Verifier System

Offline verifier and bundles

A verifier bundle is a portable evidence pack. It contains the proof objects needed to verify a stream range without Attesto backend access, plus a manifest that binds the included files.

Offline verifier

The offline verifier checks locally. Online anchor re-checks are optional and explicit, so a reviewer can still verify the core bundle when network access is restricted.

attesto verify receipt ./receipt.json
attesto verify stream ./stream.json
attesto verify checkpoint ./checkpoint.json
attesto verify bundle ./attesto-bundle.json --report ./report.json

Bundle structure

{
  "manifest": {
    "bundle_id": "bundle_...",
    "protocol": "ATTESTO-PROOFSTREAM-001",
    "created_at": "2026-06-07T12:00:00Z",
    "stream_id": "str_...",
    "from_seq_no": 1,
    "to_seq_no": 250,
    "artifact_hashes": {
      "receipts.json": "sha256-hex",
      "windows.json": "sha256-hex",
      "checkpoints.json": "sha256-hex",
      "witnesses.json": "sha256-hex",
      "anchors.json": "sha256-hex"
    }
  }
}

Verifier matrix

Mutation	Expected result
Changed payload	Reject: payload hash no longer matches event commitment.
Changed sequence number	Reject: stream ordering and head hash break.
Removed event	Reject: window inclusion or stream range is incomplete.
Inserted event	Reject: sequence, previous hash, or window commitment changes.
Stale checkpoint	Reject: checkpoint does not match expected stream progression.
Wrong witness signature	Reject: statement signature or key epoch is invalid.
Wrong anchor	Reject: anchor commitment does not bind the included epoch.
Conflicting checkpoint heads	Reject and report fork evidence.

Public verification API

Use POST /v2/verify when an online service wants the same verifier semantics as the CLI.

curl -X POST https://verify.attesto.eu/v2/verify \
  -H "Content-Type: application/json" \
  --data-binary @attesto-bundle.json