# internal/adapters/cli/verify

Package verify is the scafld verify command. It loads a signed receipt and the trusted keys, checks the signature, the target commit and the acceptance criteria, and reports the result. SelfCheck reports the local verify wiring without touching a receipt.

## Handler

```go
func Handler() func(context.Context, []string, io.Writer, io.Writer) int
```

Handler returns a CLI-compatible verify handler.

## Parse

```go
func Parse(args []string) (Options, error)
```

Parse parses verify command arguments.

## RenderSelfCheck

```go
func RenderSelfCheck(report SelfCheckReport) string
```

RenderSelfCheck renders a SelfCheckReport for humans. It states plainly what scafld can and cannot confirm and never claims a merge gate is enforced.

## Run

```go
func Run(ctx context.Context, opts Options) (appverify.Result, error)
```

Run loads the receipt and trusted keys, composes ports, and verifies.

## SelfCheck

```go
func SelfCheck(ctx context.Context, root string) (SelfCheckReport, error)
```

SelfCheck reports, without contacting any network or service, the local verify wiring: the configured verify.policy and whether the CI workflow file is present. It reads reporting metadata only and never touches a receipt.

## Options

```go
type Options struct {
	Root           string
	ReceiptPath    string
	TrustedKeys    string
	Target         string
	MaterialRef    string
	AcceptanceRoot string
	MaterialOnly   bool
	JSON           bool
	CI             bool
	SelfCheck      bool
}
```

Options configures the verify CLI adapter.

- `Root: string`: 
- `ReceiptPath: string`: 
- `TrustedKeys: string`: 
- `Target: string`: 
- `MaterialRef: string`: 
- `AcceptanceRoot: string`: 
- `MaterialOnly: bool`: 
- `JSON: bool`: 
- `CI: bool`: 
- `SelfCheck: bool`: 

## SelfCheckReport

```go
type SelfCheckReport struct {
	Policy            string
	WorkflowInstalled bool
	WorkflowPath      string
	TrustedKeysPath   string
	TrustedKeysStatus string
	KeyLifecycle      trust.KeyLifecycleSummary
	SigningKeyPath    string
	SigningKeyStatus  string
	SigningKeyMode    string
	// Gap is set when the declared policy implies a CI workflow that is not installed.
	Gap string
}
```

SelfCheckReport is the offline wiring state scafld can confirm locally. It never asserts that any merge gate is active: requiring the verify check is a GitHub branch-protection setting scafld cannot read or set.

- `Policy: string`: 
- `WorkflowInstalled: bool`: 
- `WorkflowPath: string`: 
- `TrustedKeysPath: string`: 
- `TrustedKeysStatus: string`: 
- `KeyLifecycle: trust.KeyLifecycleSummary`: 
- `SigningKeyPath: string`: 
- `SigningKeyStatus: string`: 
- `SigningKeyMode: string`: 
- `Gap: string`: Gap is set when the declared policy implies a CI workflow that is not installed.