Signed claims and public verification

FedGrade's strongest provenance guarantee: a validated claim can ship as an independently verifiable artifact that a third party can check without trusting FedGrade. This is the "C2PA for intelligence claims" position — verifiable provenance as a protocol, not a marketing badge.

What a signed artifact is

Each artifact bundles the facts that make a claim checkable: the source-chunk hash, the retrieval timestamp, the validator version, the provenance grade, and a SHA-256 of the normalized excerpt the claim rests on. The bundle is serialized to a deterministic canonical form (recursively sorted keys, no whitespace) and signed with FedGrade's Ed25519 key. The published canonicalization rule is what lets anyone recompute and verify the same bytes.

Verifying without trusting FedGrade

A third party — a CI job, an agent, a journalist's script — can verify a FedGrade claim end to end:

1. Fetch the public keys from /.well-known/fedgrade-keys.json (the JWKS).
2. Recompute the canonical form of the artifact.
3. Check the Ed25519 signature against the published key for the artifact's key id.
4. Optionally recompute the excerpt SHA-256 to confirm the cited text.

No FedGrade account, no API key, no trust in FedGrade's servers — the math either checks out or it doesn't. Key rotation is supported: retired public keys stay in the verification set so artifacts signed under an old key keep verifying.

The /verify surface

• The public verifier page at /verify lets you paste an artifact, its signature, and (optionally) the excerpt, and runs the checks in the browser-facing API.
• POST /api/verify is auth-free and CORS-open by design — off-platform verifiers call it cross-origin. It accepts either a pasted { artifact, signature, key_id, excerpt } or a stored { signature_id }, and returns { valid, checks: { signature, canonical_form, excerpt_hash } }.
• The verify_claim MCP tool exposes the underlying claim-support validator as a primitive — the same gate FedGrade's own briefs must pass.

Privacy

Artifacts embed the claim text by design — that text is exactly what gets verified. v1 only ever signs claims from library-wide (anonymous) briefs, and the stored-artifact read path additionally filters to records with no workspace, so the public verify endpoint can never serve tenant data.

Honest limits

Signing is a configured capability — it activates when FedGrade's signing key is provisioned and no-ops cleanly otherwise (no behavior change anywhere when unset). Verification proves a claim was issued and unaltered by FedGrade against a cited source; it does not, by itself, prove the underlying source is correct — that is what the citation and the source link are for.