Verify it yourself.

The verifier

Paste a credential, its anchor, and its bundle. Press verify. The check runs the same logic as the Python reference verifier - cross-validated against it on the real fleet credentials, 24 cases out of 24.

Reference implementation, production hardening pending.

Where these come from

Three inputs, three sources. None of them is "ask us nicely."

1. The credential and the bundle are issued together. When we attest an agent, the tool writes the credential and its bundle as one set. The bundle is the re-derivation evidence for that exact credential. Whoever holds the credential holds the bundle - you receive both.
2. The anchor is the issuer's public key, and you obtain it on its own. That is the point of the whole exercise: you check the credential against an anchor you got independently, not one we slipped you next to the credential. For this demo, "Load the sample credential" fills it in.

A governance credential is meant to be handed out and checked. There is nothing secret in what you paste here - the key that signs a credential never appears in it. What proves the credential is the math, run against an anchor you trust.

The three checks

A verdict of ACCEPT means all three held. Any one failing rejects the credential.

1. The issuer signature verifies against the anchor you supplied. Not an anchor we hardcoded. Yours. Hand it a stranger's key and it rejects.
2. The attestation chain re-derives from the bundle. Five elements - persona, transformation, payload, timestamp, governance log - hashed and composed. Change one byte of the bundle and the composite no longer matches.
3. The conscience attestation is present. The agent's signed standing to refuse - including refusing its operator on the served person's behalf. A validly-signed credential without it is rejected. That is the defining claim of this profile, not a footnote.

Do not trust this server

A verifier that only runs on our machine is a verifier that asks for trust again. So it also runs on yours.

Download the sample and verify it offline with Node - no network, nothing of ours in the loop:

node scripts/verify-credential-offline.ts \
    public/verify-sample/credential.jwt \
    --anchor public/verify-sample/anchor.b64 \
    --bundle public/verify-sample/bundle.json

Sample files: credential.jwt, anchor.b64, bundle.json.

The offline script and the web endpoint share one verification module. The same module is cross-validated against the Python reference implementation - the canonical definition of a valid Evoked governance credential.