verify_audit_bundle
Verify an audit bundle offline to detect tampering: re-walks hash chains from genesis, matches signed anchor, and checks witnesses. Returns verdict with checks, problems, and limits.
Instructions
OFFLINE verification of an audit_bundle() — needs only the bundle (no store, no key). Re-walks both
hash-chains from genesis, matches the tips/counts to the signed anchor, and (with witnesses) checks
external co-signatures. Returns {ok, checks, problems, limits, summary}; any post-export tamper fails it.
CONTENT: the bundle carries hashes and never text, so a clean chain over SUBSTITUTED text verifies here
— exactly what an out-of-band edit plus a legitimate amendment produces. store_path (the store file
the bundle was taken from) re-derives each record's commitment against the earliest receipt covering
it, and summary.content_checked then says True. Without it the verdict still returns and limits
says in words that content was not examined.
This surface had no way to pass it: limits told the auditor to "pass store_items=", a parameter that
did not exist here, so over MCP the answer was always the content-blind one. A missing store_path is
REFUSED rather than silently downgraded — opening a store creates it, so a mistyped path would
otherwise hand back a clean verdict over an empty store the call had just made.
expected_pubkey is the key you hold OUT OF BAND. Without it the chain signatures can only be
checked against a key carried inside this same artifact, which proves the writer owned a keypair
and not which one — so the verdict says PRESENT BUT UNVERIFIED rather than passing. This
parameter did not exist here either, so over MCP the pinned check was unreachable in both
directions. require_signed=True turns an unsigned or unverified chain into a failure.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| bundle | Yes | ||
| threshold | No | ||
| witnesses | No | ||
| store_path | No | ||
| require_signed | No | ||
| expected_pubkey | No |