Concepts

How verification works

Verifying a capsule is two independent checks. The signature proves who sealed it. The receipt proves the log witnessed it. Neither check requires trusting the operator — both run from the bytes, offline.

# verify a receipt's inclusion proof, offline
from scitt_cose import verify_receipt

r = verify_receipt(receipt, leaf_entry_hex=leaf,
                   log_public_key_pem=log_key)
print(r.ok)   # -> True
Vocabulary check: see the word-for-word translation across dev / auditor / spec registers.

What this actually establishes

Auditor register — what a passing check proves, and what it doesn't
  • You do not trust the operator — every claim is checkable from the bytes.
  • You do not need the raw inputs or outputs — verification uses digests.
  • You do not need network access to the operator — you need the public key and the proof.

A derived verdict is not an adjudicated one. verify never grades up: absence isn't forgery, and an unwitnessed record isn't an invalid one — it's simply not yet independently checkable. A passing signature check tells you who signed and that the bytes are intact; a passing inclusion check tells you the record is discoverable and can't be quietly dropped. Neither check tells you the underlying action was correct, authorized, or wise — that's a separate, human judgment the record makes checkable, not one it replaces.

How it works

Check 1 — the signature

The capsule is a COSE_Sign1 structure. Given the issuer's public key, the verifier confirms the signature covers the protected header and payload. If any field changed after signing, the check fails. This establishes who made the statement and that it is intact.

Check 2 — the inclusion proof

The transparency service returns a receipt: a signed proof that the statement's leaf digest sits in the log's Merkle tree at a given size. Given the log's public key and the leaf digest, the verifier recomputes the path to the signed tree head. This establishes that the record was witnessed and is discoverable — not held privately by the operator.

Staying append-only over time

Beyond a single inclusion proof, a verifier can request a consistency proof between two signed tree heads to confirm the log only ever appended — it never rewrote or removed earlier entries. Inclusion answers “is my record in the log?”; consistency answers “has the log stayed honest between then and now?”

Try it without installing anything at the hosted verifier, or run the same library yourself — see Verify a capsule.
Go deeper — implementation & usage docs in capsule-emit: Why witnessing makes it trustworthy ↗ · The public log, explained ↗