Skip to content

Reviewer Fast Path

Jump to bottom
Meridian Verity Group edited this page Jul 19, 2026 · 1 revision

Reviewer Fast Path

This path is designed for a fresh local environment and public, synthetic data only.

Warning

Do not use customer data, production logs, credentials, payment data, API keys, private implementation mappings, or other sensitive material.

Prerequisites

  • Python 3.10 or newer
  • Git or the current release ZIP
  • a fresh virtual environment
  • normal network access to install Python dependencies

Option A — frozen release tag

git clone --branch v2.2.6-public-eval --depth 1 \
  https://github.com/meridianverity/permit-receipt.git
cd permit-receipt
python -m venv .venv

Activate the virtual environment:

# Linux/macOS
. .venv/bin/activate

# Windows PowerShell
.venv\Scripts\Activate.ps1

Use the corrected portable install path:

python -m pip install --upgrade pip
python -m pip install -r requirements.txt
python -m pip install -e . --no-deps

The portable path intentionally allows build isolation. The immutable v2.2.6 release documentation previously showed --no-build-isolation without first installing the pinned build backend; that can fail in a fresh environment. See Current Status and Errata.

Run the selected review packet

python ietf126/run_review_packet.py
python ietf126/independent_recompute.py
python ietf126/independent_crypto_verify.py
cat ietf126/results/review-summary.md

Published v2.2.6 results:

IETF 126 selected review packet:       20 / 20 PASS
Independent recomputation:             17 / 17 PASS
Independent crypto verification:       19 / 19 PASS

Run the public vectors and strict tests

python run_vectors.py
PYTEST_DISABLE_PLUGIN_AUTOLOAD=1 PYTHONWARNINGS=error \
  python -m pytest -q -p no:cacheprovider

On Windows PowerShell:

$env:PYTEST_DISABLE_PLUGIN_AUTOLOAD = "1"
$env:PYTHONWARNINGS = "error"
python -m pytest -q -p no:cacheprovider

Published v2.2.6 results:

ORPRG public evaluation vectors: 76 / 76 PASS
Strict pytest:                  323 / 323 PASS

Run the short scenario demo

python -m paygate_hybrid.hybrid_demo
python tools/run_public_eval.py

The expected scenario family includes:

  • a joint ORPRG + domain-profile ALLOW that reaches a synthetic COMMIT stage;
  • scope mismatch denied at the ORPRG stage;
  • missing domain evidence denied after ORPRG ALLOW;
  • direct-provider bypass denied by the synthetic provider adapter; and
  • evidence tampering detected in audit-only validation.

The agentic-commerce profile is one synthetic example. It does not process live payments and is not a production payment integration.

Reviewer questions

After running the packet, inspect these questions rather than relying only on pass counts:

  1. Does canonicalization include every field that can materially change the effect?
  2. Can a receipt for one target, purpose, audience, tenant, jurisdiction, operation, or budget authorize a different effect?
  3. Are stale epochs, rollback, missing status evidence, replay, malformed data, duplicate keys, and unsupported profiles denied?
  4. Is authenticity checked independently of the main verifier path?
  5. Can any effect-bearing path bypass the intended gate?
  6. Are ALLOW and DENY records sufficient for later reproduction without exposing sensitive data?

Deeper paths

Clone this wiki locally