tanilo-receipt-verify 0.1.0__tar.gz

tanilo_receipt_verify-0.1.0/CHANGELOG.md

@@ -0,0 +1,56 @@
+# Changelog
+
+## Unreleased — `jwks_is_complete` parameter
+
+New keyword argument on `verify()`: `jwks_is_complete: bool = False`.
+
+An unresolved `kid` is ambiguous on its own — it can mean "this is just whatever keys I fetched" (a gap) or "this IS my complete trust list" (a refusal). Previously the verifier always assumed the former. Now the caller says which:
+
+- **`jwks_is_complete=False` (default, no behavior change):** an unresolved `kid` reports `verified: None`; overall status is `indeterminate` when nothing else fails. Identical to every prior release.
+- **`jwks_is_complete=True`:** an unresolved `kid` reports `verified: False`, an error naming the `kid` is added to `.errors`, and overall status is `invalid` — a policy refusal, not a gap. Applies both to the partial-JWKS case (some issuers supplied, this one isn't) and to the fully-omitted case (no JWKS supplied at all, declared complete regardless).
+
+Does not change how a signature that resolves and genuinely fails cryptographic verification is reported — that is `invalid` under either setting, unchanged.
+
+Converged out of the tsc#4 GitHub thread (2026-09-24): [robertolocatelli81-dev](https://github.com/robertolocatelli81-dev)'s `keys_are_complete` and [babyblueviper1](https://github.com/babyblueviper1)'s `--referenced-set-is-complete` (shipped in [preaction-governance-conformance@3ffddb0](https://github.com/babyblueviper1/preaction-governance-conformance/commit/3ffddb0)) are the same split applied to different artifacts — a JWKS key set here, a referenced-proof set there. `jwks_is_complete` is that shape, credited to both, applied to this package's own JWKS lookup.
+
+**Test coverage:** `tests/test_jwks_is_complete.py`, 7 tests — the default-unchanged case, the declared-complete refusal case (partial JWKS and fully-omitted JWKS), confirms a resolved signer's `verified: True` is untouched by the flag, and confirms the flag never softens a genuine cryptographic failure.
+
+## 0.1.0 — first release of `tanilo-receipt-verify`
+
+Supersedes `agentoracle-receipt-verify` 0.1.0. Same verifier, same API, one defect correction (AC-11).
+
+### AC-11 — partial-JWKS case no longer reported as `invalid`
+
+`agentoracle-receipt-verify` 0.1.0 handled the fully-omitted-JWKS case correctly (`indeterminate`, not `valid`). It did not handle the partial case: a composed, multi-signer envelope where the caller supplies JWKS for some but not all signers.
+
+For a signer whose `kid` had no match in any supplied JWKS, 0.1.0 recorded `{"verified": False}` — indistinguishable from a genuine cryptographic signature failure. `all_signatures_verified` then read that as a real failure, and adjudication ranked it above "unevaluated," so the envelope came back `status: "invalid"` — a verdict about a signature that was never actually checked, not one that failed a check.
+
+This release distinguishes the two cases:
+
+- **Unresolved key lookup** (no JWK for that signer's `kid` in any supplied issuer's set) → `verified: None`, `issuer: "unresolved"`. Overall status is `indeterminate` when every other check passes, with `indeterminate_reason` naming the unresolved `kid`(s).
+- **Cryptographic failure** (key found, signature checked, verification fails) → `verified: False`. Overall status is `invalid`.
+
+Precedence rule: a real `False` outranks a `None` for the overall `all_signatures_verified` check. All-`None`-no-`False` means every signer that had key material verified, and at least one signer's key was never supplied — an honest "could not fully check," not a pass and not a fail.
+
+**Upgrading:** if your code branches on `status == "invalid"` to detect a partial-JWKS call, that call now correctly returns `status == "indeterminate"` instead. `result.errors` no longer contains a "signature verify failed" line for a signer whose key was never supplied — check `result.indeterminate_reason` for that case instead.
+
+**Test coverage:** `tests/test_ac11_partial_jwks.py` locks this in with a real multi-signer fixture (three genuine Ed25519 signers). Its core assertions were confirmed to fail against the actual published `agentoracle-receipt-verify==0.1.0` wheel (status came back `invalid` with the unresolved kid in `errors`) and pass against this release. The file also promotes five other hand-checked scenarios from the fix into the permanent suite: all-omitted and empty-dict JWKS on a multi-signer envelope, a genuine cryptographic failure with the key present, a mixed real-failure-plus-unresolved-key case (failure must still outrank unresolved), and a fully resolvable single- and three-signer happy path.
+
+### Also in this release
+
+- Package renamed `agentoracle-receipt-verify` → `tanilo-receipt-verify`. Import path is now `from tanilo_receipt_verify import verify` (previously `agentoracle_receipt_verify`).
+- No behavior changes beyond the AC-11 fix above. Everything in `agentoracle-receipt-verify` 0.1.0's own CHANGELOG entry (tri-state `status`/`valid`, `indeterminate_reason`, fail-closed `None`) carries forward unchanged.
+
+---
+
+## Prior history (as `agentoracle-receipt-verify`)
+
+### 0.1.0 — 2026-08-11
+
+**Corrected a defect in 0.0.1 that could report a signed envelope as `valid` without checking any signature.**
+
+`verify(envelope, jwks_by_issuer=None)` gated all signature verification behind the presence of key material. Called without `jwks_by_issuer` on a genuinely signed envelope, it returned `valid=True` with zero signatures checked. Fixed by introducing the tri-state `status` (`"valid"` / `"invalid"` / `"indeterminate"`) and making `valid` `Optional[bool]`, `None` when indeterminate.
+
+### 0.0.1 — 2026-06-01
+
+Initial release. Superseded — see above.

