Standalone reference verifier for the world-model-mcp v0.13+ tamper-evident audit log
Wellknown found it in public sources; nobody has proven control of it yet. Claiming takes one click if the repository is under your GitHub account, or a small file on your domain otherwise. Verified owners get the badge, 15-minute checks, status alerts, edits that outrank crawled data, and a ranking boost.
Agents can do it too: POST https://wellknown.network/api/v1/claims with {"agent":"world-model-mcp-verifier","method":"well_known_file"} — machine-readable steps at claim.json, guide at /docs/claim.
Everything here was measured by our prober or read from a registry. Nothing is self-reported.
Attributed to the source that supplied each field. Treated as claims, not facts.
# world-model-mcp-verifier Standalone reference verifier for the [world-model-mcp](https://github.com/SaravananJaichandar/world-model-mcp) v0.13+ tamper-evident audit log. **Python + TypeScript**, both languages tested against the same JSON test vectors so drift is caught at CI time. Compliance auditors download this repo, pin the operator's public-key fingerprints, and verify audit-log inclusion proofs locally. Nothing here depends on the world-model-mcp server at runtime — that is the point. If the server can convince this verifier that a fact was recorded in a signed epoch, the fact was recorded. If it cannot, verification fails with a specific reason. ## What gets verified Given an inclusion-proof bundle produced by the world-model-mcp server's `prove_entry_inclusion` MCP tool + the operator's Ed25519 and SLH-DSA-SHA2-128f public keys, the verifier confirms: 1. Every closed epoch in the chain has a hybrid signature that verifies under the operator's public keys against the canonical epoch payload. 2. Each epoch's `prev_epoch_root` matches the previous epoch's `merkle_root` (or `EPOCH_GENESIS_ROOT` for the first). 3. The RFC 6962 Merkle inclusion proof verifies for the entry's `row_hash` at the given `leaf_index` against the containing epoch's `merkle_root`. Any single failure returns a specific reason — which epoch, which check. The verifier fails closed on every unexpected input. ## Algorithm choices - **Hash function:** SHA-256 (FIPS 180-4). - **Signature primitives:** Ed25519 (FIPS 186-5) + SLH-DSA-SHA2-128f (FIPS 205). Hybrid — both signatures required for verification. - **Merkle tree:** RFC 6962 (same as Certificate Transparency). - **Domain separation:** every signed message is prefixed with `world-model-mcp/audit-log/epoch-root/v1\0`. Full rationale in [docs/AUDIT_LOG.md](https://github.com/SaravananJaichandar/world-model-mcp/blob/main/docs/AUDIT_LOG.md) on the main repo. ## Python Install: ```bash pip install world-model-mcp-verifier ``` U…
Mapped onto the structured taxonomy from declared text and observed tool names. Confidence shown for derived entries.
Every source is kept verbatim. Field changes are logged as events.