bide-audit

Overview ¶

Command bide-audit produces and verifies audit ProofBundles from the command line, for the auditor/compliance persona who does not write Go. It is deliberately dependency-light: it imports only the core + audit packages (stdlib under the hood), no store backend, so it works against any store by operating on an exported journal (a JSON array of records) and a signed tree head. `verify` needs neither: just the bundle and a public key.

# Produce a proof that one tool call happened, against an anchored STH:
bide-audit prove -journal run.json -sth sth.json -tool call_abc -out proof.json

# Verify it offline, trusting only an out-of-band public key:
bide-audit verify -bundle proof.json -pubkey ed25519:1a2b...   # only exit 0 means verified

Exit status: 0 verified, 1 not verified, 2 usage error, 3 no verdict, 4 input unreadable or unusable (see exitFor). Only 0 means verified.

Export the journal with audit.ExportJournal(ctx, store, runID), marshaled to JSON.