Buyer verification
Verification is the free side of the system: a paying agent or platform checks a seller's attestation with no charge, no registration and no personal data. The check completes locally.
The verification path
- Fetch the verdict for the seller's endpoint identifier over the free
path. The verdict is a small signed document: operator status, bond state, audit date, and the renewal cadence promise.
- Check freshness against the cadence the credential itself promises —
the buyer never needs a clock authority beyond its own.
- Verify the signature locally. The verdict payload verifies with a
published public key (Ed25519) against the canonical byte form of the payload. No call to any ZadQ system is required at decision time.
verdict ──► freshness check ──► local signature check ──► badge state
│ │ │
└── absent ────┴──── stale ──────────┴── invalid ──► "unknown"Badge states
| State | Meaning |
|---|---|
human-backed | Valid, fresh attestation; an accountable operator with an active bond stands behind the endpoint |
revoked | The attestation has been withdrawn |
unknown | No verdict available, stale, or unverifiable — the neutral fallback |
Graceful degradation
unknown is a first-class state, not an error. Every integration keeps working when no verdict is available: the badge shows unknown and the payment flow proceeds exactly as it would without the attestation layer. Buyer-side policy — whether to pay unknown sellers — always belongs to the buyer, never to the verification layer.
What verification never requires
- No account, key or credential on the buyer side.
- No fee on the verification path.
- No personal data in either direction.
- No live dependency: a cached verdict inside its freshness window verifies
offline.
Next: the SDK reference lists the vendorable modules implementing this path.