GOVP
Source
GOVP 0.1.13

Verify an agent activity record

A fictional five-event example: verify the original statement, then detect changed data and a changed signed record.

Synthetic teaching example. No language model or Gemacode containment runtime was executed. GOVP verifies the signed record and the exact supplied bytes; it does not independently observe or enforce the events described.

Follow the statement

  1. Proposal A: write operation-A.txt.
  2. Authorization A: a fictional permission allows A.
  3. Action A: the statement declares completion and gives the output file's SHA-256.
  4. Proposal B: write a second file.
  5. Refusal B: the statement declares denial under that fictional permission.

The absence of an output for B is part of the constructed example. It does not demonstrate that a real prohibited action was prevented. The event JSON is a teaching format, not a normative GOVP extension.

Prepare the recipient's machine

Install the verifier while connected, then download the six files below into one folder. Once the verifier and its dependencies are installed, all three verification commands read local files without contacting the sender.

python -m pip install govp==0.1.13
python -m govp self-test

This newly added sample is downloaded separately; it is not part of the existing 0.1.13 package's govp examples --extract output. Run the following commands from the folder containing the downloaded files.

1. Verify the original

python -m govp verify agent-record.govp.txt --asset agent-record.json

Expected: VALID, exit 0. Format, signature, GOVP-ID and asset checks pass. canonical remains not checked because the record is read from disk.

2. Change the declaration

The manipulated statement changes the last event's decision from deny to allow, leaving the signed record untouched.

python -m govp verify agent-record.govp.txt --asset agent-record.tampered.json

Expected: INVALID, exit 1. The signature still passes; the asset check is FAIL. This establishes a byte mismatch, not a policy violation or a forged signature.

3. Change the signed record

The manipulated record changes its publisher field without creating a new signature.

python -m govp verify agent-record.tampered.govp.txt --asset agent-record.json

Expected: INVALID, exit 1. The signature check is FAIL; the asset check passes. Add --json to preserve individual checks. Exit 2 means an input or command problem; it is not a cryptographic rejection.

Check the separately referenced output

GOVP verification of the JSON does not automatically inspect files named inside it. Calculate the output file's SHA-256 and compare it with artifact_sha256 in event 3:

python -c "import hashlib,pathlib; print(hashlib.sha256(pathlib.Path('operation-A.txt').read_bytes()).hexdigest())"

Expected SHA-256:

5b325f0e05656ae2bd093d7e711767c0329b27aaa238fe66aa91d3153ede2236

The repository walkthrough also provides an automated comparison.

Interpret the result

The signing key was generated for this demonstration and its private key was discarded. The embedded public key and the supplied PEM are demonstration material, not an institutional trust anchor or a signature by Gemacode's CEO.

The agent.example URLs and declared timestamp are fictional metadata. No canonical retrieval, live status, independent timestamp, institutional identity or event completeness has been established. Verification does not prove that a real agent acted, was authorized or was contained. Evaluate source evidence and recipient policy separately.

The supplied bytes can be verified repeatedly. The discarded private key and its exact signature are not reproducible. This fixture does not qualify a product for production or substitute for an independent evaluator.

Quick start · Browser verifier · Security and trust boundaries · Example source files