The verifier.
dsr-verifier-cli is the reference implementation of the DSR/1.0 verification protocol. It reads a signed projection, independently recomputes every signature and chain hash, detects anomaly patterns automatically, and writes an unsigned JSON verification report — all without network access to Déjà. Heads of Risk, CISOs, audit-firm technologists, internal auditors, and regulators use it to verify evidence bundles on their own infrastructure under SOC 2 Type II, ISO 27001, NYDFS Part 500, DORA, or SR 11-7 obligations. Compatible with audit engagements at KPMG, Deloitte, EY, PwC, BDO, Grant Thornton, and independent firms.
Install the verifier.
dsr-verifier-cli is Apache-2.0 and runs fully offline. Nothing here contacts Déjà — install it, point it at a receipt, verify against the published key.
brew install deja-app/tap/dsr-verifier-cli
Pre-built binaries for linux-amd64, linux-arm64, darwin-amd64, darwin-arm64, and windows-amd64 — each with a SHA-256 checksum and a GPG signature.
sha256sum -c SHA256SUMS gpg --verify SHA256SUMS.asc SHA256SUMS
dsr-verifier-cli verify deja-receipt-{id}.json → signature valid · chain intact
signature_invalid due to a canonical-form mismatch fixed in v1.2.0. Run brew upgrade dsr-verifier-cli or download the latest binary above.Verifying an intact projection.
Sarah Chen runs the verifier against the SOX Q1 2026 engagement after download. All 6,689 receipts verify, the chain is intact, and the tool writes a JSON verification report she can attach to her workpapers.
$ dsr-verifier-cli verify-bundle SOX_Q1_2026_bundle.json --key ed25519:7fBxK2mP4nQ8vR3eL6jF1w ─── dsr-verifier-cli v1.2.0 ──────────────────────────────────────── Bundle: SOX_Q1_2026_bundle.json (18.2 MB) Engagement: eng_01hxk4m9pq Vault: vault_01hx2k · UBS Wealth Management Signer: charles@ubs.com (vault admin) ✓ Bundle envelope valid Signed by vault admin · RE_01hxk4mp · 2026-02-04T09:02:11Z ✓ Manifest loaded 6,689 receipts enumerated across 3 zones 0.8s ✓ Signatures recomputed Signature Algorithm ed25519 Content hash Algorithm sha256 [████████████████████████████████████] 6,689/6,689 3.2s · all signatures match ✓ Chain integrity verified Verifies the seven currently supported DSR/1.0 receipt types R1 → R2 chains: 2,308 / 2,308 R1 → R1 (prior_match): 412 / 412 0.1s ✓ Pattern analysis (cluster_analysis_v1) Anomaly count: 0 / 6,689 No clustering analysis performed (threshold: anomalies ≥ 10) ─── Result ──────────────────────────────────────────────────── ✓ VERIFICATION PASSED 6,689 receipts · 100% integrity · 0 anomalies Total time: 4.1s ✓ Verification report written Output: SOX_Q1_2026_bundle.verification.json (unsigned JSON summary) Next steps: · Attach SOX_Q1_2026_bundle.verification.json to your audit workpapers · Share with engagement admin at charles@ubs.com $ ▊
.verification.json report can then be attached to audit workpapers as the record of verification.Verifying a compromised vault.
The same command, run later on a different bundle, detects 50 anomalies across 4 categories. The built-in cluster_analysis_v1 module automatically surfaces the pattern — the auditor doesn't have to spot it by eye.