tanilo_receipt_verify-0.1.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 TK Collective LLC
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

tanilo_receipt_verify-0.1.0/MANIFEST.in

@@ -0,0 +1,5 @@
+include README.md
+include CHANGELOG.md
+include LICENSE
+recursive-include tests *.py
+recursive-include tests/fixtures *.json

tanilo_receipt_verify-0.1.0/PKG-INFO

@@ -0,0 +1,118 @@
+Metadata-Version: 2.4
+Name: tanilo-receipt-verify
+Version: 0.1.0
+Summary: Verifier for composed verification-state envelopes (RFC 8785 JCS + EdDSA/ES256 JWS). Canonicalization is byte-identical to the production Node canonicalizer. Supersedes agentoracle-receipt-verify 0.1.0.
+Author-email: Joe Krausz <joe@tanilo.io>
+License-Expression: MIT
+Project-URL: Homepage, https://tanilo.io
+Project-URL: Repository, https://github.com/TKCollective/tanilo-receipt-verify
+Requires-Python: >=3.9
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: cryptography>=42.0.0
+Dynamic: license-file
+
+# tanilo-receipt-verify
+
+Verifier for composed verification-state envelopes: RFC 8785 JCS canonicalization plus EdDSA/ES256 JWS signature verification. Canonicalization output is byte-identical to the production Node canonicalizer.
+
+**JCS number formatting:** this implementation's number serialization matches RFC 8785 for the value ranges receipt fields actually use (small integers and simple decimals) — it does not implement the full RFC 8785 §3.2.2.3 ECMAScript-compatible number-to-string algorithm across every double (extreme exponents, `-0`, etc.). If a future receipt field ever carries a number outside that range, re-verify canonicalization against the Node reference before trusting a byte-identical claim for it.
+
+**Supersedes `agentoracle-receipt-verify` 0.1.0.** Same author, same verifier, corrected defect (AC-11) described below. If you have `agentoracle-receipt-verify` installed, switch to this package; `agentoracle-receipt-verify` will not receive further fixes.
+
+## Design goal
+
+Three language bindings, one canonicalization. A receipt canonicalized in Node, Python, or the browser must produce the byte-identical string and byte-identical SHA-256. No language-specific behavior. No trusted issuer round-trip.
+
+## Install
+
+```bash
+pip install tanilo-receipt-verify
+```
+
+## Usage
+
+**Key material is required to reach a verdict.** Pass `jwks_by_issuer`:
+
+```python
+from tanilo_receipt_verify import verify
+
+result = verify(envelope, jwks_by_issuer={
+    "https://agentoracle.co/.well-known/jwks.json": ao_jwks,
+    "https://agenttrust.uk/.well-known/jwks.json": at_jwks,
+})
+
+if result.status == "valid":
+    print("verified — canonical:", result.canonical_sha256)
+```
+
+### Three outcomes, not two
+
+| `status` | `valid` | Meaning |
+|---|---|---|
+| `"valid"` | `True` | Every check ran and passed |
+| `"invalid"` | `False` | A check ran and failed; see `.errors` |
+| `"indeterminate"` | `None` | A check could not run; see `.indeterminate_reason` |
+
+**Calling `verify(envelope)` without `jwks_by_issuer` on a signed envelope returns `indeterminate`, not `valid`.** Canonicalization recompute proves the payload matches its claimed hash; it binds the payload to no issuer. Only the signature does that. A verifier that reported `valid` there would assert a property it never tested.
+
+`None` is falsy, so `if result.valid:` fails closed. Branch on `.status` when you need to distinguish "failed" from "could not check".
+
+## What it checks
+
+| Invariant | Description |
+|---|---|
+| `canonical_recomputes` | JCS(payload) → SHA-256 recomputes byte-identical to claimed |
+| `decision_ref_recomputes` | `sha256(JCS(preimage))` matches published `decision_ref` (per invinoveritas/babyblueviper1 spec) |
+| `decision_signer_ne_runtime` | Decision signer issuer ≠ runtime issuer (fail-closed: self-approval is void). `None` when either issuer is absent from the payload — the check could not run, which is not the same fact as "it ran and they matched" |
+| `all_signatures_verified` | Every JWS signature (`EdDSA` or `ES256`, per draft-krausz-verification-state-02 §5.1) verifies against a resolvable JWK by `kid`. `None` when a signer's key material could not be resolved from the supplied JWKS, its key material was malformed, or its algorithm isn't one of the two this verifier implements — unevaluated, not failed. `False` for an unresolved kid instead of `None` when `jwks_is_complete=True` — see below |
+
+## Corrects a defect in `agentoracle-receipt-verify` 0.1.0 (AC-11)
+
