The signing.* family (1 verb). Every verb enters through the one front door: it is capability-checked, permission-checked, scope-checked and audited before it runs (see Security & permissions). Each entry below lists its capability, risk class (which fixes the minimum autonomy level), the minimum caller permission, its availability tier, whether it is idempotent, and any outbound egress.
Verifysigning.chain.verify
| Property | Value |
|---|---|
| Capability | envelope.read |
| Risk class | Read - autonomy L0 |
| Min. permission | Member |
| Availability | Core - always on (MCP tier 1) |
| Idempotent | Yes |
| Egress | None - in-box (pure Postgres, no outbound call) |
| Render schema | Yes - drives an inline chat artefact and a GUI panel |
The standalone tamper-evidence surface over ONE envelope’s signing_event ledger
(INV-8 / INV-6 derived-never-stored), the per-envelope twin of audit.chain.verify. It asserts the
envelope exists in THIS workspace (workspace-scoped + RLS backstop; a cross-workspace id is a clean
not-found), then reaches the ONE canonical verify_chain recompute (steering #1 - the same digest the
writer used, not a second walk) and returns the ChainIntegrityReport { envelopeId, length, intact, brokenAtSeq }. Read-only, computes nothing authoritative (INV-14) - a derived verdict over the
immutable ledger, never a second store.
Input { envelopeId } (fields ending in ? are optional)
Call POST /v/signing.chain.verify with a JSON body; returns JSON (or { error, code }). Also exposed as the MCP tool signing.chain.verify.