Sourcey Catalog Verifier

@sourcey/catalog-verifier is Sourcey's deterministic contribution preflight for the Startup Credits and Agent Ready Services data repositories.

It does not verify Catalog releases. Each release names, by digest, the exact verifier archive that verifies it. That archive re-derives every Agent Readiness card the release carries from its declarations and run records. To verify a release, use the archive it names, published at https://artifacts.sourcey.com/catalog/code/catalog-verifier/sha256-<digest>/. Using that archive, rather than whichever version of this package is current, means a release is always judged by the verifier that admitted it. Since 1.2.0 this package no longer has a verify-release command or CatalogVerifierApplication.verifyRelease.

The verifier checks exact local candidate bytes. It does not crawl vendors, judge factual truth, prove submitter authority, run an Agent Readiness assessment, submit data, or make a payment.

Contribution preflight

Validation is deliberately two-step. First derive the bounded identity query from the exact Git objects, then ask Sourcey's public API to sign its current Catalog answer. The final validation remains offline over those saved bytes.

sourcey-catalog-verify identity-context-request startup-credits \
  --repository . \
  --base origin/main \
  --head HEAD \
  --taxonomy ./taxonomy.json \
  --live-parent-release-id sha256:... > identity-query.json

curl --fail-with-body --silent --show-error \
  -H 'content-type: application/json' \
  --data-binary @identity-query.json \
  https://api.sourcey.com/v1/catalog-verifier/identity-contexts \
  | jq '.data' > identity-context.json

sourcey-catalog-verify validate startup-credits \
  --repository . \
  --base origin/main \
  --head HEAD \
  --taxonomy ./taxonomy.json \
  --identity-context identity-context.json \
  --root-set sourcey-root-set.json \
  --trusted-root-digest sha256:... \
  --verified-at "$(node -p 'new Date().toISOString()')"

Use agent-readiness instead of startup-credits for an Agent Ready Services declaration. Run sourcey-catalog-verify explain <repository-kind> for the exact executable criteria and exclusions.

A green result means only that the supplied bytes satisfy the deterministic contribution and identity-context contracts. Sourcey's admission and release authority remains separate.

Supply chain

This repository is a generated public release-source projection from Sourcey's single Catalog verifier owner. Contract and rule changes must be made in that owner and reprojected; pull requests that hand-edit generated implementation files are not accepted.

Published packages contain no install scripts, telemetry, network daemon, browser, mutable plugin loader, or Catalog data. Releases are exact-versioned and carry npm provenance.

License

MIT. See LICENSE and THIRD_PARTY_NOTICES.json.