SDK 0.6.0 ships today for both Python (asqav) and TypeScript (@asqav/sdk). The main addition is a clean offline verification path for environments that cannot reach the internet during an audit run.
The idea is simple: fetch the public key directory once while you are connected, then everything else is local. No special mode, no API key, no Asqav infrastructure involved during the verify step.
Offline verification in one pass
# snapshot the public key directory once
curl https://api.asqav.com/.well-known/jwks.json > jwks.json
# install the verify dependencies
pip install "asqav[verify]"
# verify with no network access
python verify_receipt.py \
--receipt receipt.json \
--jwks jwks.json \
--offline
The --offline flag makes the verifier refuse to make any network call. If a key is missing from your local snapshot, the issuer-key axis fails rather than fetching silently.
ML-DSA-65 works the same way
Post-quantum receipts (ML-DSA-65, NIST FIPS 204) verify offline the same way as Ed25519 receipts. The algorithm identifier rides inside the signed envelope, so the verifier reads which algorithm to use from the receipt itself. The pure-Python dilithium-py library handles the signature math with no native compilation.
Air-gapped installs
If the target machine has no internet at all, pre-download the wheels on a connected machine and transfer them:
pip download "asqav[verify]" -d ./wheels
# transfer ./wheels/ to the air-gapped machine
pip install --no-index --find-links ./wheels "asqav[verify]"
Getting started
Full offline verification guide: asqav.com/docs/offline-air-gapped-verification. Source: github.com/jagmarques/asqav-sdk.
Asqav provides cryptographic governance for AI agents through signed, tamper-evident receipts covering actions, policy decisions, result digests, and independent timestamps. Receipts support recordkeeping and independent verification; they do not by themselves establish legal compliance, which depends on the system and jurisdiction. Founded by João Marques.
Top comments (0)