sworn-verify-cli

Command-line tool to verify SWORN protocol manifests in CI/CD pipelines.

Wraps sworn-verifier (the canonical JS port of the SWORN AT manifest validator) with a thin CLI suitable for GitHub Actions, GitLab CI, Jenkins, or any shell runner.

Install

npm install -g sworn-verify-cli

Or run ad-hoc without install:

npx sworn-verify-cli <url>

Usage

sworn-verify <url>                Verify a manifest at URL, print human-readable decision
sworn-verify <url> --json         Print full ManifestDecision JSON to stdout
sworn-verify <url> --strict       Exit 1 if allow=false (so CI fails on refuse)
sworn-verify --file <path>        Verify a local JSON file (no network)
sworn-verify --version
sworn-verify --help

Exit codes

| Code | Meaning | |------|------------------------------------------------------------------| | 0 | allow=true (or any decision when --strict is not set) | | 1 | allow=false (only when --strict is set) | | 2 | usage error (missing args, bad URL, file read error) |

Examples

Verify a published manifest and fail CI if it gets refused:

sworn-verify https://raw.githubusercontent.com/praxisagent/pact-channels/main/adversarial/at-clean-base-reference.json --strict

Get the full decision JSON for a downstream tool to consume:

sworn-verify https://example.com/manifest.json --json

Verify a local file before publishing it to GitHub:

sworn-verify --file ./build/manifest.json --strict

Decision shape

{
  "url": "https://...",
  "configured": true,
  "fetched_at": "2026-05-04T19:46:00.000Z",
  "status_code": 200,
  "allow": true,
  "reason": null,
  "spec_version": "3.0.0",
  "stripped_hash": "0xa67d408151085fdb4fd484bac555fcbab3cfc60f1fb2cce861edadcc78183999"
}

stripped_hash is the keccak256 of the strict-strip canonical JSON. It is byte-compatible with the reference Go daemon (sworn-autosubmit-watcher.chitacloud.dev) and the Python reproducer.

Spec versions

Currently accepted: 1.0.0, 1.0.1, 2.0.0, 3.0.0.

Anything else gets refused with reason=unknown_spec_version (forward-compat refuse-path, AT-10).

See also

• sworn-verifier — the underlying JS validator (this CLI is a thin wrapper)
• https://sworn-verifier.chitacloud.dev/verify — hosted REST endpoint with the same logic
• https://chenecosystem.com/desk/sworn-adversarial-test-may-2026/ — adversarial test series writeup
• Source spec: https://sworn.chitacloud.dev/manifests/pact-16-spec.json

License

MIT