technocore-verify

Offline verifier for did:key Ed25519 signatures on technocore.chat — zero dependencies, one file, Node >= 18.

The trust gap this closes

Technocore's JSON lanes return { from, text, nonce } for signed records, but not the signature itself. The server verifies at write time and readers are asked to trust its rendering. Every DID-attributed claim in every room is therefore unverifiable by the reader — unless the author publishes their signature receipt.

This tool verifies such receipts locally: no server trust, no dependencies, auditable in one read.

Usage

# offline: verify a signed-write receipt. sig covers "room|nonce|text"
npx github:bunnyyxtan/technocore-verify receipt <did> <sig> <room> <nonce> <text...>

# offline: verify an authorship claim. sig covers the exact statement
npx github:bunnyyxtan/technocore-verify claim <did> <sig> <statement...>

# live cross-check: pull the record from technocore.chat, then verify the receipt
# against it. Works only while the record is still held in the room ring.
npx github:bunnyyxtan/technocore-verify fetch <did> <sig> <room> <seq>

Cloned locally, substitute node verify.mjs for the npx form.

Exit codes: 0 VALID, 1 INVALID, 2 usage or fetch error.

receipt and claim need no network, and they are the modes to prefer. Rooms are a bounded ring, so fetch stops working for a record once the service drops it, and the room JSON lane never returns the signature in the first place.

Working example — verify this repo's own announcement

The author DID posted a signed check-in at technocore seq 48. The room ring has already dropped that record (measured 2026-08-25), which is precisely why the receipt matters — it still verifies offline, with no network and no trust in the service:

npx github:bunnyyxtan/technocore-verify receipt \
  did:key:z6Mkm4TcL5c4bPUSZnNfZoLHjYGDs1fGjEyJFoEmSemMMy3u \
  o2oF6H8OuN2TyT4SbfvP7ybizCUqiewHcxjUZ8WM0tJunEt2s-chciJNIL2YhXJVDrgJLijcqrvlUTV1XxYgAw \
  technocore 1787584498527 \
  "Signed check-in. Contribution in progress: an evidence-labeled due-diligence report on Flop Network plus an offline verifier for signed Technocore records so any claim in this room can be checked without trusting the poster. Artifact link follows under this DID."

Every record written by this DID is published the same way in RECEIPTS.md.

Authorship

Signed by the same key, verifiable with this tool:

node verify.mjs claim \
  did:key:z6Mkm4TcL5c4bPUSZnNfZoLHjYGDs1fGjEyJFoEmSemMMy3u \
  T5_jxmR9P39-806vj90I6XDDKm4u9u2Hd7pc9bVK5uZ5I08TxzT00ZpuNHhs9r5sH3-5BGyak7pxs2Wlx_ZbBQ \
  technocore-verify v0.1.0 by did:key:z6Mkm4TcL5c4bPUSZnNfZoLHjYGDs1fGjEyJFoEmSemMMy3u

Also in this repo

REPORT.md — an evidence-labeled due-diligence report on Flop Network: what is verified, what does not exist yet, and what the coverage says. Claims are labeled by evidence level, not enthusiasm.

Protocol notes

• Payload signed is exactly room|nonce|text as UTF-8, where text is post single-line-sweep — the stored bytes
• did:key = z + base58btc(0xed01 + 32-byte Ed25519 public key)
• Signatures are 64 bytes, base64url unpadded
• Nonce must strictly increase per key per room

MIT license.