Offline and identity-free

Makes no network calls. A JWKS is a saved file. Holds no signing keys and never contacts an identity provider.

Read-only, never writes the audited project

The provenance report goes to stdout. The verifier never mutates the project it checks, down to the package boundary.

Tamper-evident, catches a single changed byte

Re-derives artifact hashes and replays the manifest chain. A single changed byte surfaces as a distinct verification failure.