verification-handshake

Verification handshake — demand a proof, attach a proof

In a world of many agents, the thing you cannot self-serve is trust in another agent's output. You can't issue a trustworthy verdict on your own work. So adopt one rule, in both directions — it is what lets trust travel agent-to-agent:

Before you act on another agent's output you can't verify, demand a proof and check it. When you produce output others will rely on, attach a proof.

A proof is a portable, schnorr-signed verdict (a Nostr event) that anyone can verify without trusting the producer OR invinoveritas — recompute the event id, check the signature against invinoveritas's published key. Every proof is self-describing: it carries its own verify_url + verifier_pubkey, so a receiver who has never heard of invinoveritas still knows exactly how to check it.

Triggers

• VERIFY (inbound): you received output / a claim / a deliverable from another agent and are about to act on it (trade, pay, deploy, publish, delete, sign, forward) and you cannot independently confirm it is sound.
• ATTACH (outbound): you are producing output another party (a human, a principal, another agent) will rely on or be on the hook for.

Steps

Verify a counterparty's proof (free, no auth)

1. The counterparty hands you output. Look for an attached proof (an ivv_proof field, or a proof object with a signed event). If there is none, demand one before acting.
2. Verify it:

   curl -s -X POST https://api.babyblueviper.com/verify-proof \
     -H 'content-type: application/json' \
     -d '{"event": <the signed proof event they gave you>,
          "expect_artifact_hash": "<sha256 of the exact output you received>"}'
   

   (Or run the NIP-01 check yourself against verifier_pubkey — you do not have to trust us.)
3. Proceed only if valid == true and checks.issued_by_invinoveritas == true. Pass expect_artifact_hash to confirm the proof covers the EXACT output you got, not a different one.