verify_envelope
Read-onlyIdempotent
Verify a commit's signed envelope offline against RFC 8032 Ed25519 rules. Accepts a single commit SHA or explicit envelope JSON file, enforcing trusted keys, mode, actor types, and expiry policies.
Instructions
Verify one signed commit envelope offline against RFC 8032 Ed25519 rules.
Use for a single commit SHA or explicit envelope JSON file. Prefer
``verify_pr_range`` for PR/branch ranges and ``audit_export`` for procurement
bundles spanning many commits. Do not use when you only need hook status —
call ``status`` instead.
Read-only: no network or SSX360_API_KEY required. Does not modify Git state.
Returns ``{ok, sha, actor_type, mode, error?, envelope?}``; ``ok`` is false
on signature, policy, expiry, or missing-envelope errors.
Parameters:
workspace: Git repo root (defaults to detected repo).
commit_sha: Commit SHA to verify (uses local envelope file).
envelope / envelope_path: Optional explicit path to envelope JSON.
require_mode: Policy filter, e.g. emulated or hardware (empty skips).
trusted_keys / trusted_keys_file: JSON file listing trusted public keys.
check_expiry: Reject envelopes with expired delegation timestamps.
require_actor_types / deny_actor_types: Actor policy allow/deny lists.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| envelope | No | Path to a commit envelope JSON file to verify. Alias for envelope_path; use when importing bundles from CI artifacts or audit exports. | |
| workspace | No | Git repository root. Empty auto-detects from the working directory. | |
| commit_sha | No | Commit SHA whose local envelope file should be verified offline. | |
| check_expiry | No | When true, reject envelopes whose signed delegation or agent-scope manifest includes an expired ``expires_at`` timestamp (ISO 8601 UTC). | |
| require_mode | No | Policy filter on signature mode, e.g. emulated or hardware. Empty skips mode enforcement. | |
| trusted_keys | No | Path to a JSON policy file listing trusted Ed25519 public keys (device_id or base64 public keys). Alias for trusted_keys_file. | |
| envelope_path | No | Optional explicit path to an envelope JSON file instead of the default ``.matrixscroll/envelopes/<sha>.json`` location. | |
| deny_actor_types | No | If set, fail verification when provenance.actor_type matches any denied value. | |
| trusted_keys_file | No | Path to a JSON policy file listing trusted Ed25519 public keys. | |
| require_actor_types | No | If set, fail verification unless provenance.actor_type is in this list. |
Output Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
No arguments | |||