Prove and certificates

Prove: the record#

Prove is the record of what happened. Guard's decisions, your checks and findings, and the grants and ceilings you set are written as entries in a hash-linked record on your computer. Each entry carries a fingerprint of the one before it, so an edited, reordered or deleted entry shows up as a break in the chain. You do not have to set anything up. Guard and your checks record what they see on their own.

The Record (Prove) screen shows what is recorded, newest entries and Guard's decisions with a marker: red for a call Guard stopped, amber for one it would have stopped, held or something to look at. It also shows whether the record still matches a copy you saved.

Copies kept elsewhere#

A record that sits only on the computer that wrote it can be rewritten together with its fingerprints. To catch that, you keep an anchor, a signed statement of where the record stood, somewhere the record's owner cannot change. Later, Geometer or the open verifier can compare the record with it.

• Save the record to a folder writes the evidence and an anchor. The evidence comes as JSON, CSV and an OpenTelemetry trace file. Keep the proof-copy file somewhere other than this computer.
• Copies kept in a second place: type a folder on another disk, another machine or a synced folder and press Keep copies here. Geometer then writes a small copy of where the record stands there each time a batch of entries is recorded. If the copies get old, or the folder cannot be reached, the screen says so. The copies hold no call details. They protect only against someone who cannot also change that folder.

The screen's answers are in words: Matches your saved copy, Does not match your saved copy, Some of it is missing, and No saved copy to compare with. A match shows the record was not changed since the copy. It does not show the record is true or complete.

Call details and who can export#

The details of each call (its arguments) are stored locked on your computer. Without the key, a copy of the files does not reveal them. You can set limits by age or by total size with geo prove retention, and remove one call's details with geo prove forget. Removed details stay visible as removed, and anything that needed them can no longer be replayed.

You can give someone a credential that can only export a record, with geo prove access. It cannot read call details, delete anything or change keys, and you can revoke it. Signing keys can be listed, rotated, revoked and recovered with geo prove keys.

Turning an incident into a check#

A call that Guard stopped, held or would have stopped is an incident. On the Record screen you can copy it into a test, verify what it needs and run it again on test copies of your tools. If the same rule breaks again, the incident is reproduced and can become a check. This never sends the call again, never changes Guard's rules and keeps nothing unless you decide to. From a terminal: geo prove incidents, geo prove incident and geo prove incident-keep.

Certificates#

A certificate (the app also calls it an assessment report) states what one finished check found, rule by rule, and what it did not cover. It is signed so others can tell whether anyone changed it. For each rule it says whether a run broke it, whether it was never seen broken within the check's limits, whether it could not be decided, or whether no run reached it. It lists what was not checked.

A certificate is not proof that your agent is correct. It covers only the tasks, the time and the test copies of your tools that the check used.

The three gauges#

The certificate answers three separate questions. Geometer shows them side by side and never merges them into one mark.

Integrity compares the report with its signature. A report signed on your computer is signed by that computer's own key, and the words say it is self-signed. That shows nobody changed it. It does not show that anyone else checked it, or who issued it.

Applicability compares the version of the code the report was about with the project now. When they differ, or a newer report replaces it, or you withdraw it, the report no longer applies. Its results are never rewritten. Keeping a check does not flip a report to "changed".

Draft, issue, share, track#

Prove shows four states around one card.

• Draft. A report built from the latest finished check, unsigned, with no id. Nothing is stored. It can never be exported as a certificate.
• Issued. Issue the certificate signs the report with this computer's key and stores it. Issuing again for the same check gives the same report. Every report shows a short fingerprint, four words and a number derived from the report's id.
• Shared. Share as a pack exports the report as a folder in Geometer's own records folder, never in your project. It holds a page you can read without Geometer or a network, the evidence that may leave your computer, and a file for checking the report. Private evidence stays on your computer, and anything that looks like a password or key is left out. Export a copy to share publicly makes a separate copy, with its own name, that leaves out all private evidence.
• Tracked. When the code changes after you issued a certificate, applicability changes and the next step becomes Recheck what changed. A certificate is never reissued automatically.

Preview as a reviewer shows the page a recipient would open, before anything leaves your computer. A certificate contains no grants and no typed names.

Signing#

By default a report is signed with an Ed25519 key made on your computer. You can also turn on Also sign with the newer post-quantum method. The report is then signed twice, with the usual method and with ML-DSA-65, a newer one designed to stay secure against future quantum computers. Both signatures are then required, the file is larger, and the person checking it needs both of your computer's public keys. The first time, Geometer makes the second key. From a terminal, geo assessment create --profile hybrid does the same. A check that already has a report keeps the report it has.

Checking a certificate#

Anyone can check a certificate without Geometer. Choose the report file and a key you trust, taken from the person who made the report by a route you trust. A key that came inside the report is never used, because anyone could have put it there. Checking shows whether the report is unchanged and who signed it. It does not run the check again, and it does not show that what it found is true. See Verify records yourself for the open verifier.

From a terminal:

geo assessment key --out <where to save the key>
geo assessment verify <report folder> --trust-key <key file>

The first command saves this computer's public key and key log for the people who will check your reports. The second checks a report folder against a key you chose; --trust-this-computer trusts the key of the computer you run it on.

Next#

• Issue and share a certificateThe step-by-step guide.
• Verify records yourselfBuild the open verifier and check a pack or a certificate.