACK.json --key KEYHASH [--expect HEAD]
+```
+
+| Exit | Meaning |
+|---|---|
+| 0 | Verified: intact, and signed by the key you pinned |
+| 1 | Intact, but the signer is not pinned |
+| 2 | Chain broken |
+| 3 | Signature invalid |
+| 4 | Head differs from `--expect` |
+| 5 | The pack cannot be read |
+| 6 | The key differs from `--key` |
+
+**What it proves:** the pack was not changed after the key you pinned signed it.
+**What it does not prove:** that the records were true when they were written. That is for the examination.
+
+The same verifier is the single-file download at [governanceos.si/verify](https://governanceos.si/verify). The two are byte-identical.
+
+## Try it
+
+`tests/data` holds a sample pack from a fictional institution and a tampered copy of it:
+
+```
+python -m unittest discover -s tests -v
+```
+
+## License
+
+Apache License 2.0; see [LICENSE](LICENSE) and [NOTICE](NOTICE). The license grants no rights to the GovernanceOS name or marks (section 6).

governanceos-0.1.0/README.md

@@ -0,0 +1,47 @@
+# GovernanceOS
+
+Open-source tools from [GovernanceOS](https://governanceos.si), under the Apache License 2.0. They run on your own machine with Python 3 and nothing else installed, and they make no network calls.
+
+```
+pip install governanceos
+```
+
+## gos-verify: verify an evidence pack offline
+
+An institution that keeps its AI governance records in GovernanceOS can share an evidence pack with an examiner. `gos-verify` checks that pack on the examiner's own machine:
+
+1. It recomputes the SHA-256 hash of every record, checks that each links to the one before it, and checks that the positions run without a gap.
+2. It checks the Ed25519 signature over the whole pack: the header, every record and the summaries.
+3. It prints the signing key's hash and compares it with the one the institution sent you by another route (`--key`), and compares the head with a head it sent you (`--expect`).
+4. It says plainly that the public anchor was not checked, because that needs a network.
+
+```
+gos-verify PACK.json --key KEYHASH [--expect HEAD]
+```
+
+| Exit | Meaning |
+|---|---|
+| 0 | Verified: intact, and signed by the key you pinned |
+| 1 | Intact, but the signer is not pinned |
+| 2 | Chain broken |
+| 3 | Signature invalid |
+| 4 | Head differs from `--expect` |
+| 5 | The pack cannot be read |
+| 6 | The key differs from `--key` |
+
+**What it proves:** the pack was not changed after the key you pinned signed it.
+**What it does not prove:** that the records were true when they were written. That is for the examination.
+
+The same verifier is the single-file download at [governanceos.si/verify](https://governanceos.si/verify). The two are byte-identical.
+
+## Try it
+
+`tests/data` holds a sample pack from a fictional institution and a tampered copy of it:
+
+```
+python -m unittest discover -s tests -v
+```
+
+## License
+
+Apache License 2.0; see [LICENSE](LICENSE) and [NOTICE](NOTICE). The license grants no rights to the GovernanceOS name or marks (section 6).

governanceos-0.1.0/pyproject.toml

@@ -0,0 +1,33 @@
+[build-system]
+requires = ["setuptools>=77"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "governanceos"
+version = "0.1.0"
+description = "Open-source tools from GovernanceOS. First: gos-verify, the offline verifier for GovernanceOS evidence packs."
+readme = "README.md"
+license = "Apache-2.0"
+license-files = ["LICENSE", "NOTICE"]
+requires-python = ">=3.8"
+authors = [{ name = "GovernanceOS" }]
+keywords = ["ai governance", "evidence pack", "offline verification", "ed25519", "model risk"]
+classifiers = [
+  "Development Status :: 4 - Beta",
+  "Environment :: Console",
+  "Intended Audience :: Financial and Insurance Industry",
+  "Operating System :: OS Independent",
+  "Programming Language :: Python :: 3",
+  "Topic :: Security :: Cryptography",
+]
+
+[project.urls]
+Homepage = "https://governanceos.si"
+Source = "https://github.com/GovernanceOS/governanceos"
+"Verify a pack" = "https://governanceos.si/verify"
+
+[project.scripts]
+gos-verify = "governanceos.cli:verify"
+
+[tool.setuptools.packages.find]
+where = ["src"]

