Verify offline

Python (needs only cryptography)

import json, base64
from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PublicKey
r = json.load(open("receipt.json"))
assert r["schema"] == "cain42.keystone.codeguard-decision.v1" and r["decision"] in ("ALLOW", "DENY", "REQUIRE_APPROVAL")
body = {k: v for k, v in r.items() if k not in ("signature_b64", "public_key_b64")}
Ed25519PublicKey.from_public_bytes(base64.b64decode(PINNED_KEY)).verify(
    base64.b64decode(r["signature_b64"]), json.dumps(body, sort_keys=True, separators=(",", ":"), ensure_ascii=False).encode())

Browser or Node 20+

WebCrypto supports Ed25519: canonical JSON is JSON.stringify with keys sorted at every level. The lab does exactly this.

Where to get the key

/codeguard-keystone/public-key. Fetching it from the same server proves the receipt was not changed, not who signed it; compare the fingerprint with one published elsewhere (for example the NULLIUS verifier kits) and pin it.

FIRME AI CORPORATION · CAIN-42 is a Byzantine trust fabric. Numbers marked "our own check" were run by us, not by an independent party. Nothing on these pages is a certification.