studio-11-co/PRML Verify

Verify PRML commitments in CI. Block merges on tampered or regressed eval claims. Optional public registry anchor.

Trust Signals

Scorecard Score: not yet scored
Maintenance Recency: Stale
License: None

Inputs

name	description	required	default
mode	Verification mode: - "manifest": verify a PRML manifest's SHA-256 (hash/tamper) and, if `observed` is set, evaluate the predicate. Requires `manifest-path`. This is the PRML-manifest verifier — runs the `falsify` reference CLI. Exit 0 PASS · 3 TAMPERED (hash mismatch) · 10 FAIL (below threshold). - "guard" (default): scan all .falsify/ claims via the workflow engine, fail on any FAIL/STALE. - "verdict": check one engine claim by name (requires `claim` input). - "lock": hash and freeze an engine claim (rare in CI). - "schema-only": validate a PRML YAML against the v0.1 / v0.2-RFC JSON Schema (shape only, no hash). Requires `manifest-path`. Note: guard/verdict/lock drive the `falsify-engine` workflow CLI; manifest/schema-only operate on a standalone `*.prml.yaml`.	no	guard
claim	Claim name (required when mode=verdict or mode=lock)	no	""
manifest-path	Path to a PRML manifest YAML (required when mode=manifest or mode=schema-only). Relative to working-directory.	no	""
observed	Observed metric value (mode=manifest). If set, the action evaluates the manifest's predicate and exits 10 (FAIL) if it does not hold.	no	""
schema-version	PRML schema version to validate against in mode=schema-only. One of: "v0.1" (default, stable) or "v0.2-rfc" (open through 2026-05-22).	no	v0.1
expected-hash	Expected SHA-256 hash to verify against. If set and the computed hash mismatches, the action exits 3 (TAMPER). Useful to pin a specific registry-anchored claim across CI runs.	no	""
anchor-to-registry	If "true", also POST the canonical manifest to the public registry (default: registry.falsify.dev) and surface the permalink as an output. Defaults to "false" — only enable when you want a public receipt.	no	false
registry-url	Public PRML registry endpoint (used only when anchor-to-registry=true).	no	https://registry.falsify.dev
registry-handle	Submitter handle to attach to the registry commit (defaults to GitHub repo owner).	no	""
python-version	Python version used to run falsify.	no	3.11
falsify-version	Version of the single `falsify` PyPI package, pinned for reproducibility (default: 0.3.10). That one package provides both commands used here: the `falsify` PRML CLI and the `falsify-engine` command. There is no separate `falsify-engine` package to install.	no	0.3.10
working-directory	Path to the repository root that contains .falsify/.	no	.

Outputs

name	description
hash	SHA-256 digest of the canonical manifest bytes.
permalink	Registry permalink (only set when anchor-to-registry=true and registry POST succeeded).
status	Final status: pass / fail / tamper / inconclusive.
badge-snippet	Markdown snippet for embedding the registry badge in a README.