Gravit Verifier hosted service
The hosted API behind gravitverifier.space: the open-source
Gravit Verifier (pinned version) behind
API keys, with a signed, hash-chained receipt for every decision that anyone can check offline.
| Part | What |
|---|
public/ | PHP router, served at /api/v1/ |
private/ | outside the web root: lib.php (keys, plans, receipts), worker.py (runs the verifier), admin.php, data/ |
sdk/python | gravit-verifier-client: API calls plus offline verify_response and verify_export |
sdk/typescript | gravit-verifier-client: API calls |
tests/test_api.py | end-to-end test: decisions equal the verifier's golden vectors byte for byte, receipts and export verify, tampering is detected |
API v1
| Endpoint | |
|---|
POST /api/v1/verify | body {"artifact": {...}, "use_test_registry": true, "registry": optional} → {result, receipt, signature, entry_hash} |
GET /api/v1/decisions?limit= | your decision history |
GET /api/v1/decisions/{decision_id} | one decision with its receipt |
GET /api/v1/export?from_seq= | all receipts, signed and hash-chained, for your auditor |
GET /api/v1/usage | plan and monthly usage |
GET /api/v1/service-key | the service's Ed25519 public key (no key needed) |
POST /api/v1/gate | Capability Gate: {capability, action or action_hash, policy, decision_id?, overrides?} → fail-closed state SAFE / FRONTIER / UNSAFE / UNKNOWN with a receipt in the same chain |
GET /api/v1/status | health and component versions (no key needed) |
GET /api/v1/log/proof/{entry_hash} | inclusion proof of your receipt in the public receipt log, with the signed tree head; check offline with verify_log_proof |
GET /api/v1/openapi.json | OpenAPI 3.1 description of this API (no key needed) |
Next to the decision, the result carries a Graviteron: how strongly the counted evidence supports the
claim (expected) and how much evidence stands behind it (uncertainty), computed with
graviteron.evidence (vendored in
private/graviteron_evidence). Every operator is trusted equally for now, so its calibration is
not yet established; the decision itself is unchanged.
The request body is passed to the verifier byte for byte, so signed numbers keep their exact form.
The result in the response is the verifier's canonical JSON; result_sha256 in the receipt covers it.
Honest status
Early service (October 2026). Plans and prices are planned, not yet sold. The bundled registry and trust root
are test keys from the verifier's test suite; bring your own registry for real use.
Public receipt log
Once a day private/publish_log.py builds an RFC 9162 Merkle tree over the entry hashes of all
receipts of all accounts, signs the tree head with the service key and has it timestamped by three
independent RFC 3161 authorities (DigiCert, Sectigo, GlobalSign; the time counts as a Verified Fact
when at least two agree). Heads are public at https://gravitverifier.space/log/latest.json and
/log/heads/<size>.json. So we cannot quietly remove or change a receipt we issued: every later head
would show it. Merkle tree and anchors are vendored from
History Keeper.
Erasure (GDPR)
php admin.php delete <email> erases what identifies a person: the email, the API keys and the stored
results. The receipts stay: they are leaves of the public log and hold no personal data (account id,
hashes, states). Their signatures still verify; result_sha256 then refers to a result that was erased.
Remove the address from the waitlist file as well.
Capability Gate
/v1/gate answers one question for an AI agent: may this capability be used for this exact action?
The policy lists allowed, frontier and forbidden capabilities; anything else is UNKNOWN and blocked.
A frontier capability is permitted only with decision_id of a decision from /v1/verify in your
account that is a Verified Fact with status SUCCESS and whose artifact_id equals the action hash
(SHA3-256 of the canonical action, returned as action_hash). Specification and tests:
capability-gate.
Licence: Apache-2.0.
