Verity
中文Get beta

Verity / Verification receipts

A signed record of one local run

A receipt records what Verity checked, which copy of the repository it used, where it ran, and when it ran. The signature lets Verity detect later changes to that record.

What a receipt records

The current raw schema is `verity-verification-receipt.v3`. It binds the result to the repository and snapshot fingerprints, selected target, recorded host and execution environment, completed phases, machine oracle, timestamp, and local Ed25519 signature.

The raw receipt stays local. It may contain paths and detailed execution evidence, so it should be handled like local diagnostic material.

When verification is accepted

The machine command is:

verity verify-receipt RECEIPT.json \
  --repository C:\path\to\repository \
  --json

`accepted` is true only when all of these are true:

  1. the schema is exactly `verity-verification-receipt.v3`;
  2. the Ed25519 signature is valid;
  3. the current repository fingerprint matches;
  4. the original snapshot and repository fingerprints are consistent;
  5. the recorded result is `verified`.

Older schemas are rejected.

Stable rejection reasons

ReasonMeaning
`tampered`The signed content no longer validates.
`stale`The current repository differs from the recorded fingerprint.
`wrong-repository`The receipt belongs to another repository.
`unsupported-schema`The receipt schema is not the current accepted contract.
`not-verified`The original run did not finish with a verified result.

What the JSON response includes

`verity-receipt-verification.v1` returns receipt identifiers, result, signature status, fingerprint match status, `accepted`, and a stable reason code. It does not return source, paths, logs, phase output, or command output.

A local signature proves tamper evidence for this installation. It does not prove who operated the machine, establish remote identity, or certify that a repository is secure.

Use with Agent Guardrails

Agent Guardrails works without Verity. A receipt is consumed only when supplied explicitly:

agent-guardrails check \
  --verity-receipt .\receipt.json \
  --review

An accepted receipt supplies runtime verification evidence only. Scope, security, protected paths, required commands, and evidence files remain independent checks.