Verify Execution Certificate
sqlguard_verifyREQUIRED before production execute. Verify Execution Certificate signature, expiry, and PASS. If verify fails, do not write.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| signature | Yes | Ed25519 signature string over the certificate bytes | |
| accept_demo | No | If true, accept demo-mode certificates (non-production) | |
| certificate | Yes | Execution Certificate object returned by sqlguard_validate | |
| public_key_pem | No | Optional PEM public key; defaults to SQLGuard live attestation key | |
| expected_sql_hash | No | Optional hex hash that must match certificate.sql_hash | |
| expected_schema_hash | No | Optional hex hash that must match certificate.schema_hash |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| valid | No | Whether the certificate signature and claims verify | |
| reasons | No | Failure reasons when valid is false | |
| decision | No | PASS/FAIL from the verified certificate |