bide-audit

Overview ¶

Command bide-audit produces and verifies audit ProofBundles from the command line, for the auditor/compliance persona who does not write Go. It is deliberately dependency-light: it imports only the core + audit packages (stdlib under the hood), no store backend, so it works against any store by operating on an exported journal (a JSON array of records) and a signed tree head. `verify` needs neither: just the bundle and a public key.

# Produce a proof that one tool call happened, against an anchored STH:
bide-audit prove -journal run.json -sth sth.json -tool call_abc -out proof.json

# Verify it offline, trusting only an out-of-band public key:
bide-audit verify -bundle proof.json -pubkey 1a2b...   # exit 0 = verified

Export the journal with: json.Marshal(store.History(ctx, runID)).