legate-verify

Offline verifier for Legate cross-party proofs. Verify a standing-covenant export or an Overlap diversification certificate with no ScopeBlind server and no account. The cryptography (ristretto255 Pedersen commitments + bit-decomposition range proofs, Ed25519 signatures, all @noble) is inlined, so verification runs fully offline and the package is small enough to read.

npx legate-verify covenant-export.json
npx legate-verify diversification-certificate.json
cat artifact.json | npx legate-verify

Export either artifact from the browser: legate.scopeblind.com/covenant ("Download proof") or /overlap ("Download certificate"), then verify it here with our code removed.

Exit codes: 0 every proof verified, 1 something failed, 2 the input could not be read. A validly-proven breach reads as VALID (a signed alarm), which is not the same as an INVALID artifact: validity and health are separate questions, and the verifier says which.

What it checks

• Covenant export — per epoch: the charter is co-signed by every roster member; the epoch is bound to that exact charter (cap, roster, cadence, and the breach-latch flag are all inside the digest); the roster is complete; every sealed value is signed by its party and its source tier attested against the exact commitment; every value is in range; and the resolution proves the aggregate under the cap (HEALTHY) or affirmatively over it (BREACHED, one bit). It then prints the covenant strip, honoring a sticky charter's latch.
• Diversification certificate — every participant co-signed it, the clean bit is consistent with the counts, and it is bound to a match transcript digest (so it cannot be minted for a match that did not happen).

Honest scope

Confirms the math and the signatures. It does not, and cannot, establish that a charter's roster is complete (a counterparty never brought into the charter is outside the covenant; that is the paper's job) or that a self-reported input is true (the tier ladder names that gap). The certificate is an accountable attestation by the participants, not a trustless proof of an empty intersection. The verifier prints this scope.

Apache-2.0. Part of Legate by ScopeBlind. The core is generated from the open source at packages/scopeblind-pm/web/src/{covenant,covenant-v2,psi}.ts.