Commands & protocol
The full command surface, the stdout directives K-Veritas recognizes, and platform support.
CLI commands
| kveritas init [--local] [--harness] | Start a session. |
| --disclosure redacted|names|open | How much the report reveals (default redacted). |
| --show-names | Keep real file names (same as --disclosure names). |
| kveritas run [--files f1,f2] -- <cmd> | Wrap and record an experiment run. |
| kveritas seal [-o path] | Sign the session into a report (+ bundle at open). |
| kveritas verify <report> | Verify a report offline (PDF or agent .json). |
| kveritas prove <report.pdf> <file> [file...] | Prove one or more files were in a signed snapshot (one self-contained proof). |
| kveritas verify-proof <proof.json> | Check a self-contained proof (or pass the report too). |
| kveritas checkout <bundle> <[run:]snapshot> <dir> [--report r.pdf] | Reconstruct a snapshot's files. |
| kveritas check --claims c.json --report r.pdf | Check paper claims against a report. |
| kveritas generate-claims --report r.pdf | Derive a claims file from a report. |
| kveritas status | Show the current session state. |
| kveritas update | Self-update the CLI. |
| kveritas clean | Remove the session directory. |
Protocol lines
K-Veritas recognizes these directives when printed to stdout, in any language. Everything captured this way is bound into the signed record.
| KVERITAS_METRIC name=<id> value=<float> [step=<label>] | Record a metric. |
| KVERITAS_PHASE name=<phase> | Mark a phase boundary (snapshot + hardware). |
| KVERITAS_CLAIM metric=<id> value=<float> [phase=<phase>] | Commit an inline claim. |
| KVERITAS_INPUT src=seed:<value> | Commit a seed. |
| KVERITAS_MODEL params=<int> arch=<name> precision=<fp16|bf16|fp32> | Declare the model card. |
| KVERITAS_WORKLOAD dataset_size=<int> epochs=<float> batch_size=<int> [seq_len=<int>] | Declare the workload. |
| KVERITAS_ARTIFACT role=model|dataset [name=<ref>] path=<file> visibility=public|private | Attest a model or dataset. |
Verification layers
verify is offline and needs no account. For an experiment PDF it checks the data hash, the RSA-PSS signature, the visual PDF hash, the provenance chain, and (if provided) the checkout bundle hash. For an agent session it checks the server-signed genesis, the full hash chain, and the server-signed seal, localizing any inconsistency to the exact entry.
Platform support
| Verify / seal / proofs / checkout / benchmarks | Cross-platform (Linux, macOS, Windows). |
| Provenance timeline & disclosure levels | Cross-platform. |
| Activity map (file reads/writes, subprocesses) | Linux only. macOS / Windows: coming. |
| Per-process hardware & HMCA attribution | Linux only. Falls back to system-wide elsewhere; per-OS support coming. |