governanceos-0.1.0/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+

governanceos-0.1.0/src/governanceos/__init__.py

@@ -0,0 +1,5 @@
+"""Open-source tools from GovernanceOS (Apache-2.0). https://governanceos.si"""
+from .verify import VERSION as VERIFIER_VERSION
+
+__version__ = "0.1.0"
+__all__ = ["__version__", "VERIFIER_VERSION"]

governanceos-0.1.0/src/governanceos/cli.py

@@ -0,0 +1,9 @@
+"""Console entry points. verify.py is byte-identical to the download at governanceos.si/verify."""
+import sys
+
+from .verify import main
+
+
+def verify():
+    """gos-verify PACK.json --key KEYHASH [--expect HEAD]"""
+    raise SystemExit(main(sys.argv))

governanceos-0.1.0/src/governanceos/verify.py

@@ -0,0 +1,281 @@
+#!/usr/bin/env python3
+# GovernanceOS pack verifier 1.2.1
+# Copyright 2026 GovernanceOS. Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License. You may obtain a copy of the License at
+#     http://www.apache.org/licenses/LICENSE-2.0
+# Unless required by applicable law or agreed to in writing, software distributed under the License is
+# distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+#
+# What it does, offline, with Python 3 and nothing else installed:
+#   1. recomputes the SHA-256 hash of every record, checks each one links to the record before it, and checks the
+#      positions run without a gap;
+#   2. checks the Ed25519 signature (RFC 8032, pure Python below) over the whole pack: the header, every record and
+#      the summaries. Only the anchors are outside it, because they are added later and checked online;
+#   3. prints the signing key's hash (SHA-256 of the public key) and compares it with the one the institution sent
+#      you separately (--key), and compares the head with a head it sent you (--expect);
+#   4. says plainly that the public anchor was not checked, because it needs a network.
+# The key inside a pack proves nothing on its own: anyone can change or shorten a pack, rebuild the chain and sign it
+# with a key of their own. Only the pack key hash, received by another route, ties the pack to the institution, so
+# the result is VERIFIED only when --key matches. A head alone shows the records end there, not that nothing earlier
+# was left out.
+# What it proves: the pack was not changed after the key you pinned signed it.
+# What it does not prove: that the records were true when they were written.
+#
+# Usage:  python gos-verify.py PACK.json --key KEYHASH [--expect HEAD]
+# Exit:   0 verified (intact, signed by the pinned key) · 1 intact but the signer is not pinned · 2 chain broken
+#         3 signature invalid · 4 head differs from --expect · 5 cannot be read · 6 key differs from --key
+import hashlib, json, sys, unicodedata
+
+VERSION = "1.2.1"
+MAX_BYTES = 200 * 1024 * 1024  # a pack larger than this is refused, unread
+
+# ---- Ed25519 verification, after the reference code in RFC 8032, section 6 ----
+_p = 2 ** 255 - 19
+_L = 2 ** 252 + 27742317777372353535851937790883648493
+_d = -121665 * pow(121666, _p - 2, _p) % _p
+_I = pow(2, (_p - 1) // 4, _p)
+
+
+def _inv(x):
+    return pow(x, _p - 2, _p)
+
+
+def _recover_x(y, sign):
+    if y >= _p:
+        return None
+    x2 = (y * y - 1) * _inv(_d * y * y + 1)
+    if x2 == 0:
+        return None if sign else 0
+    x = pow(x2, (_p + 3) // 8, _p)
+    if (x * x - x2) % _p != 0:
+        x = x * _I % _p
+    if (x * x - x2) % _p != 0:
+        return None
+    if (x & 1) != sign:
+        x = _p - x
+    return x
+
+
+def _add(P, Q):
+    A = (P[1] - P[0]) * (Q[1] - Q[0]) % _p
+    B = (P[1] + P[0]) * (Q[1] + Q[0]) % _p
+    C = 2 * P[3] * Q[3] * _d % _p
+    D = 2 * P[2] * Q[2] % _p
+    E, F, G, H = B - A, D - C, D + C, B + A
+    return (E * F % _p, G * H % _p, F * G % _p, E * H % _p)
+
+
+def _mul(s, P):
+    Q = (0, 1, 1, 0)
+    while s > 0:
+        if s & 1:
+            Q = _add(Q, P)
+        P = _add(P, P)
+        s >>= 1
+    return Q
+
+
+def _equal(P, Q):
+    return (P[0] * Q[2] - Q[0] * P[2]) % _p == 0 and (P[1] * Q[2] - Q[1] * P[2]) % _p == 0
+
+
+_gy = 4 * _inv(5) % _p
+_gx = _recover_x(_gy, 0)
+_G = (_gx, _gy, 1, _gx * _gy % _p)
+
+
+def _decompress(b):
+    if len(b) != 32:
+        return None
+    y = int.from_bytes(b, "little")
+    sign = y >> 255
+    y &= (1 << 255) - 1
+    x = _recover_x(y, sign)
+    return None if x is None else (x, y, 1, x * y % _p)
+
+
+def ed25519_verify(public, message, signature):
+    if len(public) != 32 or len(signature) != 64:
+        return False
+    A = _decompress(public)
+    R = _decompress(signature[:32])
+    if A is None or R is None:
+        return False
+    s = int.from_bytes(signature[32:], "little")
+    if s >= _L:
+        return False
