regent-receipt-verify

Verify a Regent Control receipt or allow token without Regent: only the token and a JWKS you saved while the issuer was reachable. Nothing calls the network. One dependency (cryptography) for RS256.

pip install regent-receipt-verify
curl -s https://control-api.regentprotocol.org/v1/control/.well-known/jwks.json > jwks-2026-09.json   # save it now, keep it with the receipts
regent-verify @receipt.txt --jwks jwks-2026-09.json --request request.json --mandate mandate-v2-reveal.json --policy policy-v3-reveal.json

from regent_receipt_verify import verify
res = verify(token, jwks, request={"tool": "stripe", "action": "charge.create", "resource": None, "args": {...}},
             mandate_reveal=reveal_from_owner, policy_reveal=policy_reveal_from_org)
res.valid, res.kind, res.claims, res.args_hash_match, res.mandate_match, res.policy_match

What it proves:

Key rotation: pass --jwks several times (every JWKS you saved). Exit code 0 when the signature verifies and every supplied check matches.

Test vectors are minted by the real issuer (packages/receipt-verify-vectors), and the same file drives the Node package @regent-protocol/receipt-verify.