VerdifaX

GET /runs/{id}/verify

Server-side verification: re-derives the manifest hash from the stored manifest fields and confirms byte-for-byte match with the recorded seal. Used by the dashboard's "Verify" button and by automated audit tooling.

Request

GET /runs/{id}/verify
X-Verdifax-Key: vfx_...

Response

200 OK, regardless of match outcome:

{
  "ok": true,
  "verified": true,
  "manifest_hash":   "6c1428f81519c5bb...",
  "recomputed_hash": "6c1428f81519c5bb...",
  "verification_at": "2026-04-30T03:35:09.001Z",
  "verification_kind": "manifest-self-seal",
  "formula_version": "v1.9 (execution record)",
  "dcae_engine_hint": {
    "available_at": "POST /dcae/verify",
    "engine_version": "verdifax-dcae/1.0.0"
  }
}

If the recomputed hash differs from the recorded hash, verified is false and recomputed_hash shows what the manifest actually re-derives to. That's a tamper indicator.

What this proves

The verifier confirms that the recorded manifest fields collapse, under SHA-256, to exactly the recorded ManifestHash. Modifying a stored manifest field without also changing the recorded hash makes this check fail. The manifest does not include the authorization chain, the causal graph and real-world effects, the request substance, or the system provenance, so this check says nothing about those sections.

What this doesn't prove

This endpoint runs on the same server that recorded the run. Cryptographically, that's a self-check. For third-party verification, what an auditor wants, run the open-source verifier, verdifax-verify, over the run's audit bundle on a different machine: offline, it recomputes every section hash, the bundle hash and the anchored public-log leaves from the bundle's own fields and confirms every section is bound to the same manifest hash. It does not re-derive the manifest hash itself; that takes the full stored manifest, against which you can run your own SHA-256 implementation of the canonical manifest preimage.

Example

curl -s http://localhost:9090/runs/42/verify \
  -H "X-Verdifax-Key: vfx_..." | python3 -m json.tool

Continue