Stage307 adds real identity verification to REMEDA.
Stage306 connected verification decisions to actions.
Stage307 strengthens the identity layer:
identity=true
is no longer treated as a self-declared claim.
It must be verified by cryptographic evidence.
Core Concept
Before Stage307:
identity=true → trusted
After Stage307:
identity=true + valid GPG signature → trusted
identity=true without valid signature → rejected / blocked
What Stage307 Adds
GPG detached signature verification
Public-key based identity proof
No private keys in the repository
Fail-closed behavior when identity cannot be verified
Action Gate integration
Action Rule
{
"accept": "allow",
"pending": "warn",
"reject": "block",
"error": "block"
}
Additionally:
{
"require_verified_identity": true
}
This means:
signature verification failed → block
Security Model
This repository must never contain private keys.
Allowed:
public keys
signed payloads
detached signatures
verification code
Not allowed:
private keys
passphrases
secret key material
Run locally
python3 -m venv .venv
source .venv/bin/activate
pip install -r requirements.txt
python app.py
Open:
open http://127.0.0.1:3070
API
curl -X POST http://127.0.0.1:3070/api/gate \
-H "Content-Type: application/json" \
-d '{
"manifest": {
"trust_score": 1.0,
"confidence": "high",
"upstream_error": false,
"claims": {
"execution": true,
"integrity": true,
"timestamp": true
}
},
"identity": {
"public_key_armor": "-----BEGIN PGP PUBLIC KEY BLOCK-----...",
"signed_payload": "REMEDA Stage307 Identity Statement...",
"detached_signature": "-----BEGIN PGP SIGNATURE-----..."
}
}'
Why this matters
Stage307 moves REMEDA from:
claimed identity
to:
verified identity
This is a major trust boundary.
License
MIT License
Copyright (c) 2025 Motohiro Suzuki