# A signed certificate for every
AI agent output.

Cryptographic provenance for AI-generated content. Verifiable by you, your customer, or a regulator — without trusting our servers.

Start integrating → View source

EU AI Act Article 50 takes effect 2026-08-02. Penalties up to €15M or 3% global turnover for ungoverned AI output. We're built for the deadline.

### Sign at the source

The control plane runs your agent inside a SPIFFE-identified sandbox, signing every lineage edge with Ed25519. The result is a portable, content-addressed bundle — the agent's output, the chain of computation that produced it, the trust JWKS, all cryptographically bound.

### Verify anywhere

Bundles verify in your browser via a 376 KB wasm SDK, in your Python backend via PyO3, or in our public verifier service. The hosted endpoint is convenience — the SDKs are the trust root. Same Rust verifier, byte-for-byte, across all three surfaces.

### Trust the math

Every verification appends to a chain-hashed transparency log with a signed tree head. Skeptical-code audits run quarterly, external cryptographic review biennially, an adversarial corpus gates every pull request. We publish the verdicts.

## Quickstart

### Verify in 30 seconds (Python)

    pip install nucleus-verifier
    python -c "
    import json
    from nucleus_verifier import verify_bundle
    bundle = open('bundle.json').read()
    trust  = json.dumps({'trust_jwks': json.load(open('issuer.jwks.json'))})
    print(verify_bundle(bundle, trust))
    "

### Verify in the browser (JavaScript)

    import init, { verifyBundle } from '@coproduct/verifier';
    await init();
    const report = verifyBundle(bundleJson, trustAnchorJson);
    // → { ok: true, trust_mode: "out_of_band", edge_count: 5, ... }

### Verify via the hosted endpoint (curl)

    curl -sS -X POST https://verifier.coproduct.io/v1/verify \
      -H "Content-Type: application/json" \
      -d "$(jq -nc --slurpfile b bundle.json --slurpfile j issuer.jwks.json \
            '{bundle: $b[0], trust_jwks: $j[0]}')"

## What's in the box

- nucleus-envelope — portable provenance bundle format. C2PA v2.3, in-toto, SLSA Provenance v1.1, Sigstore Bundle v0.3 exports built in.
- nucleus-control-plane-server — REST job API with SPIFFE JWT-SVID auth. Mints bundles you can ship alongside your AI API responses.
- nucleus-verifier-service — this server. SQLite-backed transparency log, signed tree heads at /v1/log/sth, JWKS published at /.well-known/jwks.json.
- JS + Python verifier SDKs — same Rust verifier compiled to wasm and PyO3. Same math, same guarantees, in your process.
- nucleus-oidc-provider — OIDC OP with RFC 8693 token exchange and RFC 9068 access tokens. Mints the JWT-SVIDs the control plane authenticates against.
- Adversarial corpus — 8 hand-crafted bad bundles, CI-gated on every PR. The audit charter's load-bearing proof.

## For your compliance review

Five documents cover the regulator-facing surface. A compliance + security + dev review can complete from cold start in about ninety minutes of reading.

- EU AI Act Article 50 — obligations mapped to bundle fields, satisfies "cryptographic methods" + "logging methods" categories
- Verifier-service threat model — STRIDE, 8 threats, each with file-line anchored mitigation
- Compliance posture — EU AI Act, NIS2, SOC 2, GDPR, NIST AI RMF, ISO 42001
- Integration guide — three patterns, Python/Node/shell examples
- Audit charter — quarterly + biennial cadences, auditor pool, bug bounty roadmap

## Service endpoints (this server)

`POST /v1/verify`
  Verify a bundle against a trust anchor.
`GET /v1/bundles/{hash}/verify`
  Look up a previously-verified bundle by SHA-256.
`GET /v1/log/sth`
  Latest signed tree head of the transparency log.
`GET /v1/log/size`
  Current entry count.
`GET /.well-known/jwks.json`
  Verifier's STH signing key.
`GET /.well-known/nucleus-verifier-configuration`
  RFC 8414-style service description.
`GET /healthz`
  Liveness probe.