Auditors: start at Trust Center · Runbook
Trust & compliance infrastructure

Website release integrity — canonical PROD + appendix rails

This page publishes canonical release pointers and trust anchors for verifying MVG verifier UI assets in an audit-ready way.

Truth strip Reviewer routing v80.5

Single-source reviewer navigation. If any page text conflicts with a signed receipt, treat it as HOLD and follow the receipt.

/trust/reviewer-index/ Reviewer Index Key roles Site‑release latest
/.well-known/mvg-reviewer-index.json Machine index Signature
Canonical pointer /.well-known/mvg-prod.json (+ .asc) is the single signed production pointer. Determine state from signature validity (fail‑closed): missing ⇒ HOLD; invalid ⇒ FAIL; valid signature ⇒ proceed to verify referenced receipts offline.
Key roles site_release_verification_keyring_url = /trust/site-release/latest/pgp.asc · security_contact_encryption_key_url = /pgp.asc · security.txt
Verifier states PASS: all required proofs verify · HOLD: proof is missing, withheld, or unverifiable (fail‑closed) · FAIL: proof is present but invalid or inconsistent.

🔐 Production posture — offline keys, fail‑closed semantics

Production keys are kept offline. PROD publications are released via a controlled ceremony and include complete signature material. Deterministic output: public verifiers return PASS only when all required signatures and evidence are present and valid. If anything is missing, withheld, or unverifiable, the result is HOLD (fail‑closed). Candidate and demo compatibility remain appendix rails for ceremony review only.

🧭 Canonical public rail — run the PROD command

Use PROD for public verification. Compatibility and candidate rails remain below as appendix references only.

python3 public_verify_site_release_v50_4.py --site-root . --trust-mode prod --verbose

Appendix rails: compatibility rail · candidate ceremony

Enhanced verification (optional): anchors + witness threshold 
# Site release (PROD) — enhanced modes:
python3 public_verify_site_release_v50_4.py --site-root . --trust-mode prod --require-anchors --verbose

python3 public_verify_site_release_v50_4.py --site-root . --trust-mode prod --require-anchors --require-witness-threshold 2 --verbose

# Deployments (PROD) — enhanced modes:
python3 downloads4/public_verify_deploy_txn_v51.py --site-root . --trust-mode prod --require-anchors --verbose

python3 downloads4/public_verify_deploy_txn_v51.py --site-root . --trust-mode prod --require-anchors --require-witness-threshold 2 --verbose

Optional flags only; default PROD is fail‑closed and returns PASS only when the signed receipts prove it.

🔎 Auditor quickstart — 5 canonical links

Prefer one page? Open Trust Center.

External audit can start here. Open these five URLs to reproduce trust posture and evidence (offline-verifiable, fail‑closed).

https://meridianverity.com/.well-known/mvg-trust.json Open
/.well-known/mvg-company.json Open company page
/.well-known/mvg-governance.json Open governance page

Identity receipts (detached signatures): /.well-known/mvg-company.json.asc · /.well-known/mvg-governance.json.asc — see signing & audit runbook.

Operations receipts (detached signatures): /.well-known/mvg-aims.json.asc · /.well-known/mvg-safety-ir.json.asc — see receipts signing ceremony.

Production pointer (receipt; detached signature): /.well-known/mvg-prod.json · /.well-known/mvg-prod.json.asc — missing or unverifiable signature MUST yield HOLD (fail‑closed).

Production anchor (timestamp proof; RFC3161; TSA CA chain via KYB packet): /.well-known/mvg-prod.anchor.json · /.well-known/mvg-prod.receipt.sha256.tsr — missing/placeholder anchor MUST yield HOLD (fail‑closed).

Production anchor #2 (optional; RFC3161; recommended: independent TSA operator): /.well-known/mvg-prod.anchor2.json · /.well-known/mvg-prod.receipt.sha256.tsr2 — missing/placeholder anchor MUST yield HOLD when required.