+    h = int.from_bytes(hashlib.sha512(signature[:32] + public + message).digest(), "little") % _L
+    return _equal(_mul(s, _G), _add(R, _mul(h, A)))
+
+
+# ---- the pack ----
+UNSIGNED = ("signature", "anchors", "anchors_note", "verifier")  # anchors: added later, checked online; verifier: checked by its own SHA-256
+HEX = set("0123456789abcdef")
+
+
+def canonical(obj):
+    return json.dumps(obj, sort_keys=True, separators=(",", ":"), ensure_ascii=False).encode("utf-8")
+
+
+def record_hash(prev_hash, record):
+    return hashlib.sha256(bytes.fromhex(prev_hash) + canonical(record)).hexdigest()
+
+
+def signed_message(pack):
+    """Everything the institution signs: the whole pack except the signature and the anchors."""
+    return canonical({k: v for k, v in pack.items() if k not in UNSIGNED})
+
+
+def key_hash(public_hex):
+    """SHA-256 of the raw 32-byte public key, as 64 lowercase hex characters."""
+    return hashlib.sha256(bytes.fromhex(public_hex)).hexdigest()
+
+
+def _grouped(h):
+    return " ".join(h[i:i + 8] for i in range(0, len(h), 8))
+
+
+def clean(v, limit=400):
+    """Pack text as it may be printed: no control or direction characters, so a pack cannot write its own result lines."""
+    t = "".join("?" if unicodedata.category(c) in ("Cc", "Cf", "Zl", "Zp") else c for c in str(v))
+    return t if len(t) <= limit else t[:limit] + "…"
+
+
+USAGE = "Usage: python gos-verify.py PACK.json --key KEYHASH [--expect HEAD]"
+HELP = USAGE + """
+  --key KEYHASH   the pack key hash the institution sent you by another route (64 hex characters, or at least 32)
+  --expect HEAD   a chain head the institution sent you (64 hex characters); optional
+Exit: 0 verified · 1 signer not pinned · 2 chain broken · 3 signature invalid · 4 head differs · 5 cannot be read · 6 key differs"""
+
+
+def _option(args, name):
+    """The value after name. A value pasted in groups of eight (as the pages show it) is read whole."""
+    if name not in args:
+        return None, True
+    i = args.index(name)
+    if i + 1 >= len(args):
+        return None, False
+    v = args[i + 1].strip().lower().replace(" ", "").replace("sha256:", "")
+    j = i + 2
+    while len(v) < 64 and j < len(args) and len(args[j]) == 8 and all(c in HEX for c in args[j].lower()):
+        v += args[j].lower(); j += 1
+    del args[i:j]
+    return v, True
+
+
+def _strict_object(pairs):
+    """A JSON object with a repeated key is refused: two readers could see two different packs."""
+    keys = [k for k, _ in pairs]
+    if len(keys) != len(set(keys)):
+        raise ValueError("a key appears twice")
+    return dict(pairs)
+
+
+def _no_constant(name):
+    raise ValueError("NaN or Infinity is not a number in a pack")
+
+
+def main(argv):
+    try:  # a non-ASCII issuer line must never turn a good pack into an unreadable one on a redirected console
+        sys.stdout.reconfigure(encoding="utf-8", errors="replace")
+    except Exception:
+        pass
+    args = [a for a in argv[1:]]
+    if any(a in ("-h", "--help") for a in args):
+        print(HELP); return 0
+    expect, ok1 = _option(args, "--expect")
+    pin, ok2 = _option(args, "--key")
+    if not (ok1 and ok2) or len(args) != 1:
+        print(USAGE); return 5
+    if pin is not None and (len(pin) < 32 or len(pin) > 64 or any(c not in HEX for c in pin)):
+        print("Key: give the pack key hash you were sent, 64 hexadecimal characters (at least 32)."); print(USAGE); return 5
+    if expect is not None and (len(expect) != 64 or any(c not in HEX for c in expect)):
+        print("Head: give the chain head you were sent, 64 hexadecimal characters."); print(USAGE); return 5
+    print(f"GovernanceOS pack verifier {VERSION} (Apache-2.0)")
+    try:
+        return _verify(args[0], pin, expect)
+    except Exception as e:  # anything the checks did not expect means the file is not a pack this verifier reads
+        print(f"Format: NOT READABLE ({e.__class__.__name__}). The file is not a pack this verifier reads, or it is cut short.")
+        print("What to do: download it again, check its SHA-256, and ask the institution if it persists.")
+        return 5
+
+
+def _verify(path, pin, expect):
+    try:
+        import os
+        if os.path.getsize(path) > MAX_BYTES:
+            raise ValueError("larger than the verifier reads")
+        with open(path, encoding="utf-8") as f:
+            pack = json.load(f, object_pairs_hook=_strict_object, parse_constant=_no_constant)
+        recs = pack["records"]
+        assert isinstance(pack, dict) and pack["format"] == "governanceos-pack/1" and isinstance(recs, list) and recs
+        assert all(isinstance(r, dict) and isinstance(r["position"], int) for r in recs)
+    except Exception as e:
