The verifier

stratl is a single Go binary with no dependencies at run time. It needs no account and makes no network calls to verify. It is also compiled to WebAssembly and runs unchanged inside the portal’s Verify page.

Build or install

cd stratl-backend && make cli      # builds cli/bin/stratl

A Homebrew tap will follow. Until then, build it, or copy the binary from a colleague; it is reproducible from the repository.

Commands

Command	Does
stratl verify <bundle.zip | bundle-dir | record.json>	Runs every check that can run on the input and prints each with PASS, FAIL or SKIP. Exit status 0 only when every check that ran passed
stratl inspect <record.json>	Prints the record’s canonical form and its hash, for producers checking their own canonicalisation
stratl keys	Fetches or inspects a workspace’s published public key
stratl audit	Not implemented yet. It will read a Langfuse or OpenTelemetry export offline and report which traces would become well-formed decisions and which lack a business subject

Verifying a bundle

stratl verify DEC-01J8ZK3Q9W7X2P4M6N8R0T1V3Y.stratl.zip

PASS  record parses (SRF 0.1)
PASS  record hash matches, RFC 8785 + SHA-256 (4a030b5135…)
PASS  public key present (keys/public.jwk, P-256)
PASS  key id matches RFC 7638 thumbprint (wueifJtZen…)
PASS  signature valid (ES256 over canonical bytes)
PASS  chain link present (seq 6, prev 7e6049b21d…)
PASS  manifest file hashes match (5 files)
PASS  checkpoint parses
PASS  checkpoint signature valid
PASS  record included in checkpoint root (RFC 6962)
PASS  RFC 3161 timestamp imprint matches
PASS  artifacts match their fingerprints (1)

A bare record.json runs the first six checks and skips the rest. A folder that is an unzipped bundle behaves like the zip.

Verifying a subject pack or a period pack

Both carry a signed manifest rather than a single record. Recompute each file’s SHA-256 against manifest.json, verify manifest.sig.json (ES256 over the RFC 8785 form of the manifest) with keys/public.jwk, then stratl verify each bundle under bundles/ in a subject pack. Evidence outputs.

The same code in the browser

make wasm-export in the backend compiles the verifier to WebAssembly and copies it into the portal repository, where the Verify page loads it. The checks, their names and their order are identical, which is why the portal page lists them before running. A bundle dropped on the page never leaves the browser.

Public keys

A bundle carries the key it needs. Independently, GET /v1/keys/{key_id} returns any key by id without authentication, and a record may name that URL in custody.key_id_url. stratl keys fetches from it. A verifier can therefore compare the key in a bundle, the key at the URL and the key in the customer’s own bucket.