Production witness ceremony evidence (public‑safe; roles only): /.well-known/mvg-prod.ceremony.json · /.well-known/mvg-prod.ceremony.json.asc — missing or unverifiable signature MUST yield HOLD when required.

https://meridianverity.com/.well-known/mvg-procurement-ticket-pack.dsse.json Open DSSE viewer
/trust/site-release/latest/releases/MVG_SiteRelease_Evidence_Bundle_MVG-SITE-PROD-20260227.3.zip Open bundle

🧾 Procurement 1‑pager — what to attach (30‑minute buyer‑run)

For Fortune 500 / Big Tech procurement & security: attach one signed URL (DSSE) and you can reproduce deterministic PASS/FAIL/HOLD offline. Missing/invalid signatures ⇒ HOLD (fail‑closed).

https://meridianverity.com/.well-known/mvg-procurement-ticket-pack.dsse.json Open DSSE viewer
/trust/security-review/packet.pdf Open packet

Packet sha256 is committed into the procurement transparency log leaf: inclusion proof.

/.well-known/mvg-procurement-inputs.json

Outputs (generated by the verifier kit): MVG_AuditSummary.pdf · MVG_CountersignedApproval.json · MVG_KitSupplyChainReceipt.json

Open Pass Kit Verify offline Security packet (PDF) Production rail

Appendix — compatibility rail (demo mode)

For Microsoft / Big Tech reviewers: reproduce deterministic public verification end-to-end without MVG production keys.

  1. Download compatibility evidence bundle
  2. Download Procurement Ticket Pack (sample) (attach 1 zip)
  3. Unzip and run:
python3 public_verify_site_release_v50_4.py --site-root . --trust-mode demo

Verifier output is deterministic: PASS when signatures & evidence verify; otherwise HOLD (fail‑closed). Output includes reason codes.

Signed status Loading…
Verify the signed status artifact (optional) 
# Sample compatibility example (works from Evidence Bundle or full site root):
gpg --import trust/site-release/demo/pgp.asc
gpg --verify trust/site-release/demo/releases/MVG_SITE_RELEASE_STATUS_LATEST.json.asc \
  trust/site-release/demo/releases/MVG_SITE_RELEASE_STATUS_LATEST.json

The website UI is display-only. Signed artifacts are authoritative.

Open demo channel Deployments (demo) Policy & Evidence index

Sample/demo keys only — not production trust.

🏛️ Production rail (PROD — authoritative)

Public PASS requires MVG operator-held production signatures. Unsigned or partial publication ⇒ HOLD.

  1. Download PROD Evidence Bundle
  2. Download Procurement Ticket Pack (PROD) (attach 1 zip)
  3. Unzip and run:
python3 public_verify_site_release_v50_4.py --site-root . --trust-mode prod

Output is deterministic: PASS only when production signatures are complete and valid; otherwise HOLD (fail‑closed). Candidate rail: candidate ceremony rail ⇒ HOLD (exit 2) by design.

Status Loading…
Open PROD channel Deployments (PROD) Policy & Evidence index

Appendix — candidate ceremony rail

Pre‑ceremony candidate channel. Missing signing material is intentional to demonstrate fail‑closed governance: If it’s missing, it’s HOLD.

  1. Download current candidate bundle
  2. Unzip and run:
python3 public_verify_site_release_v50_4.py --site-root . --trust-mode ready_to_sign

Expected: HOLD (exit 2) — by design (candidate).

Open candidate channel
Ops Signing ceremony runbook

Checklist + post‑publish verification (1 page)

Keys stay offline. Publication is atomic. And if anything is missing, the verifier must return HOLD (fail‑closed). This section is the operator template you asked for.

