Trust & compliance infrastructure

Website release integrity (PROD)

TRUST_MODE=PROD

Fail‑closed canonical rail. Public verifier results are PASS / HOLD / FAIL. The current machine-readable pointer phase is READY_TO_SIGN, so public status remains HOLD pending publication. No private keys required.

Current machine-readable production pointer phase: READY_TO_SIGN. Public reviewer status remains HOLD until detached signatures and publication proofs are complete.

Status Loading…

Status artifact (receipt): MVG_SITE_RELEASE_STATUS_LATEST.json (.asc)

This page publishes canonical release pointers and trust anchors for verifying MVG verifier UI assets in an audit-ready way.

Truth strip Reviewer routing v80.5

Single-source reviewer navigation. If any page text conflicts with a signed receipt, treat it as HOLD and follow the receipt.

/trust/reviewer-index/ Reviewer Index Key roles Site‑release latest
/.well-known/mvg-reviewer-index.json Machine index Signature
Canonical pointer /.well-known/mvg-prod.json (+ .asc) is the single signed production pointer. Determine state from signature validity (fail‑closed): missing ⇒ HOLD; invalid ⇒ FAIL; valid signature ⇒ proceed to verify referenced receipts offline.
Key roles site_release_verification_keyring_url = /trust/site-release/latest/pgp.asc · security_contact_encryption_key_url = /pgp.asc · security.txt
Verifier states PASS: all required proofs verify · HOLD: proof is missing, withheld, or unverifiable (fail‑closed) · FAIL: proof is present but invalid or inconsistent.
For external reviewersPublic verification

You do not need MVG private keys to verify; public PASS requires MVG-published signatures under the pinned fingerprint.

Unsigned/partial publication = HOLD.

Release Test Attestation (signed) is REQUIRED. If absent: HOLD.

Public verification (1 minute)
Download verifier kit:
  https://meridianverity.com/downloads2/MVG_Public_SiteRelease_Verifier_v50.4.zip

Then verify:

python3 public_verify_site_release_v50_4.py --evidence-bundle trust/site-release/latest/releases/MVG_SiteRelease_Evidence_Bundle_MVG-SITE-PROD-20260227.3.zip

Output is deterministic: PASS only when all required signatures verify; otherwise HOLD (fail‑closed). No private keys required.

Fail-closed policy
If website integrity cannot be established, verifier pages MUST treat the run as HOLD and direct reviewers to the air‑gapped verifier kit.
Pinned Site release signing key

Signing key fingerprint

Website release manifests are authenticated under the pinned fingerprint below. For trust, use the fingerprint pin and the published public key — do not rely on keyservers.

Pinned fingerprint
Pinned fingerprint (site‑release active key):
70FE48225463D34063E024D9C9E4797A0678908B
Public key (pgp.asc) fingerprint
Latest Current release pointers

MVG-SITE-PROD-20260227.3

Release manifest for critical assets (verifier UI, styles, and integrity bootstrap). This supports procurement review: “verify the verifier.”

Manifest (JSON) Signature (.asc): issued in signed releases only.
Offline verification (example) 
gpg --import trust/site-release/latest/pgp.asc
gpg --verify MVG_SITE_RELEASE_MANIFEST_MVG-SITE-PROD-20260227.3.json.asc MVG_SITE_RELEASE_MANIFEST_MVG-SITE-PROD-20260227.3.json

If the fingerprint differs, treat the release as untrusted (HOLD) and use the air‑gapped verifier kit.

Air‑gapped verifier kit mvg-trust.json mvg-trust.dsse.json Evidence bundle (ZIP) Release feed (JSON)

Canonical: https://meridianverity.com/.well-known/mvg-trust.json. Legacy alias: /trust.json (pointer-only).

Auditors attach (recommended)
These files are designed to be attached to internal audit tickets as a single, verifiable provenance trail. The evidence bundle is the minimal offline attachment set: it includes the signed manifest, the append-only headchain, the trust descriptors (ASC/DSSE), and the pinned public key required to authenticate this release without fetching additional files. 
MVG_SiteRelease_Evidence_Bundle_MVG-SITE-PROD-20260227.3.zip (recommended)
MVG_SITE_RELEASE_MANIFEST_MVG-SITE-PROD-20260227.3.json (+ .asc)
MVG_SITE_RELEASE_HEADCHAIN_MVG-SITE-PROD-20260227.3.json (+ .asc)
mvg-trust.json (+ .asc / .dsse.json)
mvg-contact.json (+ .asc / .dsse.json)
Signing order (normative)
  • Generate the Site Release Manifest (hashes + SRI) and the unsigned trust descriptors (mvg-trust and mvg-contact); do not publish yet.
  • Sign the manifest (.asc) under the pinned site-release signing key.
  • Append a new head to the headchain referencing the manifest digest (and prev_head_sha256), then update mvg-trust pointers to the new release.
  • Sign + publish (one-shot) the headchain, mvg-trust, and mvg-contact artifacts (ASC + DSSE) together. If integrity cannot be established, verifiers MUST fail‑closed to HOLD.

This order is designed for one-shot publish; partial publication MUST be treated as HOLD.

Append-only release heads (optional)

Release heads support monitoring and “no silent rewrite” posture. Heads MUST NOT override receipt pins.

Discovery rail Append-only

For large-scale monitoring, MVG MAY publish a head chain for site releases. Verification MUST use the signed manifest and pinned fingerprint.

Head chain (JSON) Signature (.asc): issued in signed releases only. Release feed (JSON)