Developer Verifier Guide
The browser verifier at verify.html
(hosted at verify.aevesa.com)
runs manifest RS256 and file_integrity checks locally. It may call
https://api.aevesa.com for optional Merkle and ledger binding - not for bundle integrity.
Browser verification (recommended)
- Open verify.html
- Paste sovereignty receipt JSON or a Proof-of-Action bundle
- Click Validate - crypto checks run in your browser
Issuer HMAC seal (advanced)
If your organization issued the receipt, you can validate the signature field against the canonical SovereigntyReceipt/2 body using the same HMAC secret as the issuer (SOVEREIGNTY_RECEIPT_HMAC_SECRET). This proves tampering after issuance but not Merkle continuity - use the portal or POST /api/v1/public/verify-receipt for anchor proofs.
Never commit HMAC secrets to this repository or public issues.
Public API (no secret required)
curl -sS -X POST "https://api.aevesa.com/api/v1/public/verify-receipt" \
-H "Content-Type: application/json" \
-d '{"receipt": { "...": "exported JSON" }}'
What it proves
Exit code 0 means the signature field matches the canonical JSON body defined for SovereigntyReceipt/2 -
detecting tampering after issuance. It does not, by itself, prove Merkle continuity; use the hosted verifier or your own ledger walk for anchor proofs.