flightdeck-verify

Standalone offline verifier for FlightDeck/Conductor evidence packs. MIT-licensed, Python-stdlib-only — read it, run it, or reimplement it. No account, no network, no trust in NorthGate required.

pip install flightdeck-verify
flightdeck-verify release-pack.tar.gz
flightdeck-verify release-pack.tar.gz --json

Exit codes (CI-friendly): 0 verified · 1 verification failed · 2 usage/IO error.

What it proves — and what it doesn't

This tool proves exactly what the pack format proves:

• Archive integrity — every file in the pack matches its SHA256SUMS entry.
• Record-chain linkage — the audit-chain/chain.jsonl records link hash-to-hash with no gaps, from genesis to head, per tenant.

It does not prove who performed the work (unsigned packs say so in their own output), and it cannot prove anything about records that were never added. The output states what was checked; it never overstates.

Why this is MIT-licensed

The point of an evidence pack is that your auditor doesn't have to trust the vendor who produced it. A verifier you can't read is a dashboard with extra steps — so this one is open, dependency-free, and small enough to audit in one sitting.

FlightDeck itself — the rail (pip install flightdeck-connect), the governor console, and the platform — is commercial software by NorthGate Strategic LLC. This verifier is the part that belongs to everyone.