Skip to content
Trust • Assurance

# Assurance Pack — offline‑verifiable.

Procurement‑grade evidence bundle: scope, executive summary, attestations, and integrity proofs. Designed so a skeptical security team can verify locally — no uploads, no third‑party scripts.

SHA‑256 DSSE (Ed25519) Contents manifest PASS / FAIL / HOLD Public‑safe

### Current public release (sample format)

v1.0.0 • effective 2026-02-11. This is a public‑safe sample release that demonstrates the offline verification workflow. Binding audit opinions and customer‑specific evidence are provided under agreement.

Download pack (.zip) Verify offline View executive summary (PDF) Evidence Pack index
Keyring snapshot: DSSE • Trust anchors: JSON • Key transparency log: DSSE
Need an assessor‑signed production release? Email security@meridianverity.com or procurement@meridianverity.com.

## What this gives security & procurement

- Fast diligence: one bundle that answers “what exists, what’s verified, what’s NDA-only”.
- Offline integrity: verify hashes + signatures without sending files to anyone.
- Reviewable scope: public-safe documents show what was / wasn’t evaluated.
- Deterministic outcomes: PASS / FAIL / HOLD; fail‑closed when crypto is unavailable.

### Two-minute verification

1. Download the ZIP + DSSE signature file.
2. Open /verify-assurance/ (browser).
3. Select both files → verify.
4. Optional: enable key transparency verification, export a verification receipt, and countersign it as an internal approval certificate (countersign • spec).

### Signed internal approval receipts (countersign)

After you verify the pack offline, the verifier can optionally countersign the receipt using your org/reviewer key (local only) to produce a signed internal approval record. Where supported, you can also countersign via WebAuthn/passkeys (platform authenticator or security key) and optionally include attestation evidence in the countersigned receipt.

Countersign in verifier Spec (v1.0.0) Hardware attestation spec

Reviewer-generated countersignatures. Your org controls signer identity + key provenance.

### Org keyring + threshold policy (2‑of‑3)

For real deal‑closing workflows: provide an org‑owned approval keyring (approved reviewer public keys) plus a threshold policy (e.g., “2‑of‑3 security reviewers must countersign”). The verifier can evaluate this policy locally (offline) and output a deterministic org approval id + downloadable certificate.

Sample keyring Spec (v1.0.0) Ticket binding spec Try in verifier

Optional: bind approvals to JIRA/ServiceNow ticket IDs as signed payload fields (no API calls).

Release artifacts public

All links are first‑party downloads under `/downloads`.

Artifact | File | SHA‑256 | Bytes
--- | --- | --- | ---
Assurance Pack (ZIP) | MVG_Assurance_Pack_PUBLIC_v1.0.0.zip | dbf47d89d42c677c2bd19e2d87635d40b7b9650a23d0a55fc8ca57cd9b29eb34 | 40842
DSSE signature (JSON) | MVG_Assurance_Pack_PUBLIC_v1.0.0.dsse.json | 676f86267c8c15a75d305065f5f9c327a6f947d075049656944972da7d401a7e | 1791
Keyring snapshot (DSSE) | MVG_Assurance_Keyring_PUBLIC_v1.0.0.dsse.json | e08a30a50804e517809ebc361448b28db8bb6e017257a8c6075286939d545ba7 | 5160
Keyring trust anchors (JSON) | MVG_Assurance_Keyring_TrustAnchors_PUBLIC_v1.0.0.json | 457f58c8eef4a6699161261868e79f8aa235033356211805cfad2c9c54ea9e93 | 980
Keyring (JSON) | MVG_Assurance_Keyring_PUBLIC_v1.0.0.json | dafaba85b6baef2ff2627ca336646d261d096ba378e531e41a335e34493da479 | 3238
Key transparency log (DSSE) | MVG_Assurance_KeyTransparency_Log_PUBLIC_v1.0.0.dsse.json | 44b43abd9e52b098d1ac39abeb3ed6c63fa6a7a9e258b06331278f6b10869fd6 | 5522
Key transparency log (JSON) | MVG_Assurance_KeyTransparency_Log_PUBLIC_v1.0.0.json | 527aa010a353dfe8feb4b621fbed9369c701cad96fdb46f8a630de51e3bc621d | 3500
Legacy public keys (JSON) | MVG_Assurance_Assessor_PublicKeys_v1.0.0.json | 905bea4f79c024e998fe7313efe0ba797f0bbf4ddd777e0683064443dab3d630 | 909
Executive summary (PDF) | MVG_Assurance_Report_PUBLIC_v1.0.0.pdf | ddd0eb6ccaa007d8488b656d1aa7c22c385feec127c82dead713ab9d1f210649 | 2831
Org approval keyring (sample) | MVG_Org_Approval_Keyring_SAMPLE_v1.0.0.json | 33c2407d68115213b74e6f72f15dd54b2fde818e59380f84b8c11f73b83743c7 | 2659
Org approval keyring spec (MD) | MVG_Org_Approval_Keyring_Spec_v1.0.0.md | 0b52709f80cc88a95cd85ff65372180d84d8e3993426883bda3d6b02159f1904 | 2499
Receipt ticket binding spec (MD) | MVG_Receipt_Ticket_Binding_Spec_v1.0.0.md | 1068e0bd2bf3668f7f535b15ade39a5863cb000792f1e9eb1a88ad7cc7e9cc57 | 1238

Full checksum ledger: SHA256SUMS.txt
Keyring + rollover Signed DSSE Offline

### Versioned keyring snapshot (rotation‑ready)

Assurance Packs are verified using a signed, versioned keyring snapshot. The offline verifier pins only the keyring trust anchors (bootstrap + witnesses), then derives the active pack signer keys from the verified keyring. This enables safe key rollover without breaking offline verification.

Domain | Role | Key ID (kid)
--- | --- | ---
Keyring | Bootstrap | ta.mvg.assurance.bootstrap.2026-02-11.v1.0.0.demo
Keyring | Witness #1 | ta.mvg.assurance.keyring.witness.1.2026-02-11.v1.0.0.demo
Keyring | Witness #2 | ta.mvg.assurance.keyring.witness.2.2026-02-11.v1.0.0.demo
Pack | Assessor signing | ta.assurance.assessor.signing.2026-02-11.v1.0.0.demo
Pack | Witness #1 | ta.assurance.witness.1.2026-02-11.v1.0.0.demo
Pack | Witness #2 | ta.assurance.witness.2.2026-02-11.v1.0.0.demo

Keyring snapshot (DSSE): MVG_Assurance_Keyring_PUBLIC_v1.0.0.dsse.json • Trust anchors: MVG_Assurance_Keyring_TrustAnchors_PUBLIC_v1.0.0.json
Key transparency Append‑only Hash‑chained

### Key transparency log (public‑safe demo)

An append‑only log records key add/retire events with a SHA‑256 hash chain. The keyring references the current log head. In production: publish immutable versions and never overwrite.

Download log (DSSE) View log (JSON)

### Non‑guarantee / scope

This pack verifies integrity + signatures + inventory. It does not prove universal safety, compliance, or correctness in all contexts. Any binding assurances are contract‑only.