@northwind/cool-verifier

© 2026 Pranauv Shrinaath S. · CooL is a project of NorthWind Cipher (in incorporation) · CooL™ trademark pending.

cool verify <receipt> — verify a CooL receipt fully offline and get an honest, per-domain verdict. This is the trust-building asset: its honesty is the whole point.

What this proves: what was computed and that the record is unforged. What this does NOT prove: that the output is correct, fair, unbiased, safe, or policy-compliant.

The honest per-domain status lives in cool-spec/STATUS.md. Attestation and anchor are mock/absent in this build and are NEVER shown as a pass.

Install

npm install -g @northwind/cool-verifier

Requires Node ≥ 22. The verifier shares the SDK's single verification core (@northwind/cool-sdk) — there is no second implementation.

Usage

cool verify receipt.json
cool verify receipt.json --json        # structured verdict
cool verify receipt.json --strict      # sterner wording about mock/absent domains
cool --version
cool verify --help

Example output:

CooL — receipt verification  ·  cool.receipt.v1
Record   acme/credit-scorer@2026.06.0    issued 2026-06-22T10:14:07.221Z    01J6XR7K8M2Q…

  ✓  Binding hash   recomputed from record, matches
  ✓  Signature      ML-DSA-65 + Ed25519 valid (key cool-sign-2026Q2-01)
  ✓  Inclusion      leaf 0 ∈ tree(3); STH signature valid
  —  Witnesses      0 independent (1 self-signature, not counted)
  —  Attestation    MOCK — no hardware quote present (planned)
  —  Anchor         NONE — not anchored to a public chain (planned)

Verdict: RECORD AUTHENTIC AND UNALTERED
         · contents cannot have been forged or edited by the operator
         · NOT yet independently witnessed or time-anchored

Three honest states

Glyph	Meaning
✓	verified
✗	FAILED (forces a non-zero exit)
—	mock / absent (never a pass)

Exit codes

Code	Meaning
0	ok — including legitimately mock/absent domains
2	REJECTED — a required domain (binding/signature/inclusion) FAILED
1	operational error — file not found, invalid JSON, or usage

Verify the examples

npm run build
node ./bin/cool.js verify ../cool-spec/examples/valid-receipt.json                 # exit 0
node ./bin/cool.js verify ../cool-spec/examples/tampered/mutated-output.json        # exit 2
node ./bin/cool.js verify ../cool-spec/examples/valid-receipt.json --json

Local development

The verifier depends on @northwind/cool-sdk via a local path. Clone both repos as siblings and build the SDK first:

# both repos side by side: ./cool-sdk and ./cool-verifier
cd cool-sdk && npm ci && npm run build
cd ../cool-verifier && npm ci && npm test

Publishing

For local development and CI the dependency on @northwind/cool-sdk is a local path (file:../cool-sdk) so the two repos work side by side without a registry. Before a real publish, a human with the org token must change that dependency to the published registry range ("@northwind/cool-sdk": "^0.1.0"). This project stops at npm publish --dry-run; it does not publish.

Security

Pre-audit software. See SECURITY.md.

Licence

Apache-2.0. © NorthWind Cipher (in incorporation).