regent-receipt-verify

Verify a Regent Control receipt or allow token without Regent: only the token and a JWKS you saved while the issuer was reachable. Nothing calls the network. One dependency (cryptography) for RS256.

pip install regent-receipt-verify
curl -s https://control-api.regentprotocol.org/v1/control/.well-known/jwks.json > jwks-2026-09.json   # save it now, keep it with the receipts
regent-verify @receipt.txt --jwks jwks-2026-09.json --request request.json --mandate mandate-v2-reveal.json --policy policy-v3-reveal.json --counterparty-jwks get4agent-jwks.json

from regent_receipt_verify import verify
res = verify(token, jwks, request={"tool": "stripe", "action": "charge.create", "resource": None, "args": {...}},
             mandate_reveal=reveal_from_owner, policy_reveal=policy_reveal_from_org)
res.valid, res.kind, res.claims, res.args_hash_match, res.mandate_match, res.policy_match

What it proves:

Key rotation: pass --jwks several times (every JWKS you saved). Exit code 0 when the signature verifies and every supplied check matches.

Test vectors are minted by the real issuer (packages/receipt-verify-vectors), and the same file drives the Node package @regent-protocol/receipt-verify.

Evidence bundles (0.4.0)

A bundle is one JSON document from the console ("Evidence bundle" on a decision or an audit event) or from GET /v1/organizations/{org}/decisions/{id}/bundle. It carries every audit event of a decision with the exact bytes that were hashed, the Merkle proof to the batch root, Regent's signed checkpoint over that root and its chain position, the epoch proof, the OpenTimestamps proof, the retained receipt and the keys.

regent-verify bundle regent-evidence-dec_7f301d041e9f.json
regent-verify bundle regent-evidence-dec_7f301d041e9f.json --jwks jwks-2026-09.json --checkpoint-jwks audit-jwks.json
regent-verify bundle regent-evidence-dec_7f301d041e9f.json --rpc https://api.mainnet-beta.solana.com

from regent_receipt_verify.bundle import verify_bundle
res = verify_bundle(bundle, receipt_jwks=saved_receipt_jwks, checkpoint_jwks=saved_audit_jwks,
                    rpc="https://api.devnet.solana.com")   # rpc is optional
res.valid, res.events, res.receipt_valid, res.receipt_anchored, res.links_ok, res.rpc_ok

Keys default to the ones inside the bundle, which proves consistency; pass the JWKS you saved (--jwks, --checkpoint-jwks) to prove provenance. The checkpoint JWKS is public at https://api.regentprotocol.org/v1/audit/.well-known/jwks.json.