COSMO Execution-Case Verifier

A public, offline, single-file verifier for COSMO execution-case evidence bundles.

Run

node cosmo-verify.mjs <bundle-dir>     # verify a bundle
node cosmo-verify.mjs --show-trust     # print the embedded trust profile
node cosmo-verify.mjs --version        # version, trust hash, source sha3

Node ≥ 18. No npm packages, no network, no environment reads. Exit codes: 0 ACCEPT, 1 REJECT (the last result names the criterion K/S/T/P/M/V/J/E/D/O), 2 ERROR.

What ACCEPT means

The bundle satisfies all ten criteria under exactly the published COSMO trust profile below. This is a separate offline verification of internal consistency — not an independent third-party attestation. There is no trust override in the normal mode.

The evidence bundles under /evidence/ can be checked with this file. Point the verifier at a bundle directory; a flat published bundle is staged into the case layout deterministically, without changing any bytes.

Verify this file before trusting it

openssl dgst -sha3-256 cosmo-verify.mjs
# must equal distributable.sha3 in PROVENANCE.json (and --version source_sha3)

PROVENANCE.json also pins the build inputs and vendored package versions, so the file can be rebuilt from source and reproduced byte-for-byte.