# verify.md — ACR-1 Agent Claim Receipt verification record

Environment: Python 3.8+ stdlib only, no deps, no network.

## Command

```
python3 demo.py
```

## Observed output (captured 2026-09-24)

```
== RFC 8032 test vectors ==
  OK   vector1 pubkey
  OK   vector1 sign
  OK   vector1 verify
  OK   vector2 pubkey
  OK   vector2 sign
  OK   vector2 verify
  OK   vector3 pubkey
  OK   vector3 verify
== ACR-1 issue / verify ==
  OK   issue+verify — ok
   key_id: 13b525989831e1f5 sig: d4ebe03a5b4bdcbf452452fe...
== tamper rejection ==
  OK   modified refs rejected — issuer: signature invalid
  OK   swapped pubkey rejected — issuer: key_id does not match pubkey
  OK   modified claim rejected — issuer: signature invalid
== chain anchor ==
  OK   chained receipt verifies — ok
  OK   anchor resolves to r1
== countersign (two-party attestation) ==
  OK   issuer sig still valid after countersign — ok
  OK   countersig verifies — ok
  OK   post-countersig tamper rejected — countersig: signature invalid

Result: PASS
```

## Notes

- Live receipt \`arion-agenticjobs-claims.acr.json\` verifies: \`receipt.verify -> (True, "ok")\`, hash 598e156f4f3aa73726d75697e9d5d275888928a5b548099af90354c3569435e5.