saphan verify
Verify a registered order reference or a signed instruction path
saphan verify
Verify a registered order reference or a signed instruction path
Load the trust chain (root pin, actor registry, LAWS MANIFEST, delegations —
trustload.go) and walk <ref|path>'s full verify chain via instr.Verify. An
input containing @ is an order reference; --ref makes that choice explicit.
For Class-O, PASS means the signature is sound AND the order is registered
AND its registered bytes match AND its projected status is active. Prints
ONLY parsed+authenticated fields (signer key-id, class, manifest serial,
chain summary, path) — never raw sidecar bytes (F-5: the tolerated tail
after sig= is unauthenticated and must never be echoed as if it were
proof). Machinery OFF (sip-P1.c): this verb only REPORTS; nothing here
gates a run or a dispatch.
--class selects Class-L (law) or Class-O (order); if omitted, the rule is:
a sidecar file <path>.sig present next to <path> means Class-O, its
absence means Class-L.
Options
| Option | Type | Default | Description |
|---|---|---|---|
--class | string | unset | law|order (default: inferred from a <path>.sig sidecar's presence) |
--manifest | string | unset | LAWS MANIFEST path (default: <workspace>/bridge/registry/LAWS_MANIFEST.md) |
--ref | bool | false | treat the argument as a registered order reference (required for a bare full digest) |
--registry | string | unset | actor registry path (default: <workspace>/bridge/registry/ACTORS.md) |
--root-pub | string | unset | root pin path (default: ~/.saphan/trust/root.key.pub) |
--stream | string | unset | order's target stream, for delegation scope matching (Class-O only) |