---
title: "oz0 evidence verify"
description: "Usage and flags for oz0 evidence verify."
canonical_url: "https://docs.oz0.ai/reference/cli/oz0/evidence/verify"
---
# oz0 evidence verify

> Usage and flags for oz0 evidence verify.

For: Operators and developers looking up a command.

Check an evidence bundle (a folder or a zip file) without the cluster and without the network: the manifest's signature, every file's size and SHA-256 and that no file is missing or extra, the audit chain's segment from the link before it across both entry versions, the signed checkpoint, the gateway's records with their signatures (a redacted record must be one an erasure lists), and the two-way check.

The two-way check covers the jobs whose run.calls entry is in the period. A gateway record is a finding if it names:

- No job the cluster knows, or a job that had ended.
- No step or attempt the job's history has.
- A step that makes no model calls.

For a model step whose runtime recorded its calls, the check also reports:

- Every call one side has and the other lacks.
- Every digest that differs.
- A completed step with no gateway record and no local model call the edge metered.

Harness sessions, colleagues' answers, judges, compactions and model steps of runtimes that record no calls are checked by step only. It lists the jobs it left out and why.

Pin the audit key with --key: its fingerprint as `oz0 audit key` prints it on the cluster, given to you by another channel than the bundle. Without it the bundle's own key is trusted, and the command says so. A bundle made without the content permission holds keyed digests and no salts, which only the signature covers, so it fails without --key unless --unpinned says that showing it is whole is enough.

Exit status: 0 when every check passed and the two-way check found nothing, 1 when something failed or was found, 2 when the bundle cannot be read.

## Usage

```bash
oz0 evidence verify PATH [flags]
```

## Flags

<table>
<thead>
  <tr>
    <th>
      Flag
    </th>
    
    <th>
      Type
    </th>
    
    <th>
      Default
    </th>
    
    <th>
      Description
    </th>
  </tr>
</thead>

<tbody>
  <tr>
    <td>
      <code>
        --json
      </code>
    </td>
    
    <td>
      bool
    </td>
    
    <td>
      
    </td>
    
    <td>
      print the result as JSON
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --key
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      
    </td>
    
    <td>
      the audit key's fingerprint (or public key) to pin, as oz0 audit key prints it
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --unpinned
      </code>
    </td>
    
    <td>
      bool
    </td>
    
    <td>
      
    </td>
    
    <td>
      check a bundle with keyed digests without --key, which shows only that it is whole: whoever edited it could have signed it again
    </td>
  </tr>
</tbody>
</table>

## Inherited flags

<table>
<thead>
  <tr>
    <th>
      Flag
    </th>
    
    <th>
      Type
    </th>
    
    <th>
      Default
    </th>
    
    <th>
      Description
    </th>
  </tr>
</thead>

<tbody>
  <tr>
    <td>
      <code>
        --context
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      <code>
        $OZ0_CONTEXT or &lt;config dir>/orchestrator-zero/context.json
      </code>
    </td>
    
    <td>
      CLI context file written by server init
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --log-level
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      <code>
        info
      </code>
    </td>
    
    <td>
      log level: debug, info, warn or error
    </td>
  </tr>
</tbody>
</table>

See [all `oz0` commands](https://docs.oz0.ai/reference/cli/oz0) and the [global flags](https://docs.oz0.ai/reference/cli/oz0#global-flags).


## Sitemap

See the full [sitemap](https://docs.oz0.ai/sitemap.md) for all pages.