+        print(f"Format: NOT READABLE ({e.__class__.__name__}). The file is not a pack this verifier reads, or it is cut short.")
+        print("What to do: download it again, check its SHA-256, and ask the institution if it persists.")
+        return 5
+    print(f"Pack: {clean(pack['pack_id'], 120)} · {len(recs)} records, chain positions {recs[0]['position']} to {recs[-1]['position']}")
+    print(f"Created: {clean(pack.get('created', 'not stated'), 40)} · Period: {clean(pack.get('period', 'not stated'), 60)}")
+    print(f"Issued by: {clean(pack['issued_by'], 200)}")
+    if pack.get("notice"):
+        print(f"Notice: {clean(pack['notice'])}")
+    prev = pack["segment_start_prev_hash"]
+    for i, r in enumerate(recs):
+        if i and r["position"] != recs[i - 1]["position"] + 1:
+            print(f"Chain: BROKEN at position {r['position']}: the positions do not run on from {recs[i - 1]['position']}.")
+            print("What to do: keep this output as evidence and ask the institution (the issuer above) to explain the gap."); return 2
+        if r["prev_hash"] != prev:
+            print(f"Chain: BROKEN at position {r['position']}: it does not link to the record before it.")
+            print("What to do: keep this output as evidence and ask the institution (the issuer above) to explain the break."); return 2
+        h = record_hash(prev, r["record"])
+        if h != r["hash"]:
+            print(f"Chain: BROKEN at position {r['position']}: the stored hash differs from the hash recomputed from the record.")
+            print("What to do: keep this output as evidence and ask the institution (the issuer above) to explain the change."); return 2
+        prev = h
+    if prev != pack["head"]:
+        print("Chain: BROKEN: the last record's hash is not the head the pack declares."); return 2
+    print(f"Chain: OK ({len(recs)} of {len(recs)} records recomputed and linked)")
+    try:
+        ok = ed25519_verify(bytes.fromhex(pack["public_key"]), signed_message(pack), bytes.fromhex(pack["signature"]))
+    except Exception:
+        ok = False
+    if not ok:
+        print(f"Signature: INVALID (key {clean(pack.get('key_id'), 80)}). The pack changed after it was signed, or another key signed it.")
+        print("What to do: keep this output and ask the institution which key signed the pack."); return 3
+    print(f"Signature: OK (Ed25519, key {clean(pack['key_id'], 80)}; it covers the header, every record and the summaries)")
+    fp = key_hash(pack["public_key"])
+    if pin is None:
+        print(f"Key: SHA256 {_grouped(fp)}")
+        print("     Not compared. The key inside a pack is the pack's own claim.")
+    elif fp.startswith(pin):
+        print(f"Key: SHA256 {_grouped(fp)}  MATCH with the pack key hash you were sent")
+    else:
+        print(f"Key: SHA256 {_grouped(fp)}  MISMATCH: the pack was signed by a key other than the one you were sent.")
+        print("What to do: do not rely on this pack; ask the institution, by a route you trust, which key signs its packs."); return 6
+    head = pack["head"]
+    grouped = _grouped(head)
+    if expect is None:
+        print(f"Head: {grouped}")
+        print("      Not compared. Add --expect with a head the institution sent you to compare it too.")
+    elif expect == head:
+        print(f"Head: {grouped}  MATCH with the value you were sent")
+    else:
+        print(f"Head: {grouped}  MISMATCH: you were sent a different head.")
+        print("What to do: do not rely on this pack; ask the institution which head is correct."); return 4
+    print("Anchor: not checked (offline). No anchor operator is named yet; once one is, compare the head with its published anchor.")
+    if pin is None:
+        if expect is None:
+            print("Result: INTACT, NOT PINNED. The pack matches its own chain and its own key, but nothing ties that key to the")
+        else:
+            print("Result: INTACT, SIGNER NOT PINNED. The records end at the head you were sent, but a shortened or changed pack")
+            print("        can be re-signed with another key. Nothing ties this pack's key to the")
+        print("        institution. Run again with --key and the pack key hash the institution sent you by another route.")
+        return 1
+    print("Result: VERIFIED. The pack was not changed after the pack key you were sent signed it: the header, every record")
+    print("        and the summaries. The same key signs every pack, so check the pack name and positions above are the ones")
+    print("        you expect. It does not prove the records were true when written; that is for the examination.")
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main(sys.argv))

