primust-verify 1.11.1

Offline verifier for Primust VPECs (Ed25519 + post-quantum ML-DSA-65). Free forever. No account required.

primust-verify

Free forever. No account required. Apache-2.0.

Offline verifier for Primust VPECs (Verifiable Process Execution Credentials).

pip install primust-verify

Verify a VPEC

from primust_verify import verify

result = verify(vpec_json)
assert result.valid

Or from the command line:

primust-verify vpec.json

Exit codes:

• 0 — valid
• 1 — invalid (signature mismatch, tampered, or failed checks)
• 2 — system error

Zero-network verification

Use --trust-root to verify without any network calls:

primust-verify vpec.json --trust-root ./primust-pubkey.pem

This fetches no external resources. The public key PEM is the only trust anchor needed.

Download the Primust public key from: https://primust.com/.well-known/primust-pubkey.pem

Deferred math-tier proofs (PACs)

A governance run's ZK (Noir/UltraHonk) proof is computed asynchronously and isn't ready at the instant the VPEC is sealed, so the sealed envelope marks that proof artifact unresolved_at_seal. The envelope alone therefore can't self-prove the math-tier claim — by default the verifier reports it as unresolved and tells you to consult the live API.

To verify the math tier fully offline, supply the PAC (Proof Attestation Certificate) — a separately-signed certificate that carries the completed proof bundle and binds it to the VPEC:

# Fetch the PAC(s) for a VPEC (public, no auth):
curl https://api.primust.com/api/v1/vpecs/<vpec_id>/pacs > pacs.json

primust-verify vpec.json --trust-root ./primust-pubkey.pem --pacs pacs.json

The verifier resolves a deferred proof at one of two trust levels:

• trustless — the ZK proof is re-verified locally against the circuit's pinned verification key and its public input is bound to the VPEC's record root. Zero trust in Primust. Requires the Barretenberg bb CLI (see below).
• attested — only the PAC's issuer signature is checked (e.g. when bb isn't installed). Same trust basis as the live-API consult, but offline. The verifier emits an SI-13 disclosure noting the proof was not independently re-verified.

Pass --require-reverified-proofs to refuse the attested fallback — a deferred proof then only clears if it is genuinely re-verified (trustless).

Enabling trustless re-verification (bb)

Trustless re-verification shells out to the Barretenberg bb CLI. Install it with bbup (installs to ~/.bb/bb, which the verifier finds automatically) or point the verifier at a specific binary with PRIMUST_BB=/path/to/bb. Without bb, the verifier degrades to the attested path (or fails the artifact under --require-reverified-proofs).

You don't need a Primust account to verify a VPEC

This tool is free, open source (Apache-2.0), and works offline. Anyone can verify a VPEC — regulators, auditors, counterparties — without creating an account or contacting Primust.

Verification paths

• primust-verify CLI — canonical local/offline verifier
• Evidence Pack verify.html — bundled local browser verifier
• verify.primust.com — hosted convenience verifier

The hosted site is useful for shared links and quick review, but it is not the canonical zero-network / trust-minimized path.

Options

Flag	Description
--production	Reject VPECs issued with test keys
--skip-network	Skip Rekor transparency log check
--trust-root <path>	Use a local PEM file as trust anchor (zero-network mode)
--pacs <path>	Supply Proof Attestation Certificate(s) to resolve deferred math-tier proofs offline
--require-reverified-proofs	Refuse the attested fallback: a deferred proof clears only if re-verified (trustless, needs bb)
--json	Output structured JSON instead of human-readable text

Requirements

• Python 3.11+
• Optional: Barretenberg bb CLI — only for trustless re-verification of deferred math-tier proofs (see "Deferred math-tier proofs" above). Not needed for signature, schema, surface, gap, or attested-PAC verification.

License

Apache-2.0

---

Docs | Verify online | Primust