verify_envelope
Read-onlyIdempotent
Verify a single signed commit envelope offline using Ed25519 cryptography. Checks signature validity, policy compliance, and expiry in one read-only operation.
Instructions
Verify one signed commit envelope offline against RFC 8032 Ed25519 rules.
Use for a single commit SHA or explicit envelope JSON file. Prefer
``verify_pr_range`` for PR/branch ranges and ``audit_export`` for procurement
bundles spanning many commits. Do not use when you only need hook status —
call ``status`` instead.
Read-only: no network or SSX360_API_KEY required. Does not modify Git state.
Returns ``{ok, sha, actor_type, mode, error?, envelope?}``; ``ok`` is false
on signature, policy, expiry, or missing-envelope errors.
Parameters:
workspace: Git repo root (defaults to detected repo).
commit_sha: Commit SHA to verify (uses local envelope file).
envelope / envelope_path: Optional explicit path to envelope JSON.
require_mode: Policy filter, e.g. emulated or hardware (empty skips).
trusted_keys / trusted_keys_file: JSON file listing trusted public keys.
check_expiry: Reject envelopes with expired delegation timestamps.
require_actor_types / deny_actor_types: Actor policy allow/deny lists.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| envelope | No | Path to a commit envelope JSON file to verify. Alias for envelope_path; use when importing bundles from CI artifacts or audit exports. | |
| workspace | No | Git repository root. Empty auto-detects from the working directory. | |
| commit_sha | No | Commit SHA whose local envelope file should be verified offline. | |
| check_expiry | No | When true, reject envelopes whose signed delegation or agent-scope manifest includes an expired ``expires_at`` timestamp (ISO 8601 UTC). | |
| require_mode | No | Policy filter on signature mode, e.g. emulated or hardware. Empty skips mode enforcement. | |
| trusted_keys | No | Path to a JSON policy file listing trusted Ed25519 public keys (device_id or base64 public keys). Alias for trusted_keys_file. | |
| envelope_path | No | Optional explicit path to an envelope JSON file instead of the default ``.matrixscroll/envelopes/<sha>.json`` location. | |
| deny_actor_types | No | If set, fail verification when provenance.actor_type matches any denied value. | |
| trusted_keys_file | No | Path to a JSON policy file listing trusted Ed25519 public keys. | |
| require_actor_types | No | If set, fail verification unless provenance.actor_type is in this list. |
Output Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
No arguments | |||