Verify a signed record locally.
Supply a PEAC record and the public key or JWKS you intend to trust. The verifier checks the signature and record profile without uploading the record to Originary.
- Type
- org.peacprotocol/mcp
- Issuer
- https://issuer.example.invalid
- Action
- tools.call search
- Result
- allowed - 200
- Algorithm
- Ed25519 (EdDSA), compact JWS
Use the PEAC CLI with a record and a public key you supply. Verification runs locally; nothing is uploaded to Originary. Generate a sample and verify it:
pnpm dlx @peac/cli@0.16.3 samples generate -o ./s pnpm dlx @peac/cli@0.16.3 verify ./s/valid/basic-record.jws \ --public-key ./s/bundles/sandbox-jwks.json
On success the CLI prints Signature valid (offline); a one-byte change fails with E_INVALID_SIGNATURE. A valid result confirms that the signature is valid under the public key you supplied over the exact protected header and payload bytes. It does not establish that the supplied key is authorized by the declared issuer. What this checks.
Browse a record type, then generate a sample to verify.
pnpm dlx @peac/cli@0.16.3 samples generate -o ./s pnpm dlx @peac/cli@0.16.3 verify ./s/valid/basic-record.jws --public-key ./s/bundles/sandbox-jwks.json
No account. No callback. Nothing stored.
What the verifier checked.
A valid result means
- The signature is valid under the public key you supplied.
- The record was not altered after signing.
- The claims decode exactly as they were signed.
It still does not mean
- That the supplied key is authorized by the declared issuer.
- That the policy was correct or legally sufficient.
- That you have seen the full payload.
- That every related event was shared.
Supplied-key verification is offline.
| How | Network | What it does |
|---|---|---|
| verify --public-key | none | You supply the public key. The signature is checked entirely offline. No fetch, no callback, nothing uploaded to Originary. |
PEAC verification capabilities.
Current release: PEAC v0.16.3. These checks compose; the wire format (0.2) and public schema are unchanged.
Verify a record with only the issuer's public key. The signature is checked entirely offline: no fetch, no callback, no account.
Signatures use Ed25519 (RFC 8032) over compact JWS (RFC 7515), checked with a shared small-order denylist. Runtimes without stable Ed25519 fail closed rather than guess.
The JWS header and payload are validated as I-JSON (RFC 7493) before parsing. Duplicate member names, out-of-range numbers, and invalid strings are rejected, so two verifiers read the same bytes the same way.
A bounded, opt-in guard classifies an already-verified record as fresh, replayed, or outside its acceptance window. Composable; it is not wired into stateless verification.
For request-shaped flows, Originary composes with RFC 9421 HTTP Message Signatures and RFC 9530 content digests computed over the raw body bytes.
A Merkle-style set commitment over a batch of records lets a verifier check inclusion: confirm a record belongs to a published, sealed run without re-checking every other record in the set. A missing record becomes detectable too.