+"AC-11" names this bug *class* — a checker's own incomplete input reported as a finding about the artifact it's checking, rather than a fact about the checker — as case AC-11 in [stillmarcus24/assurance-run](https://github.com/stillmarcus24/assurance-run), the independent conformance suite this class of defect was first named in. This package's own instance of it (below) is credited under that name, not coined here.
+
+`agentoracle-receipt-verify` 0.1.0 correctly returned `indeterminate` when called with **no** `jwks_by_issuer` at all. It did **not** correctly handle the partial case: a composed, multi-signer envelope where the caller supplies JWKS for *some* but not *all* signers.
+
+For a signer whose `kid` could not be matched against any supplied JWKS, 0.1.0 recorded `{"verified": False}` — the same value a genuine cryptographic signature failure produces. `all_signatures_verified` then read that as a real failure, and the adjudication logic ranked it above "unevaluated," returning `status: "invalid"` for an envelope that was never actually disproven — only partially checked.
+
+This package resolves the two cases distinctly:
+
+- **Signer's `kid` not found in any supplied JWKS** → that signer's entry reports `verified: None`, `issuer: "unresolved"`. The envelope's overall status becomes `indeterminate` (not `invalid`) when every other check passes, with `indeterminate_reason` naming which `kid`(s) could not be resolved.
+- **Signer's `kid` found, signature verification actually run and fails** → that signer's entry reports `verified: False`. The envelope's overall status is `invalid`.
+
+An unresolved key lookup and a cryptographic failure are different facts. Reporting both as `invalid` collapsed "we never checked this" into "this was checked and failed" — the same failure class documented in the 0.1.0 CHANGELOG for the fully-omitted-JWKS case, here on the partial-JWKS path instead.
+
+## The two meanings of a missing key — `jwks_is_complete`
+
+An unresolved `kid` can mean two different things, and this verifier cannot tell them apart on its own:
+
+1. **"This is whatever keys I happened to have on hand."** A missing kid is a gap in what the caller fetched, not a statement about the receipt. That's the default above: `verified: None`, `status: "indeterminate"`.
+2. **"This IS my complete trust list."** The caller is asserting every issuer they will ever accept is already in `jwks_by_issuer`, so a kid that isn't there is a deliberate refusal, not a gap.
+
+Both readings are legitimate; the verifier has no way to guess which one the caller means, so it's an explicit argument instead of a guess:
+
+```python
+result = verify(
+    envelope,
+    jwks_by_issuer={"https://agentoracle.co/.well-known/jwks.json": ao_jwks},
+    jwks_is_complete=True,  # this IS the whole trust list
+)
+# an unresolved kid now reports verified=False, is named in .errors,
+# and the envelope's status is "invalid" — a policy refusal, not a gap
+```
+
+`jwks_is_complete` defaults to `False`, matching every example above with no behavior change. Setting it to `True` only changes what happens when a kid can't be resolved against the supplied JWKS — it does not change how a signature that resolves and genuinely fails cryptographic verification is reported; that's always `invalid` either way.
+
+Credit where it's due: this split converged out of a public thread rather than being invented here. [robertolocatelli81-dev](https://github.com/robertolocatelli81-dev) proposed the same distinction for JWKS lookups as `keys_are_complete` in `cryptovalid-opencore`, and [babyblueviper1](https://github.com/babyblueviper1) shipped the same distinction for a different artifact — a referenced-proof set, not a key set — as `--referenced-set-is-complete` in [preaction-governance-conformance](https://github.com/babyblueviper1/preaction-governance-conformance). Both land on: absent-by-default is an absence, not a judgment; the caller has to declare completeness before a missing entry becomes a refusal. `jwks_is_complete` here is that same shape applied to this package's own JWKS lookup.
+
+## Cross-language guarantees
+
+The `tests/` suite includes byte-identical fixtures shared with the Node reference implementation:
+
+- `test_jcs_byte_identical_to_node` — Python JCS output byte-matches Node output for a payload with nested objects, arrays, unicode, booleans, and integers.
+- `test_decision_ref_recompute_babyblueviper1` — Python recomputes the shipped [invinoveritas fixture](https://github.com/babyblueviper1/preaction-governance-conformance/tree/3e54ee2/examples/decision-ref-recompute), byte-identical to her Python and our Node.
+- `test_conformance_sample_canonical_hash` — reproduces the canonical hash from the production `/v1/conformance/sample` endpoint.
+
+## License
+
+MIT — see `LICENSE`.

