Click Clack provenance verifier

This Apache-2.0 package independently checks Click Clack contribution exports without the Click Clack application, a database, credentials, or network access.

Install and run

Node.js 22 or newer is required.

npm install --global @gr33r/provenance-verifier
click-clack-verify export.json
click-clack-verify current.json --expect-continues earlier.json
click-clack-verify export.json --json

Exit status 0 means the proof is valid, 1 means the proof failed, and 2 means the command input or export schema could not be read. The default JSON summary is retained for compatibility. --json adds an explicit capabilities object.

The current v3 format proves that the export is internally consistent, signed, and bound to the included manuscript. It additionally binds every new Figment proposal to its exact admitted model and original source passage, every accepted contribution to a workspace-scoped deciding-writer identifier, and an opted-in native paste to the exact text that arrived with source=paste. A paste record proves the paste action only; it does not prove authorship, whether AI was involved, or where the text originated. Legacy v2 exports remain fully readable and are never backfilled with evidence that was not recorded.

Comparing a later export with a receipt you retained can prove that the history has not contradicted that receipt. Neither v2 nor v3 provides operator-independent non-repudiation.

Ordinary verification remains offline. Optional v3 OpenTimestamps evidence is checked for an exact detached-digest binding to the signed checkpoint. A Bitcoin attestation is only an upper time bound after independent best-chain verification; its presence and a server confirmed label are not authority. Use --require-timestamp --bitcoin-rpc-url <url> --bitcoin-cookie-file <path> to verify against an explicitly selected Bitcoin Core node. Credentials belong in the cookie file, never in the URL or command arguments. HTTP is accepted only for loopback; other Bitcoin Core URLs must use HTTPS. The verifier never falls back to public block explorers.

Library API

import { verifyExport } from '@gr33r/provenance-verifier';

const result = verifyExport('export.json', {
  earlierExportFile: 'earlier.json',
});

The package includes fictional, deterministically signed fixtures under fixtures/. The tampered fixtures are expected to fail.

License boundary

This package alone is licensed under Apache-2.0. The private Click Clack application remains UNLICENSED; installing or receiving this package grants no license to the application.