✅ 2-minute Verify (DEMO — one-shot GO)

  1. Download Evidence Bundle
  2. Unzip and run:
python3 public_verify_site_release_v50_4.py --evidence-bundle MVG_SiteRelease_Evidence_Bundle_MVG-SITE-DEMO-20260218.1.zip --trust-mode demo

Expected: GO (fail-closed: any mismatch ⇒ HOLD).

Signed status Loading…

Signed status artifact: MVG_SITE_RELEASE_STATUS_LATEST.json (signature)

Verify the signed status artifact (optional) 
gpg --import trust/site-release/demo/pgp.asc
gpg --verify trust/site-release/demo/releases/MVG_SITE_RELEASE_STATUS_LATEST.json.asc \
  trust/site-release/demo/releases/MVG_SITE_RELEASE_STATUS_LATEST.json
Trust & compliance infrastructure

Website release integrity (DEMO)

TRUST_MODE=DEMO

DEMO KEYS ONLY — Not production trust. Do not rely for operational decisions.

This page publishes canonical release pointers and trust anchors for verifying MVG verifier UI assets in an audit-ready way.

For external reviewersPublic verification

You do not need MVG private keys to verify; GO requires MVG-published signatures under the pinned fingerprint.

Unsigned/partial publication = HOLD.

Release Test Attestation (signed) is REQUIRED. If absent: HOLD.

Public verification (1 minute)
Download verifier kit:
  https://meridianverity.com/downloads2/MVG_Public_SiteRelease_Verifier_v50.4.zip

Then verify:

python3 public_verify_site_release_v50_4.py --evidence-bundle trust/site-release/demo/releases/MVG_SiteRelease_Evidence_Bundle_MVG-SITE-DEMO-20260218.1.zip

Outputs GO / HOLD and explains why. No private keys required.

Fail-closed policy
If website integrity cannot be established, verifier pages MUST treat the run as HOLD and direct reviewers to the air‑gapped verifier kit.
Pinned Site release signing key

Signing key fingerprint

Website release manifests are authenticated under the pinned fingerprint below. For trust, use the fingerprint pin and the published public key — do not rely on keyservers.

Pinned fingerprint
7E4D682DF2F98EDBB398705B537D0D9C7C61794C
7E4D 682D F2F9 8EDB B398 705B 537D 0D9C 7C61 794C
Public key (pgp.asc) fingerprint
Latest Signed release pointers

MVG-SITE-DEMO-20260218.1

Release manifest for critical assets (verifier UI, styles, and integrity bootstrap). This supports procurement review: “verify the verifier.”

Manifest (JSON) Signature (.asc): issued in signed releases only.
Offline verification (example) 
gpg --import trust/site-release/demo/pgp.asc
gpg --verify MVG_SITE_RELEASE_MANIFEST_MVG-SITE-DEMO-20260218.1.json.asc MVG_SITE_RELEASE_MANIFEST_MVG-SITE-DEMO-20260218.1.json

If the fingerprint differs, treat the release as untrusted (HOLD) and use the air‑gapped verifier kit.

Air‑gapped verifier kit mvg-trust.json mvg-trust.dsse.json Evidence bundle (ZIP) Release feed (JSON)

Canonical: https://status.meridianverity.com/.well-known/mvg-trust.json. Legacy alias: /trust.json (pointer-only).

Auditors attach (recommended)
These files are designed to be attached to internal audit tickets as a single, verifiable provenance trail. The evidence bundle is the minimal offline attachment set: it includes the signed manifest, the append-only headchain, the trust descriptors (ASC/DSSE), and the pinned public key required to authenticate this release without fetching additional files. 
MVG_SiteRelease_Evidence_Bundle_MVG-SITE-DEMO-20260218.1.zip (recommended)
MVG_SITE_RELEASE_MANIFEST_MVG-SITE-DEMO-20260218.1.json (+ .asc)
MVG_SITE_RELEASE_HEADCHAIN_MVG-SITE-DEMO-20260218.1.json (+ .asc)
mvg-trust.json (+ .asc / .dsse.json)
mvg-contact.json (+ .asc / .dsse.json)
Signing order (normative)
  • Generate the Site Release Manifest (hashes + SRI) and the unsigned trust descriptors (mvg-trust and mvg-contact); do not publish yet.
  • Sign the manifest (.asc) under the pinned site-release signing key.
  • Append a new head to the headchain referencing the manifest digest (and prev_head_sha256), then update mvg-trust pointers to the new release.
  • Sign + publish (one-shot) the headchain, mvg-trust, and mvg-contact artifacts (ASC + DSSE) together. If integrity cannot be established, verifiers MUST fail‑closed to HOLD.

This order is designed for one-shot publish; partial publication MUST be treated as HOLD.

Append-only release heads (optional)

Release heads support monitoring and “no silent rewrite” posture. Heads MUST NOT override receipt pins.

Discovery rail Append-only

For large-scale monitoring, MVG MAY publish a head chain for site releases. Verification MUST use the signed manifest and pinned fingerprint.

Head chain (JSON) Signature (.asc): issued in signed releases only. Release feed (JSON)