Process and evidence integrity

Decision Passport · 6

Offline verifier

decision-verifier is a second, independent implementation of the specification, in Go with the standard library only. It shares no code with this website, needs no network access and no account, and is run in CI against the same conformance fixtures as the website's own verifier.

Source on GitHubproduction-keys.jsonengines.jsonrevocations.json

1.Build

Requires Go 1.22 or later. No modules are downloaded.

git clone https://github.com/QuantityNetwork/FaithCompass.git
cd FaithCompass/packages/decision-verifier
GOPROXY=off go build -o decision-verifier .
./decision-verifier --conformance conformance      # every shared fixture must pass (exit 0)

2.Verify a passport

./decision-verifier \
  --keys production-keys.json \
  --engines engines.json \
  [--expected-sha256 <hash you obtained independently>] \
  [--revocations revocations.json] \
  passport.bundle.json
Exit codeMeaning
0VALID
1INVALID (a check failed, including revocation when a list is given)
2UNSUPPORTED (unknown schema or engine)
3Usage or I/O error

The output is a JSON report with every check, its status (pass, fail, uncheckable) and a detail line, identical in structure to the verdict of the online portal.

3.What to trust

  1. Obtain production-keys.json once over a trusted channel and compare it with the pinned file in the repository and the live key document. Verifiers never trust keys carried in a bundle.
  2. engines.json lists the frozen engines by source hash. A bundle from an unknown engine is UNSUPPORTED, not VALID.
  3. A revocation list is accepted only when signed by a pinned key; otherwise the revocation check is “uncheckable”.
  4. For a Deep Analysis passport, re-check the bound report with its own bundle: the report seal must equal subject.report_sha256.

Details: docs/INDEPENDENT_VERIFICATION.md.

Disclaimer. A passport attests to process and evidence integrity, not legal correctness. It is not legal advice, not a qualified electronic signature or seal, and not a certification; no regulatory approval is claimed.