tanilo_receipt_verify-0.1.0/README.md

@@ -0,0 +1,104 @@
+# tanilo-receipt-verify
+
+Verifier for composed verification-state envelopes: RFC 8785 JCS canonicalization plus EdDSA/ES256 JWS signature verification. Canonicalization output is byte-identical to the production Node canonicalizer.
+
+**JCS number formatting:** this implementation's number serialization matches RFC 8785 for the value ranges receipt fields actually use (small integers and simple decimals) — it does not implement the full RFC 8785 §3.2.2.3 ECMAScript-compatible number-to-string algorithm across every double (extreme exponents, `-0`, etc.). If a future receipt field ever carries a number outside that range, re-verify canonicalization against the Node reference before trusting a byte-identical claim for it.
+
+**Supersedes `agentoracle-receipt-verify` 0.1.0.** Same author, same verifier, corrected defect (AC-11) described below. If you have `agentoracle-receipt-verify` installed, switch to this package; `agentoracle-receipt-verify` will not receive further fixes.
+
+## Design goal
+
+Three language bindings, one canonicalization. A receipt canonicalized in Node, Python, or the browser must produce the byte-identical string and byte-identical SHA-256. No language-specific behavior. No trusted issuer round-trip.
+
+## Install
+
+```bash
+pip install tanilo-receipt-verify
+```
+
+## Usage
+
+**Key material is required to reach a verdict.** Pass `jwks_by_issuer`:
+
+```python
+from tanilo_receipt_verify import verify
+
+result = verify(envelope, jwks_by_issuer={
+    "https://agentoracle.co/.well-known/jwks.json": ao_jwks,
+    "https://agenttrust.uk/.well-known/jwks.json": at_jwks,
+})
+
+if result.status == "valid":
+    print("verified — canonical:", result.canonical_sha256)
+```
+
+### Three outcomes, not two
+
+| `status` | `valid` | Meaning |
+|---|---|---|
+| `"valid"` | `True` | Every check ran and passed |
+| `"invalid"` | `False` | A check ran and failed; see `.errors` |
+| `"indeterminate"` | `None` | A check could not run; see `.indeterminate_reason` |
+
+**Calling `verify(envelope)` without `jwks_by_issuer` on a signed envelope returns `indeterminate`, not `valid`.** Canonicalization recompute proves the payload matches its claimed hash; it binds the payload to no issuer. Only the signature does that. A verifier that reported `valid` there would assert a property it never tested.
+
+`None` is falsy, so `if result.valid:` fails closed. Branch on `.status` when you need to distinguish "failed" from "could not check".
+
+## What it checks
+
+| Invariant | Description |
+|---|---|
+| `canonical_recomputes` | JCS(payload) → SHA-256 recomputes byte-identical to claimed |
+| `decision_ref_recomputes` | `sha256(JCS(preimage))` matches published `decision_ref` (per invinoveritas/babyblueviper1 spec) |
+| `decision_signer_ne_runtime` | Decision signer issuer ≠ runtime issuer (fail-closed: self-approval is void). `None` when either issuer is absent from the payload — the check could not run, which is not the same fact as "it ran and they matched" |
+| `all_signatures_verified` | Every JWS signature (`EdDSA` or `ES256`, per draft-krausz-verification-state-02 §5.1) verifies against a resolvable JWK by `kid`. `None` when a signer's key material could not be resolved from the supplied JWKS, its key material was malformed, or its algorithm isn't one of the two this verifier implements — unevaluated, not failed. `False` for an unresolved kid instead of `None` when `jwks_is_complete=True` — see below |
+
+## Corrects a defect in `agentoracle-receipt-verify` 0.1.0 (AC-11)
+
+"AC-11" names this bug *class* — a checker's own incomplete input reported as a finding about the artifact it's checking, rather than a fact about the checker — as case AC-11 in [stillmarcus24/assurance-run](https://github.com/stillmarcus24/assurance-run), the independent conformance suite this class of defect was first named in. This package's own instance of it (below) is credited under that name, not coined here.
+
+`agentoracle-receipt-verify` 0.1.0 correctly returned `indeterminate` when called with **no** `jwks_by_issuer` at all. It did **not** correctly handle the partial case: a composed, multi-signer envelope where the caller supplies JWKS for *some* but not *all* signers.
