$ ./verify --describe

ProtocolX Verify [ LIVE ]

for engineering leads shipping Move

Five CI gates on every pull request. Every run leaves an evidence bundle with a re-derivable digest.

verify run --repo protocolx/vault --pr 482bundle · sha256

gate.01build — the package compiles on a runner that has never seen it, with a pinned Sui CLI[ PASS ]

gate.02digest — the source still builds to the digest the chain holds[ PASS ]

gate.03tests — the Move suite runs green against the exact commit proposed[ PASS ]

gate.04pin — the framework dependency stays where you pinned it[ PASS ]

gate.05mutation-smoke — assertions are deleted one at a time and the suite re-runs against each, up to a set limit. The bundle records how many were derivable, how many ran, how many were killed and how many survived.[ PASS ]

statusready to merge

signed by0x9c…4f2a · ci-runner

digestsha256:8f42a9c1d0b6e73f4c2e5a90b7d1e6c3ab52f7d0e9c48d31bf6a02e5d7c9a1b8

re-deriveverify reproduce <digest>

exit0

// this bundle is the artifact your customer keeps

// problem

Test suites go green while the guards holding user funds sit untested. When a fund draws the wrong balance in production, the record of what you checked is missing.

// what you get

Five CI gates on every pull request: build, digest, tests, pin, mutation-smoke.
Every run drops an evidence bundle with a re-derivable digest.
A one-line reproduce command a customer, auditor, or exchange can run on their own.
Hosted runners with retention. Private repos supported.

$ ls ./gates

Five gates, one bundle

gate.01[ PASS ]buildthe package compiles on a runner that has never seen it, with a pinned Sui CLI
gate.02[ PASS ]digestthe source still builds to the digest the chain holds
gate.03[ PASS ]teststhe Move suite runs green against the exact commit proposed
gate.04[ PASS ]pinthe framework dependency stays where you pinned it
gate.05[ PASS ]mutation-smokeassertions are deleted one at a time and the suite re-runs against each, up to a set limit. The bundle records how many were derivable, how many ran, how many were killed and how many survived.

$ verify bundle.json

Re-derive a bundle here

The same digest the CLI prints, computed in your browser from the text on the left.

~/bundle.json1142 chars

evidence bundle JSON

{
  "schema": "protocolx-verify/evidence-manifest",
  "schemaVersion": 1,
  "subject": {
    "repository": "Northlatch-Labs-LLC/example",
    "commitSha": "9c1f0a2b7d4e6f8091a2b3c4d5e6f708192a3b4c",
    "packagePath": "move/"
  },
  "toolchain": {
    "sui": {
      "value": "sui 1.44.2",
      "reason": null
    },
    "python": {
      "value": "Python 3.14.0",
      "reason": null
    }
  },
  "gates": {
    "build": {
      "status": "pass",
      "reason": null
    },
    "digest": {
      "status": "pass",
      "reason": null
    },
    "tests": {
      "status": "pass",
      "reason": null
    },
    "pin": {
      "status": "pass",
      "reason": null
    },
    "mutation-smoke": {
      "status": "pass",
      "reason": null,
      "derivable": 31,
      "limit": 40,
      "derived": 31,
      "executed": 31,
      "killed": 29,
      "survived": 2
    }
  },
  "digest": {
    "algorithm": "sha256",
    "excludes": [
      "run",
      "bundleDigest"
    ]
  },
  "run": {
    "generatedAtUtc": "2026-09-16T04:00:00Z"
  },
  "bundleDigest": "sha256:a6821ad2cdf557c60a6c800ad800683dc0fc1d101b240e6762e5be330b315d52"
}

or drop a file on the box

waiting

computed here—

claimed by the bundle—

Change one character on the left. The digest moves, and about half of the 256 blocks move with it. That is the whole idea.

$ ls ./supports

Move on SuiGitHub ActionsGitLab CIself-hosted runners

$ pricing

self-host in your CIfree

First Report (one-shot audit output)$1,000

Verify Hosted App$249 / repo / month

$ start

install

$curl -sSL projectxprotocol.dev/verify | sh

run

$verify run --pr $PR

$verify publish --bundle ./out/bundle.tar

more? see the other four: ./weir ./draws ./names ./range