COTRUGLI PUBLIC VERIFICATION KIT v1 — 14 October 2026

Run from the extracted kit with Node.js 20 or later:
  node verify/verify.mjs
No npm install, account, network or private keys are required.

Expected result: VERIFIED_DEMO, four records. A nonzero exit code means failure.
You can pass a modified bundle path as the first argument. The verifier always
uses the separately supplied anchors.json. Changing an event, signature, Merkle
sibling, checkpoint, owner key or record order must fail.

The four records are explicitly synthetic: a delivered request, a failed
provisioning request and two disagreeing usage measurements. Each record has an
Ed25519 signature. Its leaf is SHA-256(0x00 || canonical({record,signature})).
Internal nodes are SHA-256(0x01 || left || right). The signed checkpoint binds the
four-leaf root, count, scope and fixture timestamp. Both owner and checkpoint
SPKI SHA-256 hashes must match anchors.json. All included keys are public demo
keys. Throwaway private keys were generated in memory and not saved.

Canonical encoding v1: UTF-8 JSON; object keys sorted by ECMAScript UTF-16 code-unit order; compact
separators; array order retained; safe integers only (no floating point/NaN).
Strings are not Unicode-normalised. Event signatures use the domain prefix
COTRUGLI/DEMO/EVENT/v1 followed by a null byte. Checkpoint signatures use
COTRUGLI/DEMO/CHECKPOINT/v1 followed by a null byte.

Trust boundary: anchors are local demonstration pins, not a production PKI or
proof of legal identity. An adversary who replaces BOTH the kit and its pins can
create another self-consistent kit. Obtain the kit/manifest from a trusted
release channel. SHA256SUMS helps detect accidental changes; it is not a signed
release attestation. A matching digest does not establish truthful metering or
business acceptance.

This kit is NOT an N8CF1 confirmation, ML-DSA rail seal, or N8 FINAL proof. It
must not be imported as FINAL into fed8ra. It deliberately keeps a publicly
verifiable cryptographic example separate from the historical October 1 run.
The old run's evidence.json is a curated summary; sample-events.json is a
projection, not the full original proof bundle. Full historical rail verification
requires the original selected record, owner signatures, exact commitment,
N8CF1 confirmation, chain and trusted NEO public anchors through the existing
verifier. Those private archives were not read or republished for this release.

Source versions and run scope are in the main README. The browser runs this
same core.js via WebCrypto. Where Ed25519 is unavailable, use this offline CLI.