Curbi / Verify · runs offline
Verify the record.
Keep the evidence.
Paste a Curbi proof bundle. Your browser checks every signature, every log position and the history against the public keys you choose. Verification runs locally, without sending your bundle or keys. This page blocks data connections; its scripts and styles load from Curbi.
Curbi publishes public verification keys in its current key set; production signing remains off. Check key validity dates and your independently pinned trust policy. You can verify another issuer’s bundle using public keys you independently trust. Published Curbi vectors require an explicit test-key choice. A bundle’s own keys are never trusted unless you say so.
What your browser checks.
| Step | Check |
|---|---|
| 1 · Keys | Only keys you supply. Private keys refused. Test keys refused unless allowed. Each key’s validity window is checked against each signature’s time. |
| 2 · Head | The log checkpoint signature (its own signing domain), size and root. |
| 3 · Receipts | Signature, DONE status, not after the head, no duplicate or conflicting receipt for one action, and an RFC 9162 inclusion proof under the signed head. |
| 4 · Permission | If attached, the attestation is signed, bound by digest, and for the same mutation, tenant, resource and subject. |
| 5 · History | Provided or remembered checkpoints are compared using RFC 9162 consistency proofs. A missing or invalid unsigned proof leaves history unproven. Two signed roots at the same size can establish equivocation. |
Same check in CI.
Terminal
unzip curbi-proof-v0.1.zip && cd curbi-proof-v0.1 npm test node bin/curbi-verify.mjs bundle.json --keys keys.json # exit 0 verified · 1 rejected
Run a check. Keep the result.
Check a reply Connect your agent →A pass means no configured rule fired. It grants no execution authority or provider-completion proof.