governanceos-0.1.0/src/governanceos.egg-info/PKG-INFO

@@ -0,0 +1,69 @@
+Metadata-Version: 2.4
+Name: governanceos
+Version: 0.1.0
+Summary: Open-source tools from GovernanceOS. First: gos-verify, the offline verifier for GovernanceOS evidence packs.
+Author: GovernanceOS
+License-Expression: Apache-2.0
+Project-URL: Homepage, https://governanceos.si
+Project-URL: Source, https://github.com/GovernanceOS/governanceos
+Project-URL: Verify a pack, https://governanceos.si/verify
+Keywords: ai governance,evidence pack,offline verification,ed25519,model risk
+Classifier: Development Status :: 4 - Beta
+Classifier: Environment :: Console
+Classifier: Intended Audience :: Financial and Insurance Industry
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3
+Classifier: Topic :: Security :: Cryptography
+Requires-Python: >=3.8
+Description-Content-Type: text/markdown
+License-File: LICENSE
+License-File: NOTICE
+Dynamic: license-file
+
+# GovernanceOS
+
+Open-source tools from [GovernanceOS](https://governanceos.si), under the Apache License 2.0. They run on your own machine with Python 3 and nothing else installed, and they make no network calls.
+
+```
+pip install governanceos
+```
+
+## gos-verify: verify an evidence pack offline
+
+An institution that keeps its AI governance records in GovernanceOS can share an evidence pack with an examiner. `gos-verify` checks that pack on the examiner's own machine:
+
+1. It recomputes the SHA-256 hash of every record, checks that each links to the one before it, and checks that the positions run without a gap.
+2. It checks the Ed25519 signature over the whole pack: the header, every record and the summaries.
+3. It prints the signing key's hash and compares it with the one the institution sent you by another route (`--key`), and compares the head with a head it sent you (`--expect`).
+4. It says plainly that the public anchor was not checked, because that needs a network.
+
+```
+gos-verify PACK.json --key KEYHASH [--expect HEAD]
+```
+
+| Exit | Meaning |
+|---|---|
+| 0 | Verified: intact, and signed by the key you pinned |
+| 1 | Intact, but the signer is not pinned |
+| 2 | Chain broken |
+| 3 | Signature invalid |
+| 4 | Head differs from `--expect` |
+| 5 | The pack cannot be read |
+| 6 | The key differs from `--key` |
+
+**What it proves:** the pack was not changed after the key you pinned signed it.
+**What it does not prove:** that the records were true when they were written. That is for the examination.
+
+The same verifier is the single-file download at [governanceos.si/verify](https://governanceos.si/verify). The two are byte-identical.
+
+## Try it
+
+`tests/data` holds a sample pack from a fictional institution and a tampered copy of it:
+
+```
+python -m unittest discover -s tests -v
+```
+
+## License
+
+Apache License 2.0; see [LICENSE](LICENSE) and [NOTICE](NOTICE). The license grants no rights to the GovernanceOS name or marks (section 6).

