Run the packaged offline self-test: verifies a known-good sample receipt and sample audit bundle shipped with the server. Read-only and deterministic; no network calls and no ScopeBlind servers are contacted. Returns JSON { ok: boolean, receipt: { valid, type, format, kid, issuer, hash }, bundle: { valid, total, passed, failed }, note }. If the packaged samples cannot be read it returns { ok: false, error }. Call this first to prove the verifier works before verifying your own artifacts.

Verify the Ed25519 signature of a single signed artifact (decision receipt, restraint receipt, passport envelope, or other Veritas Acta artifact; v1, v2, and passport formats are auto-detected). Read-only and fully offline. Provide the artifact as raw JSON (artifact_json) or a local file path (path); artifact_json wins if both are given. Verification uses public_key_hex when provided, otherwise a key embedded in the artifact payload; if neither exists it returns valid: false with error 'no_public_key' rather than guessing. Returns JSON { valid: boolean, error: string|null (e.g. 'invalid_signature', 'no_public_key'), type, format ('v1'|'v2'|'passport'), kid, issuer, hash (SHA-256 over the canonical unsigned bytes) }. Unparseable input returns { ok: false, error }.

Verify every receipt in a ScopeBlind audit bundle offline, using the bundle's embedded verification keys (the JWK set at verification.signing_keys, matched to each receipt by kid). Read-only; no network calls. Provide the bundle as raw JSON (bundle_json) or a local file path (path). Returns JSON { valid: boolean (true only if every receipt verifies), total, passed, failed, receipts: [{ index, type, kid, valid, error }] }. A document without a receipts array returns { ok: false, error }. For a single artifact, or to supply an external key, use verify_receipt instead.

Inspect a signed artifact WITHOUT verifying it: reports what the artifact claims to be so you can choose the right verification tool and key. Requires no key; read-only and offline. Provide raw JSON (artifact_json) or a local file path (path). Returns JSON { type, format ('v1'|'v2'|'passport'), issuer, kid, issued_at, payload_keys (sorted, signature excluded) }. It performs no signature check, so a well-formed forgery will explain cleanly; use verify_receipt to check authenticity.