The auditor / verifier is the single most important library EnfinitOS publishes. It is open source under MIT in three published repositories:Documentation Index
Fetch the complete documentation index at: https://enfinitos.mintlify.app/llms.txt
Use this file to discover all available pages before exploring further.
- github.com/EnfinitOS/sdk-auditor-ts — TypeScript / npm
- github.com/EnfinitOS/sdk-auditor-py — Python / pip
- github.com/EnfinitOS/sdk-auditor-rs — Rust / cargo
Don’t trust us. Verify. The library is offline by default — it
does not call EnfinitOS or any third-party service. Anyone can fork
it, audit it, fuzz the parser, and ship it inside their own
compliance pipeline.
What it verifies
A proof pack is a signed, hash-chained document. The auditor does four things against it:- Ed25519 signature against the published EnfinitOS verification key.
- SHA-256 hash chain walked end-to-end for the tenant.
- Metering re-projection from the source events embedded in the pack — re-running the same projection the platform settled against.
- Settlement reconciliation re-run, asserting bit-identical output.
Three language implementations
- TypeScript
- Python
- Rust
Byte compatibility
All three implementations are byte-compatible against a shared conformance test vector set. A proof pack that verifies under the TypeScript implementation must verify byte-identically under the Python and Rust implementations. The canonical vectors are in the sdk-auditor-ts repository under__tests__/vectors/.
Verification key rotation
The verification key is published — and rotates on a published schedule — at docs.enfinitos.com/security/keys. Rotation windows are at least 90 days so offline auditors have time to pick up the new key without service interruption.Contributing
PRs welcome. Especially:- Fuzzers for the proof-pack parser (fast-check, Hypothesis, cargo-fuzz).
- New language bindings — Go, Java, C#, Swift, Kotlin. Match the conformance vectors and we’ll review.
- Conformance-suite additions — edge cases around chain breaks, signature mismatch, and metering re-projection.
CONTRIBUTING.md in each repo (ts, py, rs).
Security disclosure
If you find a vulnerability, do not file a public issue. Email security@enfinitos.com. Full policy inSECURITY.md in each repo (ts, py, rs).