Independent Receipt Verification
Standalone DCR verifier
The CFA verifier package checks DeniedCapabilityReceipt/v1 artifacts without the CFA runtime. A reviewer can inspect a receipt, verify the embedded Ed25519 signature, and reject tampered evidence from a normal Node.js environment.
What It Verifies
Schema
The receipt declares
The receipt declares
DeniedCapabilityReceipt/v1.Key ID
public_key_id matches the embedded public_key_hex.Signature
The Ed25519 signature covers the canonical unsigned receipt payload.
The Ed25519 signature covers the canonical unsigned receipt payload.
Tamper evidence
Changing the receipt after signing causes verification to fail.
Changing the receipt after signing causes verification to fail.
CLI Use
Run the verifier against a receipt JSON file from an evidence bundle, SIEM export, or fleet ledger export:
node verifier/bin/dcr-verify.js --file ./receipt.json
A valid receipt exits with code 0. Invalid JSON, schema mismatch, key mismatch, or signature rejection exits non-zero and prints a failure reason.
Library Use
const { verifyReceiptFile } = require("./verifier");
const result = verifyReceiptFile("./receipt.json");
console.log(result.valid);
The library path is dependency-free and does not call back to CFA, the public site, or a hosted service.
Local Test
The verifier has its own test suite and is also exercised by CFA release checks:
npm --prefix verifier test
Boundary
The verifier proves that a DCR signature matches the receipt payload and embedded public key. It does not prove legal compliance, production deployment status, or that every allowed action was safe.