+
+For a signer whose `kid` could not be matched against any supplied JWKS, 0.1.0 recorded `{"verified": False}` — the same value a genuine cryptographic signature failure produces. `all_signatures_verified` then read that as a real failure, and the adjudication logic ranked it above "unevaluated," returning `status: "invalid"` for an envelope that was never actually disproven — only partially checked.
+
+This package resolves the two cases distinctly:
+
+- **Signer's `kid` not found in any supplied JWKS** → that signer's entry reports `verified: None`, `issuer: "unresolved"`. The envelope's overall status becomes `indeterminate` (not `invalid`) when every other check passes, with `indeterminate_reason` naming which `kid`(s) could not be resolved.
+- **Signer's `kid` found, signature verification actually run and fails** → that signer's entry reports `verified: False`. The envelope's overall status is `invalid`.
+
+An unresolved key lookup and a cryptographic failure are different facts. Reporting both as `invalid` collapsed "we never checked this" into "this was checked and failed" — the same failure class documented in the 0.1.0 CHANGELOG for the fully-omitted-JWKS case, here on the partial-JWKS path instead.
+
+## The two meanings of a missing key — `jwks_is_complete`
+
+An unresolved `kid` can mean two different things, and this verifier cannot tell them apart on its own:
+
+1. **"This is whatever keys I happened to have on hand."** A missing kid is a gap in what the caller fetched, not a statement about the receipt. That's the default above: `verified: None`, `status: "indeterminate"`.
+2. **"This IS my complete trust list."** The caller is asserting every issuer they will ever accept is already in `jwks_by_issuer`, so a kid that isn't there is a deliberate refusal, not a gap.
+
+Both readings are legitimate; the verifier has no way to guess which one the caller means, so it's an explicit argument instead of a guess:
+
+```python
+result = verify(
+    envelope,
+    jwks_by_issuer={"https://agentoracle.co/.well-known/jwks.json": ao_jwks},
+    jwks_is_complete=True,  # this IS the whole trust list
+)
+# an unresolved kid now reports verified=False, is named in .errors,
+# and the envelope's status is "invalid" — a policy refusal, not a gap
+```
+
+`jwks_is_complete` defaults to `False`, matching every example above with no behavior change. Setting it to `True` only changes what happens when a kid can't be resolved against the supplied JWKS — it does not change how a signature that resolves and genuinely fails cryptographic verification is reported; that's always `invalid` either way.
+
+Credit where it's due: this split converged out of a public thread rather than being invented here. [robertolocatelli81-dev](https://github.com/robertolocatelli81-dev) proposed the same distinction for JWKS lookups as `keys_are_complete` in `cryptovalid-opencore`, and [babyblueviper1](https://github.com/babyblueviper1) shipped the same distinction for a different artifact — a referenced-proof set, not a key set — as `--referenced-set-is-complete` in [preaction-governance-conformance](https://github.com/babyblueviper1/preaction-governance-conformance). Both land on: absent-by-default is an absence, not a judgment; the caller has to declare completeness before a missing entry becomes a refusal. `jwks_is_complete` here is that same shape applied to this package's own JWKS lookup.
+
+## Cross-language guarantees
+
+The `tests/` suite includes byte-identical fixtures shared with the Node reference implementation:
+
+- `test_jcs_byte_identical_to_node` — Python JCS output byte-matches Node output for a payload with nested objects, arrays, unicode, booleans, and integers.
+- `test_decision_ref_recompute_babyblueviper1` — Python recomputes the shipped [invinoveritas fixture](https://github.com/babyblueviper1/preaction-governance-conformance/tree/3e54ee2/examples/decision-ref-recompute), byte-identical to her Python and our Node.
+- `test_conformance_sample_canonical_hash` — reproduces the canonical hash from the production `/v1/conformance/sample` endpoint.
+
+## License
+
+MIT — see `LICENSE`.