Signing ceremony checklist

  1. Roles: signer (key custodian), operator (publishes), witness (records hashes). Separate duties.
  2. Pinned inputs: fetch pgp.asc + pgp.fingerprint and compare fingerprints before verifying anything else.
  3. Offline signing: produce detached .asc signatures for the evidence bundle and release artifacts.
  4. Atomic publish: upload artifacts + signatures in one deploy (no partial publishes).
  5. Record: bundle sha256 + signature sha256 + verifier output into the audit ticket.
  6. Ops evidence (post‑deploy): run the headers probe (/press/ops/security/headers/), attach ops_headers_<UTC>.txt + the deployed /_headers snapshot (or platform config export). Record ops_headers_<UTC>.txt sha256: in the ticket. Missing attachment or missing sha256 ⇒ HOLD.
Artifacts typically signed
  • /trust/site-release/latest/* (DSSE, headchain, latest pointer, pinned key)
  • /trust/site-release/<rail>/releases/* (feed, manifest, status)
  • /.well-known/mvg-company.json.asc + /.well-known/mvg-governance.json.asc (identity receipts)

Post‑publish verification (offline)

This is the same check a Big Tech reviewer runs from a cold laptop.

# 1) Download the public verifier kit
curl -fsSLO https://meridianverity.com/downloads/MVG_Public_SiteRelease_Verifier_v50.4.zip
unzip -q MVG_Public_SiteRelease_Verifier_v50.4.zip

# 2) Download the evidence bundle
curl -fsSLO https://meridianverity.com/trust/site-release/latest/releases/MVG_SiteRelease_Evidence_Bundle_MVG-SITE-PROD-20260227.3.zip

# 3) Verify
python3 MVG_Public_SiteRelease_Verifier_v50.4/public_verify_site_release_v50_4.py MVG_SiteRelease_Evidence_Bundle_MVG-SITE-PROD-20260227.3.zip
Verifier resultPASS on success; HOLD if any required signature/pointer is missing or unverifiable; FAIL if present but invalid or inconsistent.
Ops evidencePost‑deploy headers probe (curl): /press/ops/security/headers/. Attach ops_headers_<UTC>.txt + the deployed /_headers snapshot (or platform config export). Record ops_headers_<UTC>.txt sha256:. Missing attachment or missing sha256 ⇒ HOLD.

Exact next-step ceremony (missing procurement signatures or demo contact quorum)

These commands are the deterministic remediation path when procurement pointer signatures are missing or a demo site-root verify returns HOLD. Do not change DSSE bytes unless you are also re-issuing the full proof chain.

# PROD procurement pointers (authoritative detached signatures)
export PROD_PROC_FPR="AEEDDA89423655600605CEE2C71186016DA8C25F"

mkdir -p .well-known/mvg-procurement-inputs.json.sig
mkdir -p .well-known/mvg-procurement-inputs.dsse.json.sig
mkdir -p .well-known/mvg-procurement-inputs.prod.dsse.json.sig
mkdir -p .well-known/mvg-procurement-ticket-pack.dsse.json.sig
mkdir -p .well-known/mvg-procurement-ticket-pack.prod.dsse.json.sig

gpg --batch --yes --armor --local-user "$PROD_PROC_FPR" --detach-sign   --output ".well-known/mvg-procurement-inputs.json.sig/${PROD_PROC_FPR}.asc"   ".well-known/mvg-procurement-inputs.json"
cp ".well-known/mvg-procurement-inputs.json.sig/${PROD_PROC_FPR}.asc"    ".well-known/mvg-procurement-inputs.dsse.json.sig/${PROD_PROC_FPR}.asc"
cp ".well-known/mvg-procurement-inputs.json.sig/${PROD_PROC_FPR}.asc"    ".well-known/mvg-procurement-inputs.prod.dsse.json.sig/${PROD_PROC_FPR}.asc"

gpg --batch --yes --armor --local-user "$PROD_PROC_FPR" --detach-sign   --output ".well-known/mvg-procurement-ticket-pack.dsse.json.sig/${PROD_PROC_FPR}.asc"   ".well-known/mvg-procurement-ticket-pack.dsse.json"
cp ".well-known/mvg-procurement-ticket-pack.dsse.json.sig/${PROD_PROC_FPR}.asc"    ".well-known/mvg-procurement-ticket-pack.prod.dsse.json.sig/${PROD_PROC_FPR}.asc"

