# AAR reference verifier (prototype)

This offline Node.js prototype evaluates supplied Attested Agent Receipt data against a supplied trust store and signed tree head. See the proposed [Attested Agent Receipt specification](../spec/attested-agent-receipt.md). It requires Node 22 or newer, has no dependencies, and makes no network requests.

## Synthetic samples

[make-sample.mjs](make-sample.mjs) creates the synthetic files in [sample/](sample/). The checked-in samples are test data, not evidence of real runs, customers, payments, services, logs, or a deployed runtime.

```bash
node make-sample.mjs
# writes sample/receipt.json, trust.json, sth.json, tampered.json, forged-root.json
```

Run [verify.mjs](verify.mjs) against the synthetic [receipt](sample/receipt.json), [trust store](sample/trust.json), and [signed tree head](sample/sth.json):

```bash
node verify.mjs sample/receipt.json --trust sample/trust.json --sth sample/sth.json
# VERIFIED (signature and log checks against the supplied trust store); attestation root pending

node verify.mjs sample/receipt.json
# UNVERIFIED: a receipt cannot vouch for its own key or its own log root

node verify.mjs sample/tampered.json --trust sample/trust.json --sth sample/sth.json
# FAIL: the signature and log-proof checks break
```

Exit codes: `0` verified, `1` failed, `3` unverified, `2` usage.

## Checks implemented in v0.1

| Check | Status |
|---|---|
| Ed25519 signature over the canonical body, with a key from the supplied trust store | implemented |
| Signed tree head from the supplied log trust key | implemented |
| RFC 6962 inclusion proof against that signed root | implemented |
| Supplied `retained` field equals zero | implemented |
| Vendor or manufacturer attestation root (TDX, SEV-SNP, NVIDIA, Secure Enclave, TPM) | not implemented; reported as `SKIP` |

Nothing inside a receipt is trusted on its own. The prototype relies on [trust.json](sample/trust.json), which names accepted runtime and log keys, and [sth.json](sample/sth.json), a signed tree head. A `VERIFIED` result means only that the supplied data passes the implemented cryptographic and stated-field checks against those supplied inputs.

## Limits

The prototype does not observe a runtime, establish that an agent run occurred, validate a vendor or manufacturer attestation root, or independently prove zero retention. It checks a signature, a signed-tree-head and inclusion proof, and the stated `retained: 0` field in supplied data. The synthetic samples have no relationship to a production service or public log.