tanilo_receipt_verify-0.1.0/pyproject.toml

@@ -0,0 +1,20 @@
+[project]
+name = "tanilo-receipt-verify"
+version = "0.1.0"
+description = "Verifier for composed verification-state envelopes (RFC 8785 JCS + EdDSA/ES256 JWS). Canonicalization is byte-identical to the production Node canonicalizer. Supersedes agentoracle-receipt-verify 0.1.0."
+authors = [{ name = "Joe Krausz", email = "joe@tanilo.io" }]
+readme = "README.md"
+license = "MIT"
+license-files = ["LICENSE"]
+requires-python = ">=3.9"
+dependencies = [
+  "cryptography>=42.0.0"
+]
+
+[project.urls]
+Homepage = "https://tanilo.io"
+Repository = "https://github.com/TKCollective/tanilo-receipt-verify"
+
+[build-system]
+requires = ["setuptools>=77"]
+build-backend = "setuptools.build_meta"

tanilo_receipt_verify-0.1.0/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+

tanilo_receipt_verify-0.1.0/tanilo_receipt_verify/__init__.py

@@ -0,0 +1,47 @@
+"""Tanilo composed-envelope verifier (Python).
+
+Canonicalizes with RFC 8785 JCS, verifies Ed25519 JWS signatures against
+supplied JWKS, and checks recompute-invariants. JCS output and SHA-256 are
+byte-identical to the production Node canonicalizer; see tests/.
+
+IMPORTANT: `verify()` requires `jwks_by_issuer` to reach a valid/invalid
+verdict. Called without key material on a signed envelope it returns
+`status="indeterminate"` / `valid=None` -- never `valid=True`. Recompute
+alone does not bind a payload to an issuer.
+
+Also in this release: a signer whose key material could not be resolved
+(no matching `kid` in the supplied JWKS for that issuer) now reports
+`verified: None` on that signer specifically -- not `verified: False`.
+A composed envelope with JWKS for some but not all signers previously
+adjudicated the whole envelope `invalid`, collapsing "we never checked
+this signer" into "this signer's signature failed." See CHANGELOG.
+
+Public API:
+    verify(envelope: dict, jwks_by_issuer: dict | None) -> VerifyResult
+    jcs(v) -> str
+    sha256_hex(s: str) -> str
+    recompute_decision_ref(decision_ref_slot: dict) -> str
+"""
+
+from .verify import (
+    verify,
+    jcs,
+    sha256_hex,
+    recompute_decision_ref,
+    VerifyResult,
+    STATUS_VALID,
+    STATUS_INVALID,
+    STATUS_INDETERMINATE,
+)
+
+__all__ = [
+    "verify",
+    "jcs",
+    "sha256_hex",
+    "recompute_decision_ref",
+    "VerifyResult",
+    "STATUS_VALID",
+    "STATUS_INVALID",
+    "STATUS_INDETERMINATE",
+]
+__version__ = "0.1.0"