What VERIFIED means
A local verifier recomputes the canonical payload, checks the stored SHA-256 digest, verifies the Ed25519 signature against JWKS, and optionally matches the bound UBL bytes. If those checks pass, the outcome is VERIFIED.
Fiscal402 receipts use Ed25519 signatures. Receipt version 1.0.0 binds the exact UBL UTF-8 artifact using SHA-256. Canonicalization is fiscal402.sorted-json/1.
What it does not mean
- Tax-authority acceptance.
- Legal advice or a VAT return.
- That a wallet is a legal person.
- That the classification is correct as a matter of law.
How signature verification works
- receipt + JWKS + optional UBL
- ↓
- recompute fiscal402.sorted-json/1
- ↓
- SHA-256 of canonical UTF-8
- ↓
- Ed25519 over the hex digest
- ↓
- VERIFIED / INVALID / UNKNOWN_KEY / ARTIFACT_MISMATCH
| Check | Pass condition |
|---|---|
| receipt_schema | spec fiscal402.receipt and spec_version 1.0.0 |
| canonical_payload | recomputed hash equals stored hash |
| signing_key | JWKS kid matches signature.key_id |
| signature | Ed25519 valid over the hex digest string |
| ubl_sha256 | SHA-256 of exact UBL bytes matches, if UBL provided |
JWKS URL
Production keys: https://api.fiscal402.com/.well-known/jwks.json. Current kid: receipt-ed25519-v1.
Artifact hash verification
UBL is hashed as the exact generated UTF-8 bytes. Identifier sha256-utf8-bytes. There is no XML C14N. Re-serializing equivalent XML with different whitespace is a different artifact.
Sanitized verification bundle
- receipt.json
- jwks.json (synthetic public key, not the production key)
- invoice.xml
Example report
verify.json
{
"verified": true,
"result": "VERIFIED",
"receipt_schema": "SUPPORTED",
"canonicalization": "fiscal402.sorted-json/1",
"canonical_payload": "MATCH",
"signing_key": "JWKS_MATCH",
"signature": "VALID",
"ubl_sha256": "MATCH",
"settlement_reference": "PRESENT",
"notes": [
"verified means Fiscal402 receipt integrity, not tax-authority acceptance."
]
}Source-only verifier status
The independent verifier lives in the public repository https://github.com/Fiscal402/Fiscal402. Clone the repository and run the local CLI. @fiscal402/verify is not published to npm. Do not claim npm installation yet.