onetrace-verify

The reference verifier for stage-receipt records, packaged as its own distribution. Standard library only -- no dependency on onetrace, or on anything else.

That independence is not a packaging convenience. onetrace's own README states plainly that the verifier does not trust the SDK that emitted a record -- a dependency edge from this package to onetrace would contradict that sentence. A stranger must be able to install this alone and check a record produced by anything.

Install

pip install onetrace-verify

Use

onetrace-verify <run-folder>

or, pointed at a manifest directly:

onetrace-verify <run-folder>/MANIFEST.json

Every outcome is PASS, FAIL, or NOT-RUN-with-a-reason -- never silence. Exit status 0 means every check that ran passed; non-zero means at least one failed.

What this is

This is verify.py and canonicalize.py from the onetrace project's own bench (verifier/), repackaged under this distribution's own name and entry point -- not a rewrite, not a copy that can drift. The check this distribution's own build verifies: installed alone, in an environment with no onetrace present, it verifies the golden example run and refuses every rejection vector, row for row identical to running verifier/verify.py directly from the source repository.

What this package does not claim

This sdist ships no test suite of its own. The behaviour that matters most for a package this small and this static -- that the vendored verify.py/canonicalize.py stay byte-identical to their bench originals, and that an unknown manifest-level format is refused rather than silently accepted -- is exercised thoroughly from onetrace's own test suite, which imports and runs this code directly. A separate, parallel test harness inside this package's own sdist would duplicate that coverage without adding an independent check: both suites would be asserting the same thing against the same file. If that duplication ever stops being true -- if this package diverges from onetrace's own tests of it, or ships logic onetrace's suite does not exercise -- its own tests belong here at that point, not before.