verify-trust 0.1.0

CI verifier for VGI: checks that every commit in a git range is signed by a DID the community's Trust Registry currently authorizes.
Documentation

verify-trust: verify a git commit range against the VTC Trust Registry.

For every commit in a range this module answers two questions, in order:

  1. Who signed it, cryptographically? The commit's gpgsig header is parsed as a PROTOCOL.sshsig blob; the Ed25519 public key embedded in it is matched against the keys published in the DID documents of the repository's declared signers, and the signature is verified over the exact bytes git signed.
  2. Is that DID trusted, right now? The signer DID is checked against the Trust Registry with a TRQP authorization query ({entity: signer, authority, action, resource}) via trql-client.

The signer set comes from a committed index file (default .did-signers, one DID per line) that lists identities, not keys — keys are resolved from each DID document at verification time, so key rotation never requires touching the repository, and revoking a signer is a registry operation that takes effect on the next run.

Failure is closed at every layer: an unsigned commit, a signature by an unpublished key, a cryptographically invalid signature, an unauthorized DID, and an unreachable registry all fail the check — each with its own status so an operator can tell which remediation applies.