kveritas

kveritas command [options]kveritas init [--local] [--harness] [--disclosure redacted|names|open] [--show-names]kveritas run [--files f1,f2] -- command [args...]kveritas seal [-o path] [--local-key pem]kveritas verify report.pdf|session.json|proof.json [--offline] [--bundle zip] [--paper pdf]

kveritas binds a published result to the exact code, hardware, and time that produced it, and writes a cryptographically signed PDF anyone can verify. It wraps existing commands (any language). The binary is a single static Go program with no runtime dependencies.A typical experiment session is init, one or more runs, then seal. During a run, kveritas tees stdout, hashes I/O, samples hardware at about 10 Hz, and parses protocol lines. At seal time it signs canonical JSON of the session with RSA-PSS-SHA256 (4096-bit). The public key, hashes, nonce, and canonical bytes are embedded after the PDF `%%EOF` between `%%KVERITASSEALBEGIN%%` and `%%KVERITASSEALEND%%`.verify recomputes the data hash, checks the RSA-PSS signature, then distinguishes VERIFIED (signed by the K-Veritas trust anchor) from SELF-ATTESTED (valid signature on an author-supplied key). Unless --offline is set, it also asks the public verifier at kveritas.org for ledger status, HMCA coherence, optional bundle match, code audit, and paper cross-check.HMCA (execution coherence) never looks at the reported metric. It scores whether CPU, memory, I/O, and GPU channels co-fluctuate as one process. Verdicts are PASS, WARN, FAIL, or N/A. If a run declares a model card (`KVERITAS_MODEL`), seal also attests compute cost against time, energy, and memory bounds; a hard violation is FABRICATION-IMPOSSIBLE and is bound into the signature.Provenance is a Merkle-linked timeline of content-addressed snapshots. Disclosure only changes what the report shows. Patterns in .kveritasignore keep files out of any checkout bundle; withheld files remain hash-only leaves so they cannot be dropped silently.Harness mode (`init --harness`) records designated agent actions as a hash chain. Claude Code hooks are installed into `.claude/settings.json`. A failed pre hook exits 2 so a designated tool cannot run without its chain entry.

--local

Init without the attestation server. Seal with a local RSA key (self-attested, not server-origin).

Init a hash-chained agent session instead of an experiment session. Signs genesis with the server (or --local).

How much provenance the report reveals. Default redacted (pseudonyms, no names, no content). Integrity is always committed.

Keep real file names in the report without bundling content (same as --disclosure names).

Extra source files to hash before and after run. If omitted, script-like arguments (`.py`, `.sh`, `.r`, ...) are hashed automatically.

Output PDF for seal (default `kveritas-report-<id>.pdf`) or proof JSON for prove.

RSA private key for offline seal. Default `keys/private.pem` in local mode.

verify without contacting the ledger.

Checkout/source bundle for verify. Hashes are compared to the seal; the server audit can run a code review.

Manuscript PDF for verify. The server cross-checks claimed numbers against sealed telemetry.

Trust-anchor public key for verify. Without it, origin is checked against the pinned K-Veritas key.

Required pair for check. generate-claims needs --report only and prints JSON to stdout.

On checkout, verify the bundle hash against this sealed report before writing files.

harness-prove: reveal prompt or response bytes, and select the chain entry by index or tool-use id.

.kveritas/

Session directory created by init. Holds the token, run records, proof keystore, and bundles. seal removes it; clean removes it without sealing.

Gitignore-style patterns. Matching files are withheld from checkout bundles but still committed as hashes.

Harness mode appends PreToolUse, PostToolUse, and UserPromptSubmit hooks that call kveritas record --hook.

init

Create a `.kveritas` session in the current directory.

Run a command as a monitored subprocess. Captures stdout/stderr hashes, protocol lines, hardware samples, and (on Linux) per-process activity.

Sign the session into a PDF report. Open disclosure also writes `report.pdf.kvbundle.zip`. Deletes `.kveritas` on success.

Check a sealed PDF, harness `session.json`, or embedded proof. Default also runs the server audit; --offline stays local.

Build or check a selective-disclosure proof that named files were in a signed snapshot.

Reconstruct files for one snapshot from a checkout bundle. Pass --report to bind the zip to the signature.

Compare a claims JSON file to signed metrics, or print a template from a report.

Append a designated action to a harness session (also invoked by Claude Code hooks).

Prove one recorded prompt or output against its committed hash.

Show session state, replace the binary from the release channel, or remove `.kveritas`.

Print these on stdout from any language. They are hashed into the signed record.KVERITAS_METRIC name=id value=float [step=label]

Record a metric. Keras history, sklearn CV, and metric-like locals are also auto-detected.

Mark a phase boundary (hardware snapshot).

Commit a headline claim.

Commit a random seed.

Model card (feeds compute-cost attestation).

Workload card.

Attest a model or dataset. Public artifacts store a content hash; private ones store a salted commitment.

Only runs that exit 0 are saved. A failing command is discarded (the server ledger may still count the invocation). seal refuses if hashed source files changed after the runs.Per-process hardware attribution and the file/subprocess activity map are Linux-only. Elsewhere, sampling falls back to system-wide readings. Verify, seal, proofs, checkout, and disclosure levels are cross-platform.Default init talks to the K-Veritas attestation server. --local (or --local-key) produces a self-attested report: the signature is valid, but verify will not treat origin as server-signed.The proof keystore (`report.pdf.provkey.json`) stays next to the PDF and is needed for prove. Do not publish it if the report is redacted. Checkout bundles never include datasets or weights.The CLI, protocol, and verification libraries are Apache-2.0. The attestation server in the same repository is AGPL-3.0. "K-Veritas" is a trademark; the license does not grant rights to run a service that implies official certification.

K-Veritas is an open verification protocol from 27-GROUP, with the Go CLI and attestation server in kveritas-go. The client is a Cobra program that signs session JSON with RSA-PSS-SHA256 and embeds the seal in a self-contained PDF.

python(1), in-toto-run(1), cosign(1), sha256sum(1), openssl(1), git(1), claude(1)

Source code · Homepage · Documentation