Skip to content
Proof Playground

# Verify — offline.

Deterministic replay under pinned versions. No uploads. No network.

connect‑src 'none' WebWorker engine Pinned registries PASS / FAIL / HOLD
Input .zip

### Drop a Conformance Pack

All verification runs locally in your browser. Nothing is sent to Meridian Verity Group.

Drag & drop a `.zip` here, or choose a file.

Download sample pack
New: Pilot‑in‑a‑Box (30‑minute self‑serve) — run locally, then drop the generated Conformance Pack here. Overview
What to attach to Jira: Conformance Pack `.zip` + receipts `.jsonl` + signing request `.signing_request.json`.
Copied
Simulations
Self‑test offline

Scenario | Result | Time
--- | --- | ---

Runs PASS / FAIL / HOLD using built‑in packs. Click a row to load details below.
Tip: open once → airplane mode → verify. (No network calls.)
Auditor Mode Security review

### Auditor checks (optional)

Stricter checks. Unsupported crypto/codec → HOLD (fail closed).

Auditor Mode ON

- DSSE (required): verify DSSE envelopes + snapshot_id recomputation.
- COSE + JWS equivalence: if present, all verified envelopes MUST bind identical payload bytes.
- Witness policy: require witness co‑signatures (else HOLD). Threshold:
- Transparency receipts: verify receipt binds `SHA‑256(envelope bytes)` (else HOLD/FAIL).

Non‑guarantee / scope
This verifies integrity + pins + deterministic replayability. It does not prove the system is “safe” in all meanings. Use this as procurement‑grade evidence that the vendor can produce verifiable receipts under pinned semantics.
Verification result —

## —

—

Copy summary

—

### Pinned versions (replay pins)

### Observed reason codes

Open procurement kit
Local signed export uses a session key (integrity-only). For an identity‑anchored export, sign the downloaded request with your org signing key and re‑verify here. Anchors: `ta.mvg.verifier.signing.2026-02-09.v24.demo` · `nvrs:sha256:84532531a4e4952bcb0cce5a989c3805969868470d53cb55b6965b844c3604d1` Key anchors.
Signed report—
Org signer (anchored)external
Bring your own signing key (KMS/HSM). Upload: bootstrap key + trust anchors + signed report. Verified locally.
Mock server OpenAPI curl Spec CLI in trust manifest
— —
No uploads. No network.

Non‑guarantee: This verifies integrity + pins + deterministic replayability. It does NOT guarantee semantic correctness or universal safety.
What is checked Deterministic

- Pack structure + required files
- SHA‑256 digests re‑computed in‑browser
- Registry snapshot_id recomputation + pin match
- DSSE signature verification (Ed25519)
- (Auditor Mode) COSE_Sign1 + JWS verification + payload equivalence
- (Auditor Mode) witness threshold + transparency receipts
- Decision replay: derive PASS/FAIL/HOLD from reason codes under pinned semantics