$ dsr-verifier-cli verify-bundle SOX_Q1_2026_bundle.json --key ed25519:7fBxK2mP4nQ8vR3eL6jF1w ─── dsr-verifier-cli v1.2.0 ──────────────────────────────────────── Bundle: SOX_Q1_2026_bundle.json (18.2 MB) Engagement: eng_01hxk4m9pq Vault: vault_01hx2k · UBS Wealth Management ✓ Bundle envelope valid Signed by vault admin · RE_01hxk4mp · 2026-02-04T09:02:11Z ✓ Manifest loaded 6,689 receipts enumerated across 3 zones · 0.8s ⚠ Signatures recomputed — mismatches detected [████████████████████████████████████] 6,689/6,689 6,677 valid · 12 mismatched signatures 3.3s ⚠ Chain integrity — references broken Verifies the seven currently supported DSR/1.0 receipt types R1 → R2 chains: 2,304/2,308 (4 broken) R1 → R1 (prior_match): 412 / 412 0.1s ⚠ Manifest reconciliation — missing entries Projection references 31 receipt hashes that resolve to no receipt. Affected zone: payments-checkout First occurrence: 2026-02-14T09:22:11Z Last occurrence: 2026-02-17T14:08:44Z ⚠ Temporal consistency — inversions detected Receipts whose prior_hash references a FUTURE-signed receipt. This is physically impossible in an honest chain. 3 inversions across 3 receipts · payments-checkout 0.0s ─── Pattern analysis (cluster_analysis_v1) ───────────────────────── Anomaly count: 50 / 6,689 (0.7%) Categories: · missing_entries: 31 · signature_mismatches: 12 · broken_chain_refs: 4 · timestamp_inversions: 3 ◆ zone_concentration: 94% (47/50) in payments-checkout Expected under null (uniform): ~33% p-value: < 0.001 ◆ temporal_clustering: 72h window · 2026-02-14 → 2026-02-17 Anomaly rate in window: ~50× baseline p-value: < 0.001 ◆ cascade_detected: yes All 4 broken_chain_refs target receipts in missing_entries. All 3 timestamp_inversions target receipts in missing_entries. Conclusion: single underlying event, not independent failures. ◆ pattern_signature: consistent_with_targeted_deletion Plus partial replacement attempt (inversions suggest forged receipts with implausible timestamps, then inserted into chain). ◆ confidence: 0.91 Bounded. The CLI does not conclude tampering occurred — further investigation required. See full report in .verification.json. ─── Result ──────────────────────────────────────────────────── ✗ VERIFICATION FAILED 6,689 receipts · 99.30% integrity · 50 anomalies in 4 categories Total time: 4.2s ✓ Verification report written Result: invalid Anomalies: 50 (across 4 categories) Pattern: consistent_with_targeted_deletion (confidence 0.91) Output: SOX_Q1_2026_bundle.verification.json (unsigned JSON summary) Manifest: ./anomalies_01hxr8ym.json (50 entries) Next steps: · Preserve current vault state and adjacent infrastructure logs · Review full anomaly manifest: jq '.anomalies[]' anomalies_01hxr8ym.json · Re-verify after remediation (passing verification supersedes failed report) $ ▊
verification_result: "invalid" and an anomaly_categories block matching the pattern analysis. A subsequent passing re-verification supersedes this report; it does not erase it.Automated pattern detection.
The verifier's cluster_analysis_v1 module runs whenever the anomaly count crosses 10. It does not make subjective calls; it runs three statistical tests, plus a deterministic pattern label derived from them, and reports the results. Pattern detection is machine work, not auditor interpretation — which makes findings more defensible in regulatory correspondence.
> 80% concentration in one zone is flagged.consistent_with_mass_rekey, consistent_with_targeted_deletion, consistent_with_isolated_corruption, nominal. Never asserts; reports best match with confidence.The reference implementation is published under Apache-2.0 at github.com/deja-app/dsr-verifier-cli. Pre-built binaries for linux-amd64, linux-arm64, darwin-amd64, darwin-arm64, and windows-amd64 are available on every release. Charter customers receive direct support from the founding team during their first audit engagement.
Audit-firm technologists running pre-release evaluation against test vaults, regulators conducting protocol review, and Charter customers preparing their first audit engagement should reach out directly.
Reach out to the founding team