Verify offline

keystone-ci-verify.py is one file, imports no CAIN code, and needs only cryptography. Pin the key once; never fetch it at verify time.

gh api repos/OWNER/REPO/pulls/N -H "Accept: application/vnd.github.diff" > pr.diff
python3 keystone-ci-verify.py attestation.json --pubkey b6hfA2rpAdV29FOdhNXGkk4t91mCV0AnfFYwq0HO0R8= \
    --diff pr.diff --head-sha "$(git rev-parse HEAD)" --require PASS

Exit 0 = valid and the verdict is one you accept; 1 = not valid (the reason is printed); 2 = usage error. We ran it on a live attestation: valid with its own diff, NOT VALID with another sample's diff ("issued for different code"), NOT VALID with a wrong key.

Public key: b6hfA2rpAdV29FOdhNXGkk4t91mCV0AnfFYwq0HO0R8= (also at /keystone-ci/public-key).

FIRME AI CORPORATION · CAIN-42 is a Byzantine trust fabric. Numbers marked "our own check" were run by us, not by an independent party. Nothing on these pages is a certification.