Gatesi receipt checkers
==========================

These two scripts check a signed receipt (and, optionally, the run's trace) on your own computer.
They do not contact Gatesi or the internet. The format they check is written down in /spec/receipt-v1.md,
so you can also write your own checker.

You need two files from the Gatesi that issued the run:

1. The receipt: in the viewer open the run, tap "Signed receipt" and copy the text into a file called receipt.json.
   (Or: GET /v1/runs/RUN_ID/receipt?detail=1 with your admin token.)
2. The trace (optional but recommended): in the viewer open the run, tap "Export trace", save it as trace.json.
   (Or: GET /v1/runs/RUN_ID.)

Run one of:

   python3 agentgate_verify.py receipt.json trace.json --key-id KEYID
   node agentgate_verify.mjs   receipt.json trace.json --key-id KEYID

KEYID is the 16-character key id you got from the issuer in a way you trust (for example in person, or from
their published page). Without --key-id the check only shows the receipt is internally consistent: anyone could
have made a receipt with their own key. With it, a pass means: that key's owner signed exactly this chain head,
and the trace is exactly the events that chain head commits to.

Result: "everything checked passed" (exit code 0), or PROBLEM lines and "DO NOT TRUST THIS RECEIPT" (exit code 1).

What a pass does not mean: that the agent did nothing outside Gatesi, or that the issuer is honest.
It is the issuer's own record, made tamper-evident.

Python needs version 3.7 or newer and nothing else (the signature check is built in, so it takes about a
second). Node needs version 18 or newer.