gwt-verify

Offline verifier CLI for Gravity Lock signed artifacts.

Quick start

cd verifier
npm install
npm test

Commands

• gwt-verify <artifact.json>
• gwt-verify <artifact.json> --json
• gwt-verify <artifact.json> --pubkey <fingerprint>
• gwt-verify <artifact.json> --bundle <bundle.json> (custody cross-check)
• gwt-verify <artifact.json> --sample <n> (pipeline trace replay sample size)
• gwt-verify --version

Example usage

# Verify extension signed bundle
gwt-verify ./examples/bundle.json

# Machine-readable output
gwt-verify ./examples/bundle.json --json

# Enforce expected signer fingerprint
gwt-verify ./examples/bundle.json --pubkey "aa:bb:cc:..."

# Verify custody manifest against referenced bundle
gwt-verify ./examples/custody.json --bundle ./examples/bundle.json

# Verify pipeline trace with bounded replay sample size
gwt-verify ./examples/pipeline_trace.json --sample 25

Packaging smoke

• npm test runs verifier unit/integration tests
• npm run test:pack builds a tarball and verifies install-path execution (gwt-verify --version)

Exit codes

• 0: all checks pass
• 1: signature verification failed
• 2: canonical hash mismatch
• 3: semantic verification failure
• 4: unknown schema or unsupported artifact type
• 5: --pubkey fingerprint mismatch
• 99: malformed input / read error / bad flags

Current coverage

• Extension signed bundles (gwt.bundle.v1) with:
  • canonical hash re-derivation
  • Ed25519 signature verification
  • audit prev_event_hash chain check
  • schema dispatch for 0.12 / 0.14 / 0.15 / 0.16
• Additional artifact semantics:
  • gwt.custody_manifest.v1: referenced bundle hash cross-check (--bundle)
  • gwt.pipeline_trace.v1: reconstruction replay against transformed_input_hash
  • gwt.coherence_report.v1: recompute and validate summary statistics
  • gwt.nucleus.v1: recompute weighted composite nucleus score
  • gwt.unified_bundle.v1: container signature + embedded extension/server bundle verification

Publish and npx flow

Use:

• verifier/RELEASE.md for full release runbook (version bump, pack/install smoke, publish, post-publish npx validation)
• verifier/PUBLISH_READY_CHECKLIST.md for operator checklist
• npm run release:check (or npm run release:check:full) for executable readiness checks