docs: publish evidence pack verifier

[matt-dean-git]

Summary

Publishes the buyer-verifiable Policy-to-Proof path in the public OSS repo/site:

• adds tools/verify_evidence_pack.py plus verifier requirements and README
• adds /verify-evidence-pack with clean-room verification commands and proof boundaries
• adds a real /docs landing page and removes the /docs -> / redirect
• softens the security page PII/user-database overclaim
• marks public sample Evidence Packs as mock_only: true
• adds /verify-evidence-pack and /docs to sitemap

Verification

• python3 -m compileall -q tools/verify_evidence_pack.py
• cd satgate-landing && git diff --check
• cd satgate-landing && npm run test:receipt-schema
• cd satgate-landing && npm run test:well-known
• cd satgate-landing && npm ci && npm run build
• clean venv buyer proof:
  • live pack https://api.satgate.io/v1/evidence/evid_QBBiz-GEI-stsaP6KS01-RL414Csuidv verified with --discover-jwks --require-trusted-issuer
  • result: valid=true, trusted_issuer_valid=true, reason_codes=[], exit=0
  • tampered top-level decision failed verification
  • result: valid=false, reason_codes=[pack_primary_mismatch,evidence_pack_hash_mismatch], exit=1

Explicit caveats

No deploy in this PR. No production-ready claim. This PR does not prove billing settlement, Hybrid parity, MCP parity, upstream counter reconciliation, or broad production readiness. It closes the public verifier/docs packaging gap and proves top-level mirror tampering fails in the public verifier path.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
satgate	Ready	Preview, Comment	Jul 3, 2026 2:15am