# Demo site-root HOLD remediation (contact descriptor needs 2-of-3 demo root signatures)
export DEMO_ROOT_FPR_1="5D53D7AC75A0256FF7782F49B4817940D0FBD02E"
export DEMO_ROOT_FPR_2="7CCA0672C9088C82CC0385F16391DA9D9A0CCD8D"
mkdir -p .well-known/mvg-contact.json.sig

gpg --batch --yes --armor --local-user "$DEMO_ROOT_FPR_1" --detach-sign   --output ".well-known/mvg-contact.json.sig/${DEMO_ROOT_FPR_1}.asc"   ".well-known/mvg-contact.json"
gpg --batch --yes --armor --local-user "$DEMO_ROOT_FPR_2" --detach-sign   --output ".well-known/mvg-contact.json.sig/${DEMO_ROOT_FPR_2}.asc"   ".well-known/mvg-contact.json"

# Re-verify after publishing
python3 public_verify_site_release_v50_4.py --site-root . --trust-mode prod --verbose
python3 public_verify_site_release_v50_4.py --site-root . --trust-mode prod --require-anchors --verbose
python3 public_verify_site_release_v50_4.py --site-root . --trust-mode prod --require-anchors --require-witness-threshold 2 --verbose
python3 downloads4/public_verify_deploy_txn_v51.py --site-root . --trust-mode prod --verbose
python3 downloads4/public_verify_deploy_txn_v51.py --site-root . --trust-mode prod --require-anchors --verbose
python3 downloads4/public_verify_deploy_txn_v51.py --site-root . --trust-mode prod --require-anchors --require-witness-threshold 2 --verbose
Deterministic HOLD labelsHOLD_PROCUREMENT_POINTER_UNSIGNED = detached procurement signatures missing. HOLD_DEMO_CONTACT_DESCRIPTOR_UNSIGNED = site-root demo lacks the required 2-of-3 contact descriptor quorum.

Audit ticket template (copy/paste)

Title: MVG — Site release verification (post‑publish)

Release evidence:
- Evidence bundle: https://meridianverity.com/trust/site-release/latest/releases/MVG_SiteRelease_Evidence_Bundle_MVG-SITE-PROD-20260227.3.zip
- Pinned signing key: https://meridianverity.com/trust/site-release/latest/pgp.asc
- Pinned fingerprint: https://meridianverity.com/trust/site-release/latest/pgp.fingerprint

Verification (offline):
- python3 public_verify_site_release_v50_4.py MVG_SiteRelease_Evidence_Bundle_MVG-SITE-PROD-20260227.3.zip

Expected:
- Deterministic (PASS / HOLD / FAIL). Missing or placeholder signatures MUST be treated as HOLD.
Observed:
- [paste verifier output]

Recorded hashes:
- bundle sha256: [paste]
- signature sha256 (if used): [paste]

Ops evidence (post‑deploy):
- Headers probe (curl): https://meridianverity.com/press/ops/security/headers/ (attach ops_headers_<UTC>.txt)
- ops_headers_<UTC>.txt sha256: [paste]
- Hosting headers policy snapshot: https://meridianverity.com/_headers (attach deployed copy or platform config export)

Ops gate:
- If either attachment is missing, or ops_headers sha256 is not recorded: HOLD (do not grant GO)
3× placementThis runbook is linked from here (official), from the DSSE viewer ticket copy block (practical), and from the security review page (audit pointers).
Display-only UI Receipts, not promises

This page does not decide PASS/HOLD/FAIL. It displays the latest result from signed artifacts published on the trust rails.

https://meridianverity.com/.well-known/mvg-status.dsse.json
/.well-known/mvg-procurement-inputs.json

See: Signed status aggregator

If any signed artifact is missing or mismatched, the verifier returns HOLD (fail‑closed).

