holisticquality-verify-manifest

Independent, zero-dependency verifier for Holistic Quality / NOMOS signed manifests — corpus manifests and published research artifacts (e.g. the PM & Alzheimer's evidence synthesis).

It lets anyone confirm, on their own machine and without trusting Holistic Quality's infrastructure, that a published artifact is exactly what was signed, by the named parties, unmodified. This operationalizes Regulator Bill of Rights, Article IX (Falsifiability).

Install

pip install holisticquality-verify-manifest

Requires Python ≥ 3.9 and the system gpg binary (GnuPG). No Python dependencies; no network access.

Use

verify-manifest \
  --manifest path/to/manifest.json \
  --bundle   path/to/signatures/v0.sig.json

First import the signers' public keys into your GPG keyring (the manifest publisher provides them), then run the command above.

Exit codes

Useful flags: --verbose (per-signature detail), --json (machine-readable result), --gpg-homedir (use an isolated keyring).

What it checks

1. Canonical-hash recompute — re-derives the SHA-256 of the manifest's canonical-JSON form (signatures excluded) and compares it to the hash inside the signature bundle. Detects any post-signing tampering.
2. GPG signature verification — each detached, ASCII-armored signature in the bundle is verified against the canonical-hash bytes.
3. Two-person rule — at least two distinct verified GPG fingerprints (disable with --no-two-person for diagnostics only).

Trust & provenance

This package is vendor-minimal: it contains only the verification path, so the whole thing is auditable in minutes. Its modules are faithful, behavior- preserving copies of the in-repository verifier; a golden-fixture test (tests/test_golden.py) enforces that a manifest signed by the canonical NOMOS signer verifies here — behavioral identity, checked, not asserted.

How-to with a worked example: https://holisticquality.io/regulator-verify-manifest

License

Apache-2.0 © Holistic Quality LLC