Module 6: Verification, Attestation, and Revocation

6.1 — Verification in Practice

from vcp import Orchestrator, VerificationContext, VerificationResult

verification_context = VerificationContext(
    trust_config=trust,
    model_family="example-model-*",
    purpose="customer-support",
    environment="production",
    audience="adult",
    region="GB",
)

result = Orchestrator(trust).verify(
    bundle,
    context=verification_context,
)

if result is not VerificationResult.VALID:
    raise PermissionError("VCP verification failed: " + result.name)

The SDK has no universal fixed-duration verification guarantee and no dedicated timeout outcome. Set a timeout around network-dependent acquisition and revocation work at the application boundary, then choose a documented failure policy.

6.2 — The 17 Verification Outcomes

Only VALID permits the application to continue to local enforcement. Avoid retrying security failures as if they were transient.

6.3 — Safety Attestation

The issuer signature binds bundle bytes to an issuer key. A separately trusted auditor can sign a safety-attestation claim. VCP-SDK 4.2.0 recognises:

A valid signature establishes integrity and provenance relative to configured trust anchors. It does not independently establish that the review method was adequate, lawful, complete, or correctly described. Governance must define the evidence required for each claim.

6.4 — Revocation

A manifest may provide an HTTPS real-time check_uri and a CRL crl_uri. The SDK validates schemes, ports, credentials, fragments, DNS results, resolved addresses, response size, JSON shape, issuer binding, and freshness before accepting network evidence.

"revocation": {
  "check_uri": "https://status.example.org/vcp/revocation",
  "crl_uri": "https://status.example.org/vcp/crl.json"
}

If a manifest declares no revocation URI, the current SDK logs that revocation was not configured and treats the bundle as not revoked. High-assurance deployments that require revocation must reject bundles without an approved revocation mechanism in an application policy or custom enforcement plugin.

If configured endpoints fail, the orchestrator returns FETCH_FAILED. Decide whether each action class blocks, uses a still-valid verified cache entry, or enters a separately constrained fallback.

6.5 — What Verification Proves

• The accepted bytes matched their declared canonical hash
• The signatures verified under the configured algorithms and keys
• The issuer and auditor matched current trust anchors
• Configured temporal, replay, budget, scope, and revocation checks passed

Verification does not prove that a model followed the content, a tool action was safe, a reviewer exercised sound judgment, the system complied with law, or downstream logs are complete. Those need separate runtime, human, legal, and operational evidence.