Verify a Passport capsule

Every SBO3L decision is wrapped in a Passport capsule — a self-contained, offline-verifiable proof artifact. This page runs the same Rust verifier the CLI ships, compiled to WebAssembly. You don't trust this server; you trust the bytes of sbo3l_core_bg.wasm we serve, and you can verify that bytes match the published sbo3l-core crate yourself.

SBO3L<SBO3LAGENT<ETH<<9C8A3E...7F12<<4D2F1B...A983<<AGENT IDENTITYagent · 256×256ENS NAMEsbo3lagent.ethAGENT ID0x4f2a...c8b1REPUTATION0.94 / 1.00ISSUED2026-05-03 14:22:08ZEXPIRES2026-05-03 14:32:08ZCRYPTOGRAPHIC CHECKSstructrequestpolicysignatureauditeventDECISIONALLOWREQUEST HASH0x9c8a3e...7f12POLICY HASH0x4d2f1b...a983AUDIT CHAIN LINK0xee2c7a...19feEXECUTOR EVIDENCEkeeperhub://workflow/9c8a3eACTIONuniswap.swap50,000 USDC → ETH · sepoliamax-slippage 50bps · MEV-guard ONSIGNED · ed255190xa1b2…f3e4 · sbo3l-issuer-1

Visual reference: the SBO3L Passport spread. Left page carries agent identity + the six cryptographic check seals; right page stamps the decision. The verifier on this page runs the same six checks against any capsule JSON you paste below.

Verify a SBO3L Passport capsule

Paste a capsule JSON and click Verify. The verifier runs entirely in your browser via the sbo3l-core Rust crate compiled to WebAssembly — no daemon, no network call. v2 capsules with embedded policy_snapshot and audit_segment verify all 6 cryptographic checks self-contained; v1 capsules pass the structural and request-hash checks and honestly report the others as SKIPPED.

idle

What gets checked

A v2 self-contained capsule embeds policy.policy_snapshot and audit.audit_segment; the verifier runs all 6 checks with no aux input:

  1. structural — schema + cross-field invariants (deny ⇒ no execution, live mode ⇒ evidence, hash agreement, etc.)
  2. request_hash_recompute — JCS+SHA-256 of the embedded APRP equals the claimed request_hash
  3. policy_hash_recompute — JCS+SHA-256 of the embedded policy equals the claimed policy_hash
  4. receipt_signature — Ed25519 signature on the embedded receipt verifies against the embedded receipt-signer pubkey
  5. audit_chain — the embedded audit-bundle's chain segment verifies (signatures + prev-hash linkage)
  6. audit_event_link — the bundle's summary.audit_event_id matches the capsule's audit.audit_event_id and is present in the chain segment

v1 capsules pass the structural and request-hash checks; the remaining four show as SKIPPED because the capsule doesn't carry the embedded crypto material. That's an honest report — never a fake-OK.

Source: crates/sbo3l-core/src/passport.rs (wasm.rs for the JS bridge, scripts/build-wasm-verifier.sh for the build pipeline).