Prove and certificates

Prove keeps a record of what Geometer checked and found, which you can export and show to others. A certificate is a signed report built from a finished check. Neither one says your agent is right. They say what was checked, and whether the record has changed since.

Prove: the record

Prove is the record of what happened. Guard’s decisions, your checks and findings are written as entries in a hash-linked record on your computer. Each entry carries a fingerprint of the one before it, so an edited, reordered or deleted entry shows up as a break in the chain. You do not have to set anything up. Guard and your checks record what they see on their own.

geo prove status shows what is recorded and whether the record still matches a copy you saved.

Copies kept elsewhere

A record that sits only on the computer that wrote it can be rewritten together with its fingerprints. To catch that, you keep an anchor, a signed statement of where the record stood, somewhere the record’s owner cannot change. Later, Geometer or the open verifier can compare the record with it.

• Save the record to a folder with geo prove export writes the evidence and an anchor. The evidence comes as JSON, CSV and an OpenTelemetry trace file. Keep the proof-copy file somewhere other than this computer. geo prove anchor saves only the anchor.
• Copies kept in a second place: geo prove copies <folder> takes a folder on another disk, another machine or a synced folder. Geometer then writes a small copy of where the record stands there each time a batch of entries is recorded. If the copies get old, or the folder cannot be reached, geo prove status says so. The copies hold no call details. They protect only against someone who cannot also change that folder.

The answers of geo prove status are in words: Matches your saved copy, Does not match your saved copy, Some of it is missing, and No saved copy to compare with. A match shows the record was not changed since the copy. It does not show the record is true or complete.

Call details and who can export

The details of each call (its arguments) are stored locked on your computer. Without the key, a copy of the files does not reveal them. You can set limits by age or by total size with geo prove retention, and remove one call’s details with geo prove forget. Removed details stay visible as removed, and anything that needed them can no longer be replayed.

You can give someone a credential that can only export a record, with geo prove access. It cannot read call details, delete anything or change keys, and you can revoke it. Signing keys can be listed, rotated, revoked and recovered with geo prove keys.

Turning an incident into a check

A call that Guard stopped, held or would have stopped is an incident. geo prove incident copies it into a test, verifies what it needs and runs it again on test copies of your tools. If the same rule breaks again, the incident is reproduced and can become a check. This never sends the call again, never changes Guard’s rules and keeps nothing unless you decide to. geo prove incidents lists them and geo prove incident-keep keeps one.

Certificates

A certificate (the command line calls it an assessment report) states what one finished check found, rule by rule, and what it did not cover. It is signed so others can tell whether anyone changed it. For each rule it says whether a run broke it, whether it was never seen broken within the check’s limits, whether it could not be decided, or whether no run reached it. It lists what was not checked.

A certificate is not proof that your agent is correct. It covers only the tasks, the time and the test copies of your tools that the check used.

The three gauges

The certificate answers three separate questions. Geometer shows them side by side and never merges them into one mark.

The three gauges

Gauge	Question	States
Assessment	What did the check find?	None, found problems, held, incomplete
Integrity	Is this report unchanged since it was signed?	None, draft, signed, invalid
Applicability	Does it still apply to the current code and settings?	None, current, changed, unknown

Integrity compares the report with its signature. A report signed on your computer is signed by that computer’s own key, and the words say it is self-signed. That shows nobody changed it. It does not show that anyone else checked it, or who issued it.

Applicability compares the version of the code the report was about with the project now. When they differ, or a newer report replaces it, or you withdraw it, the report no longer applies. Its results are never rewritten. Keeping a check does not flip a report to “changed”.

Draft, issue, share, track

A certificate goes through four states.

• Draft. A report built from the latest finished check, unsigned, with no id. Nothing is stored. It can never be exported as a certificate.
• Issued. geo assessment create signs the report with this computer’s key and stores it. Issuing again for the same check gives the same report. Every report shows a short fingerprint, four words and a number derived from the report’s id.
• Shared. geo assessment export saves the report as a folder in Geometer’s own records folder, never in your project. It holds a page you can read without Geometer or a network, the evidence that may leave your computer, and a file for checking the report. Private evidence stays on your computer, and anything that looks like a password or key is left out. --public makes a separate copy, with its own name, that leaves out all private evidence.
• Tracked. When the code changes after you issued a certificate, applicability changes and the next step is to check again and create a new report. A certificate is never reissued automatically.

geo assessment show --html shows the page a recipient would open, before anything leaves your computer. A certificate contains no typed names.

Signing

By default a report is signed with an Ed25519 key made on your computer. You can also sign with the newer post-quantum method. The report is then signed twice, with the usual method and with ML-DSA-65, a newer one designed to stay secure against future quantum computers. Both signatures are then required, the file is larger, and the person checking it needs both of your computer’s public keys. The first time, Geometer makes the second key. Use geo assessment create --profile hybrid. A check that already has a report keeps the report it has.

Checking a certificate

Anyone can check a certificate without Geometer. Take the report file and a key you trust, taken from the person who made the report by a route you trust. A key that came inside the report is never used, because anyone could have put it there. Checking shows whether the report is unchanged and who signed it. It does not run the check again, and it does not show that what it found is true. See Verify records yourself for the open verifier.

For example:

geo assessment key --out <where to save the key>
geo assessment verify <report folder> --trust-key <key file>

The first command saves this computer’s public key and key log for the people who will check your reports. The second checks a report folder against a key you chose; --trust-this-computer trusts the key of the computer you run it on.

Next

• Issue and share a certificate (The step-by-step guide.)
• Verify records yourself (Build the open verifier and check a pack or a certificate.)