algovoi-keystone-validate 0.2.0

Validate keystone execution evidence (recompute, decision-binding, tamper) with structured error logging -- the verifier companion to the keystone connectors (keystone-only edition, Apache-2.0)

algovoi-keystone-validate

Validate a batch of keystone execution_ref records -- recompute each offline, check decision-binding, detect tampering -- and log what failed and why. The verifier companion to the keystone connectors. Open, keystone-only edition, Apache-2.0. Available on request -- see https://docs.algovoi.co.uk/keystone-connectors

keystone-validate records.jsonl --log errors.jsonl --decision-ref sha256:...
# keystone-validate: 14 records | 12 ok | 1 integrity | 1 operational | 0 malformed | trustworthy=False

from algovoi_keystone_validate import validate_records
report = validate_records(connector_records, expected_decision_ref="sha256:...")
report["trustworthy"]   # False if any integrity / malformed error

It separates two failure classes operators must not confuse:

• Integrity error -- the recorded fields do not recompute to the claimed execution_ref (tampering / corruption); the evidence cannot be trusted.
• Operational error -- the execution_ref is valid, but it records an operation whose outcome was FAILED (a real runtime failure the connector captured -- trustworthy evidence of a failure).

Plus malformed (missing fields / bad outcome / bad timestamp). The validator never trusts the claimed hash; it always recomputes. Exit 0 unless an integrity/malformed error is present (--strict also fails on operational failures).

License

Apache-2.0. Copyright AlgoVoi.