governanceos-0.1.0/src/governanceos.egg-info/SOURCES.txt

@@ -0,0 +1,13 @@
+LICENSE
+NOTICE
+README.md
+pyproject.toml
+src/governanceos/__init__.py
+src/governanceos/cli.py
+src/governanceos/verify.py
+src/governanceos.egg-info/PKG-INFO
+src/governanceos.egg-info/SOURCES.txt
+src/governanceos.egg-info/dependency_links.txt
+src/governanceos.egg-info/entry_points.txt
+src/governanceos.egg-info/top_level.txt
+tests/test_verify.py

governanceos-0.1.0/src/governanceos.egg-info/dependency_links.txt

@@ -0,0 +1 @@
+

governanceos-0.1.0/src/governanceos.egg-info/entry_points.txt

@@ -0,0 +1,2 @@
+[console_scripts]
+gos-verify = governanceos.cli:verify

governanceos-0.1.0/src/governanceos.egg-info/top_level.txt

@@ -0,0 +1 @@
+governanceos

governanceos-0.1.0/tests/test_verify.py

@@ -0,0 +1,47 @@
+"""The verifier against the sample pack and its tampered twin (both public at governanceos.si/verify)."""
+import io
+import json
+import os
+import unittest
+from contextlib import redirect_stdout
+
+from governanceos.verify import key_hash, main
+
+D = os.path.join(os.path.dirname(os.path.abspath(__file__)), "data")
+GOOD = os.path.join(D, "nebula-mutual-2026Q3.pack.json")
+BAD = os.path.join(D, "nebula-mutual-2026Q3-tampered.pack.json")
+
+
+def run(*args):
+    out = io.StringIO()
+    with redirect_stdout(out):
+        code = main(["gos-verify"] + list(args))
+    return code, out.getvalue()
+
+
+class Verify(unittest.TestCase):
+    def setUp(self):
+        with open(GOOD, encoding="utf-8") as f:
+            self.kh = key_hash(json.load(f)["public_key"])
+
+    def test_good_pack_verifies_with_the_pinned_key(self):
+        code, out = run(GOOD, "--key", self.kh)
+        self.assertEqual(code, 0)
+        self.assertIn("VERIFIED", out)
+
+    def test_without_a_pinned_key_it_is_not_verified(self):
+        code, out = run(GOOD)
+        self.assertEqual(code, 1)
+        self.assertNotIn("Result: VERIFIED", out)
+
+    def test_tampered_twin_breaks_the_chain(self):
+        code, _ = run(BAD, "--key", self.kh)
+        self.assertEqual(code, 2)
+
+    def test_a_different_pinned_key_is_refused(self):
+        code, _ = run(GOOD, "--key", "0" * 64)
+        self.assertEqual(code, 6)
+
+
+if __name__ == "__main__":
+    unittest.main()