aqta-verify-receipt

Offline verifier for Seal receipts (ATTESTATION-v1).

Seal signs the model call at runtime. This package checks that signature without contacting Aqta. No account. Same algorithm as the npm package.

30-second check

pip install aqta-verify-receipt
aqta-verify-receipt receipt.json \
  --key 9Y3Eiq6V8QjRDUM5nPqSwKIOPQaoEU4SbagfYFdvWa4

Default output is one compact line (words carry meaning; colour is optional):

✓ valid  ALLOWED  2d41…871e94c  pinned issuer key

Invalid:

✕ invalid  signature mismatch  2d41…871e94c

Optional flourish (never the proof):

aqta-verify-receipt receipt.json --key <pinned> --pretty
# …
◈ seal intact · verified offline

Or pipe:

curl -sS https://api.aqta.ai/r/YOUR_RECEIPT_ID | aqta-verify-receipt - \
  --key 9Y3Eiq6V8QjRDUM5nPqSwKIOPQaoEU4SbagfYFdvWa4

Current production key id: aqta-att-01269bb4b6a7d950 (/v1/attestation/public-key).

Pin that string; do not re-fetch it inside a verify loop. Keys rotate and receipts do not: a receipt verifies against the key current when it was signed, and the permanent key record (with retired keys and their validity windows) is at app.aqta.ai/security/issuer-keys.txt.

Library

from aqta_verify_receipt import verify_receipt, fetch_published_public_key

# Once per environment: fetch, then pin somewhere you control.
trusted = fetch_published_public_key()

result = verify_receipt(receipt, trusted_public_key=trusted)
if not result.valid:
    raise ValueError(result.reason)

CLI

aqta-verify-receipt <file|-> --key <base64url> [--no-strict] [--json] [--pretty] [-q]
aqta-verify-receipt <file|-> --integrity-only [--no-strict] [--json] [--pretty] [-q]

NO_COLOR=1 disables colour. Meaning never depends on colour alone.

Pinning is required by default. Without --key, pass --integrity-only (embedded key only; anyone can self-sign; result is marked untrusted).

Dependencies

cryptography (>= 42) for constant-time Ed25519. Nothing else.

What this is not

Not a governance dashboard. Not a cost router. A small verifier for one signed model-call receipt. The novel part is the receipt format and offline verification model, not ASCII theatre.

Licence

Apache-2.0. Aqta Technologies Limited.

If you implement or cite the ATTESTATION-v1 format itself, credit under CC-BY-4.0: see the repo CITATION.cff.