verify_pr_range
Verify signed/unsigned commits across a pull request range to enforce merge gates. Supports offline verification via local files, git notes, or bundles.
Instructions
Scroll Gate: verify signed/unsigned commits across a PR commit range.
Use for merge gates and PR review (many commits). Prefer ``verify_envelope``
for one commit offline. Prefer ``audit_export`` when auditors need bundles,
not pass/fail on a range.
Hosted mode (default): calls ssx360.com; requires SSX360_API_KEY.
Set ``source=local|notes|bundle`` to verify offline without an API key.
Read-only for Git refs; hosted mode emits usage to ssx360.com.
Returns ``{ok, verified_count, unsigned_shas?, failures?, error?}``.
Parameters:
workspace: Git repo root (defaults to detected repo).
base: Range start ref (exclusive), e.g. origin/main.
head: Range end ref (inclusive), e.g. HEAD or PR head SHA.
source: Envelope transport — hosted, local, notes, or bundle.
notes_ref: Git notes ref when source=notes.
bundle_dir: Bundle directory when source=bundle.
require_mode: Policy require_mode filter.
trusted_keys_file: Trusted keys JSON for signed/untrusted actor checks.
require_actor_types / deny_actor_types: Actor policy lists.
allow_empty: Accept a labelled empty range. Defaults to false.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| base | No | Range start Git ref (exclusive), typically origin/main. | origin/main |
| head | No | Range end Git ref (inclusive), e.g. HEAD or a PR head SHA. | HEAD |
| source | No | Envelope transport: hosted Scroll Gate (default, requires SSX360_API_KEY), local files, git notes, or bundle dir for offline verification. | hosted |
| notes_ref | No | Git notes ref when source=notes, default refs/notes/matrixscroll. | refs/notes/matrixscroll |
| workspace | No | Git repository root. Empty auto-detects from the working directory. | |
| bundle_dir | No | Directory containing exported envelope bundles when source=bundle. | |
| allow_empty | No | Explicitly accept an empty range. Defaults to false and the result remains labelled empty. | |
| require_mode | No | Optional policy require_mode filter applied to every commit in the range. | |
| deny_actor_types | No | Optional deny-list of provenance.actor_type values. | |
| trusted_keys_file | No | Optional JSON file of trusted public keys for the range check. | |
| require_actor_types | No | Optional allow-list of provenance.actor_type values. |
Output Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
No arguments | |||