Offline verification

Use verify-proof with a saved bundle and local trust configurations:

witness verify-proof --bundle proof-bundle.json \
  --network-config network-verification.json

Add one --peer-config for each peer network whose cross-anchor should be checked:

witness verify-proof --bundle proof-bundle.json \
  --network-config network-verification.json \
  --peer-config peer-a.json --peer-config peer-b.json \
  --output json

Do not pass --online when the verification must make no gateway requests. --network-config is required unless --online is supplied. The bundle is read from --bundle; --hash always fetches the bundle from the selected gateway and is therefore not an offline input.

Configuration input

The home file must deserialize as NetworkVerificationConfig and contain the home network ID, witness IDs and public keys, threshold, signature scheme, and public federation policy. Operator network.json files are accepted as a superset, but may contain witness endpoints and bearer tokens; use a secret-free file where possible and protect operational files.

Each peer file must have a distinct ID from the home network and from other peer files. Peer IDs must correspond to the home federation policy for their cross-anchors to verify. The configuration is the trust anchor: a file copied from an untrusted gateway is a trust-on-first-use choice and should be pinned or independently reviewed when that matters.

What is checked

The verifier validates the supplied configurations and then checks the home threshold signature. If batch inclusion is present, it checks the home network and batch linkage, leaf, root, index and tree-size bounds, and the positional RFC 9162 Merkle path. It checks each cross-anchor against the matching peer configuration, peer policy, root, network ID, and minimum witness count.

External-anchor objects are not cryptographically verified by this offline function. Their proof and optional anchored_data must be checked with the relevant provider independently.

An invalid home configuration or home threshold signature returns an invalid result and the CLI exits non-zero. Optional invalid layers remain visible in the result and prevent higher verification levels; they do not turn into home signatures. A bundle with no batch inclusion can still be Basic.