@primust/verifier

Offline TypeScript verifier and relying-party evaluator for Primust Governed-Execution Credentials and Action Clearances.

pnpm add @primust/verifier

The package ships two CLIs:

• primust-verify <artifact.json> verifies artifact structure, commitments, and signatures.
• primust-rely <requirement.yaml> <clearance.json> --revocation-snapshot <path> evaluates a relying party's declared requirement and fails closed.

Action Clearance revocation

Revocation facts are never trusted from the clearance or fetched implicitly. The caller supplies an independently authenticated action-clearance-revocation-snapshot/1 with ordered RFC3339 generated_at/expires_at timestamps, coverage_scope: global_per_covered_key, a non-empty covered_key_fingerprints array, and the three revocation arrays: revoked_clearance_ids, revoked_key_ids, and revoked_key_fingerprints.

Every fingerprint is sha256:<64 lowercase hex> over an exact raw 32-byte Ed25519 public key. A producer that marks a snapshot checked MUST include every revocation for every clearance signed by each covered key. Tenant-filtered or otherwise partial feeds are forbidden under this schema; future scoped feeds require a new schema bound to a load-bearing clearance scope. A checked snapshot is usable only if covered_key_fingerprints includes the fingerprint of the exact issuer key that verified the clearance. A snapshot for another trust domain remains unknown and cannot satisfy primust-rely.

Known matching revocations are monotonic even outside the snapshot time window. A clean result requires a current, correctly scoped snapshot.

Producer and authentication boundary

Version 2.0 ships the consumer contract, not a platform snapshot publisher. The Primust API in this candidate does not expose a route or signed file that can be treated as an authenticated action-clearance-revocation-snapshot/1. Do not trust arbitrary JSON merely because it came from a request, a clearance, or a TLS endpoint. Until a separately pinned producer or signed wrapper is ratified and provisioned, primust-rely is expected to fail closed with an unknown revocation state.

2.0 breaking-change and migration note

Version 2.0 introduces the fail-closed revocation contract. Snapshot producers must include coverage_scope: global_per_covered_key and covered_key_fingerprints. primust-rely now emits record_type: reliance-decision/2, which adds the mandatory revocation_checked check and revocation verification fields.

This is a major release because a reliance call that previously returned satisfied now returns unsatisfied until the caller supplies an independently authenticated, current snapshot that covers the verified issuer key. The snapshot option remains syntactically optional so structural-verification callers can upgrade without inventing revocation facts; it is semantically mandatory for a successful primust-rely decision. Consumers that parse reliance-decision/1 must add /2 support before upgrading.

primust-verify deliberately reports structural validity separately from reliance readiness: a correctly signed clearance may exit 0 while its revocation status is unknown_*. Use primust-rely for the authorization decision; it exits 0 only when revocation is checked_not_revoked and all requirements pass.

Apache-2.0.