Independent Receipt Verification

Standalone DCR verifier

The CFA verifier package checks DeniedCapabilityReceipt/v1 artifacts without the CFA runtime. A reviewer can inspect a receipt, verify the embedded Ed25519 signature, and reject tampered evidence from a normal Node.js environment.

What It Verifies

Schema
The receipt declares DeniedCapabilityReceipt/v1.
Key ID
public_key_id matches the embedded public_key_hex.
Signature
The Ed25519 signature covers the canonical unsigned receipt payload.
Tamper evidence
Changing the receipt after signing causes verification to fail.

CLI Use

Run the verifier against a receipt JSON file from an evidence bundle, SIEM export, or fleet ledger export:

node verifier/bin/dcr-verify.js --file ./receipt.json

A valid receipt exits with code 0. Invalid JSON, schema mismatch, key mismatch, or signature rejection exits non-zero and prints a failure reason.

Library Use

const { verifyReceiptFile } = require("./verifier");

const result = verifyReceiptFile("./receipt.json");
console.log(result.valid);

The library path is dependency-free and does not call back to CFA, the public site, or a hosted service.

Local Test

The verifier has its own test suite and is also exercised by CFA release checks:

npm --prefix verifier test

Public Split Repository

The dependency-free verifier is also published as a standalone public repository at github.com/Intelligent-Context-AI-Inc/dcr-verifier. The split package keeps the same CLI, library API, Apache-2.0 license, and offline verification boundary without requiring the CFA runtime. 

git clone https://github.com/Intelligent-Context-AI-Inc/dcr-verifier.git
cd dcr-verifier
npm test
node bin/dcr-verify.js --file fixtures/sample-denied-capability-receipt.json

Boundary

The verifier proves that a DCR signature matches the receipt payload and embedded public key. It does not prove legal compliance, production deployment status, or that every allowed action was safe.