verify

Verify a feed’s signatures and sequence integrity. This command loads the SIG metadata, resolves the JWKS, and checks every event in the feed.

Usage

ak verify <SIG_METADATA>

Arguments

Argument	Description
<SIG_METADATA>	SIG metadata URL (https://...) or local file path.

Behavior

The verify command performs the following checks:

1. Loads metadata from the provided URL or file path.
2. Resolves the JWKS to obtain the issuer’s public keys.
3. Reads all events from the event feed.
4. Verifies every JWS signature against the corresponding key in the JWKS.
5. Checks sequence ordering to ensure events are strictly sequential with no gaps.
6. Validates all payloads for structural correctness.

The command exits with code 0 on success and a non-zero code on failure.

Examples

Verify a local feed

ak verify ./issuer-root/.well-known/sig.json

Output on success:

Verified 12 events, all signatures valid.

Verify a remote feed

ak verify https://example.com/.well-known/sig.json

Output on success:

Verified 12 events, all signatures valid.

Verification failure

ak verify ./tampered-issuer/.well-known/sig.json

Output on failure:

Error: signature verification failed for event at seq=4 (kid: orgsign-1)

Notes

• Remote verification fetches the metadata, JWKS, and events over HTTPS.
• Local verification reads all files from the filesystem relative to the metadata path.
• This command is read-only and does not modify any files.
• Use dump-state if you also want to see the derived relationship state after verification.