Verify the verdict without us.

Formal AGDA™ SEDI Intervention Readiness assessments ship with a signed JSON regulator bundle. The agda-verify command runs locally under Node.js 18+. You do not depend on us to read what we produced for you.

  • Deterministic
  • SEDI signed
  • Bundle-verifiable

What's in the bundle.

A current regulator bundle uses bundleVersion 1.1 and contains the report, attestation envelope, signed result, input, manifest, verification metadata and verification history. The Ed25519 signature covers the canonical envelope. The envelope commits to the input hash, output hash and manifest hash. 

{
  "attestationVersion": "1.2",
  "engineVersion":      "2.0.6",
  "engineHash":         "17594a80a72888a18e8b2c40b6e2fddaf56989f0bb417bc884111f8260355e50",
  "transformVersion":   "N/A",
  "catalogueVersion":   "1.0",
  "methodologyVersion": "1.3.0",
  "rubricVersion":      "1.3.0",
  "keyId":              "2026-05-02-d7e5468e",
  "scoredAt":           "2026-05-14T09:47:12.334Z",
  "inputHash":          "47a2e19c41d4...cd8b103e4f8d",
  "outputHash":         "91f4c02a6800...a6d0d4e7ad91",
  "manifestHash":       "36b45cbe3e7cc74368febfb01db81bb23c792d1c4884e0cff0983e533edc1c12",
  "signature":          "M4Gb2ZqAfD...pLQX7w=="
}
attestationVersion
The attestation envelope schema version. Current production format: 1.2.
engineVersion
The AGDA™ engine semver. Pinned at the assessment.
engineHash
Engine hash recorded in the resolved manifest and committed by the attestation envelope.
transformVersion
Transform identity for the assessed output. N/A for the core SEDI engine.
catalogueVersion
Failure-mode catalogue version used by the assessment.
methodologyVersion
Methodology version stamped on the result and bound into the attestation.
rubricVersion
Rubric version stamped on the result and bound into the attestation.
keyId
Date-stamped Ed25519 key identifier matched to the public key in the manifest registry.
scoredAt
ISO-8601 UTC timestamp. The moment of attestation.
inputHash
SHA-256 of the canonical input record. Includes the fact model.
outputHash
SHA-256 of the canonical AGDA™ result payload, excluding the attestation field.
manifestHash
SHA-256 of the resolved engine manifest, binding key, catalogue and engine identity together.
signature
Base64 Ed25519 signature over the canonical attestation envelope, excluding the signature field.

How to verify.

A single command. A pinned key ID. A local verifier the supervised entity does not control. 

$ agda-verify --key-id 2026-05-02-d7e5468e --bundle ./bundle.json
[verify] result:
  attestation present: ✓ yes
  manifest found:      ✓ yes
  manifest integrity:  ✓ yes
  signature valid:     ✓ yes
  output integrity:    ✓ yes
  input integrity:     ✓ yes
  revocation checked:  ✓ yes
  revoked:             ✓ no

  ✓ ATTESTATION VALID

The verifier ships as the agda-verify package command: a self-contained Node.js CLI for Node.js 18+. It checks signature validity, manifest integrity, output integrity, input integrity when input is present, and revocation status when registry entries are available. It uses compiled JavaScript, public keys, manifest data and registry data from the customer distribution, and never contacts Intervene infrastructure.

Public keys and registry.

Public keys ship with the verifier package. Engine manifests and signed revocations are recorded in the append-only registry used by the verifier. Historical public keys remain available so historical attestations can still be checked.

Key material
public-keys/. Ed25519 public keys only.
Registry
engine-registry.jsonl. Append-only engine manifests and signed revocation entries.
Rotation
Keys may rotate for scheduled rotation, suspected compromise or engine-version retirement.
Revocation
Signed revocation entries in the registry or bundle. The verifier honours only revocations with a valid registry signature.

Three audiences. One verify path.

The same bundle. The same command. The same answer in three places that would otherwise have to trust each other.

  • Audit committee.

    Confirm that the signed SEDI result the chair is being asked to rely on is bound to a specific engine version and a specific set of inputs. No vendor trust required.

  • Internal audit.

    Run the packaged agda-verify CLI in your own environment. Compare hashes, manifest and signature against the bundle. Pass or fail is mechanical.

  • Regulator.

    Take the bundle from the supervised entity. Verify in the regulator estate. Independent of any conversation with us or with the entity.

Why this is the load-bearing claim.

Big-4 advisories produce PDFs. GRC platforms produce dashboards. Neither is mechanically bound to a signed result. The same inputs do not always produce the same output, and the recipient must trust the producer to read what the producer produced.

AGDA™'s verify path is the property that makes an Intervention Readiness verdict defensible in an examination, not just credible in a boardroom. If a signed SEDI bundle cannot be verified in your own environment, it has not done its job.

Opinion is not reproducible. The result is deterministic; the signed SEDI regulator bundle is independently verifiable.

Want to see what a verdict looks like?

The sample verdict includes a redacted historical attestation summary. Current assessments ship a full bundle bound to your own assessed system.

View sample verdict Book a conversation