For external reviewersPublic verification

You do not need MVG private keys to verify; public PASS requires MVG-published signatures under the pinned fingerprint.

Unsigned/partial publication = HOLD.

Release Test Attestation (signed) is REQUIRED. If absent: HOLD.

Public verification (1 minute)
Download verifier kit:
  https://meridianverity.com/downloads2/MVG_Public_SiteRelease_Verifier_v50.4.zip

See channel pages:
  • Production: /trust/site-release/latest/
  • Demo: /trust/site-release/demo/

Each channel provides its own evidence bundle + verifier command (offline).

Outputs PASS / HOLD / FAIL and explains why. No private keys required.

Fail-closed policy
If website integrity cannot be established, verifier pages MUST treat the run as HOLD and direct reviewers to the air‑gapped verifier kit.
Pinned Site release signing key

Signing key fingerprint

Website release manifests are authenticated under the pinned fingerprint below. For trust, use the fingerprint pin and the published public key — do not rely on keyservers.

Pinned fingerprint
Offline (operator‑held).
PROD: PASS only when all required detached signatures verify. Candidate rail: intentional HOLD.
Public key (pgp.asc) fingerprint
Latest Current release pointers

MVG-SITE-PROD-20260227.3

Release manifest for critical assets (verifier UI, styles, and integrity bootstrap). This supports procurement review: “verify the verifier.”

Manifest (JSON) Signature (.asc): issued in signed releases only.
Offline verification (example) 
gpg --import trust/site-release/latest/pgp.asc
gpg --verify MVG_SITE_RELEASE_MANIFEST_MVG-SITE-PROD-20260227.3.json.asc MVG_SITE_RELEASE_MANIFEST_MVG-SITE-PROD-20260227.3.json

If the fingerprint differs, treat the release as untrusted (HOLD) and use the air‑gapped verifier kit.

Air‑gapped verifier kit mvg-trust.json mvg-trust.dsse.json Evidence bundle (ZIP) Release feed (JSON)

Canonical: https://meridianverity.com/.well-known/mvg-trust.json. Legacy alias: /trust.json (pointer-only).

Auditors attach (recommended)
These files are designed to be attached to internal audit tickets as a single, verifiable provenance trail. The evidence bundle is the minimal offline attachment set: it includes the signed manifest, the append-only headchain, the trust descriptors (ASC/DSSE), and the pinned public key required to authenticate this release without fetching additional files. 
MVG_SiteRelease_Evidence_Bundle_MVG-SITE-PROD-20260227.3.zip (recommended)
MVG_SITE_RELEASE_MANIFEST_MVG-SITE-PROD-20260227.3.json (+ .asc)
MVG_SITE_RELEASE_HEADCHAIN_MVG-SITE-PROD-20260227.3.json (+ .asc)
mvg-trust.json (+ .asc / .dsse.json)
mvg-contact.json (+ .asc / .dsse.json)
Signing order (normative)
  • Generate the Site Release Manifest (hashes + SRI) and the unsigned trust descriptors (mvg-trust and mvg-contact); do not publish yet.
  • Sign the manifest (.asc) under the pinned site-release signing key.
  • Append a new head to the headchain referencing the manifest digest (and prev_head_sha256), then update mvg-trust pointers to the new release.
  • Sign + publish (one-shot) the headchain, mvg-trust, and mvg-contact artifacts (ASC + DSSE) together. If integrity cannot be established, verifiers MUST fail‑closed to HOLD.

This order is designed for one-shot publish; partial publication MUST be treated as HOLD.

Append-only release heads (optional)

Release heads support monitoring and “no silent rewrite” posture. Heads MUST NOT override receipt pins.

Discovery rail Append-only

For large-scale monitoring, MVG MAY publish a head chain for site releases. Verification MUST use the signed manifest and pinned fingerprint.

Head chain (JSON) Signature (.asc): issued in signed releases only. Release feed (JSON)