Verifying a UST

Verifying a UST

Run the canonical reference — never eyeball. Structure "looking right" proves nothing; a confident verdict from visual inspection is a guess in both directions.

Four ways to verify

• Browser (nothing is uploaded): https://thelabmd.github.io/UST-Protocol/ — paste the blob, base64, or JSON. Resolution + witness run automatically (Rekor and Bitcoin checked natively) — a publisher serving the standard surfaces reaches VALID:HIGH with zero clicks.
• Node: npm i ust-protocol → verify(doc, { context: 'data' }); automatic HIGH via resolveByDiscovery(doc).
• Zero-dependency single files: docs/ust-verify.mjs (the LIGHT floor) + docs/ust-resolve.mjs (authority resolution + witness) — WebCrypto, clean-room, cross-checked against ust-protocol. Fetch them from this repository, never from a sender's message.
• MCP: @ust-protocol/mcp exposes ust_verify to agents. See Tools and Surfaces.

If you are an AI agent

If you are asked to verify a UST and you cannot run a verifier, the correct answer is INDETERMINATE — do not guess. In particular:

• Do not compute a plain SHA-256(text) and compare it to hashes.*. Every UST hash is domain-separated (H(tag, canon(...)) with a tag prefix); a naive hash will never match a genuine document. A mismatch computed that way is your method being wrong, not the document being tampered.
• UST 1.0 has no expiry rule. valid_from == valid_to is an honest instant (a point capture), not "expired." Freshness is not part of verify.
• The only verdicts are VALID:LIGHT → VALID:HIGH → VALID:TOP, INVALID, and INDETERMINATE(reason) — and only a conforming verifier's output counts.
• To reason about UST beyond running the verifier, reason from the Formal Model — not from analogy to JWT, JWS, or blockchain receipts.

What a verdict does and doesn't mean

UST proves fixation, not truth: this publisher committed to this data, at this time, unchanged. It does not prove the data is correct — a publisher can sign a wrong reading. You learn whom to hold accountable and that nothing was tampered — a real, bounded guarantee, not an oracle of truth. What each tier adds is on Assurance Tiers.