arkna-verify

Independent verifier for ARKNA evidence bundles.

This CLI takes an ARKNA evidence bundle (zip) and confirms:

1. The bundle contains all required files
2. Every step's step_hash re-computes correctly from its inputs
3. The hash chain is unbroken (each step's prev_hash matches the previous step's step_hash)
4. The attestation chain_root_current matches the chain derived from the bundle's runs
5. Optional anchors (RFC 3161 timestamp, transparency log) are present and consistent

It is pure-JS, offline, and does not contact ARKNA servers. The point is that any third party — a regulator, an auditor, an investigative journalist — can verify an ARKNA-produced evidence bundle without trusting ARKNA.

Install

# One-shot
npx arkna-verify path/to/bundle.zip

# Or globally
npm install -g arkna-verify
arkna-verify path/to/bundle.zip

Exit codes

| Code | Meaning | |---|---| | 0 | PASS — chain integrity verified (warnings allowed) | | 1 | FAIL — at least one error | | 2 | usage / IO error (bundle not found, not a zip, etc.) |

What it checks

| Check | Severity if failed | |---|---| | All required files present in zip | ERROR | | manifest.json parses as JSON | ERROR | | chain-proof.json parses as JSON | ERROR | | Manifest attestation_reference matches chain proof | ERROR | | Each step prev_hash correctly chains | ERROR | | Each step step_hash re-computes correctly | ERROR | | Each run's chain_hash matches its final step's hash | ERROR | | Attestation chain_root_current matches re-computed root | ERROR | | RFC 3161 timestamp present | WARNING | | Transparency log entry present | WARNING |

Hash algorithm

Each step's step_hash is computed as:

canonicalInput   = step.input ?? ''
canonicalPayload = JSON.stringify({
  run_id:    step.run_id,
  sequence:  step.sequence,
  step_type: step.step_type,
  input:     canonicalInput,
  prev_hash: step.prev_hash ?? ''
})
step_hash        = SHA-256(canonicalPayload) hex

This formula is byte-identical across the ARKNA backend, the Node SDK, the Python SDK, the attestation CLI, the browser-side /verify/{ref} ChainWalker, and this CLI. Drift is caught by step-hash-parity.test.ts.

License

MIT.