Verify an ORBIT proof without overstating it

A successful current check means:

The package’s internal signature and Merkle inclusion proof validate.

It does not establish that the embedded signer belongs to a trusted ORBIT instance, that the signing key belongs to an accepted key era, or that a downstream runtime executed the described action. Authorization, execution reporting, and proof verification remain separate facts.

.orbitproof is a JSON evidence package. Keep and share the exact file rather than copying selected fields into a new document. Verify imposes a bounded file size, requires a top-level JSON object, and sends the accepted package to the current public verifier. Claimed contents remain hidden when the result is invalid or unproven.

• Desktop and tablet web: open Public Verify, then drop or choose a .orbitproof file.
• Mobile web: choose the package from the browser’s file picker. It uses the same public verification boundary.
• After an internal-valid result: the web verifier may generate a self-contained proof QR when the complete transport fits one code; larger packages stay file-only.

No sign-in is required. Anyone possessing the package can submit it for the same bounded check.

The current public iPhone app can:

• choose a .orbitproof file;
• open one from Files, Mail, Messages, AirDrop, or another document-providing app;
• scan an ORBIT proof QR with the in-app camera;
• choose a QR image from Photos when the code is displayed on the same phone;
• show validated package details only after the public verifier returns valid; and
• save or share the byte-exact verified .orbitproof package.

The current native app is a public verifier. Signed-in Now, Orbits, Needs You, Activity, and account changes remain responsive-web capabilities.

The current QR payload begins with ORBITPROOF:v1.z: and contains the complete compressed .orbitproof package. It is data, not a receipt ID or public lookup URL. The iPhone app decodes it locally, then submits the recovered package through the same public verifier.

A QR is transport, not verification. Scanning it never approves an action and never proves execution. Anyone who photographs, screenshots, or otherwise captures the QR possesses the shared proof package; share it with the same care as the file.

Share the exact file or, when it fits, the self-contained QR. Neither has an automatic expiry or revocation merely because it was shared. Proof data can contain sensitive action context, so the owner must choose the recipient deliberately. ORBIT does not turn a database record or action ID into a guessable public proof page.

Help me verify this ORBIT proof using only the public web verifier or the native iPhone verifier I choose. Do not upload or share the package anywhere else. Report the exact internal-proof result, the safe validated fields the verifier displays, and the three limitations: trusted instance, signing-key era, and downstream execution remain unestablished.

A standalone offline CLI is directional and unpublished. There is no supported download, install command, release URL, or trust-anchor workflow to follow today. Android native remains a future placeholder; use responsive mobile web on Android for the current public file-verification path.

• Valid: the package’s internal signature and Merkle inclusion proof validate; the permanent trust and execution limitations remain visible.
• Invalid: the current verifier determined that the package failed its supported internal checks. Claimed contents stay hidden.
• Unproven: verification could not complete because the service, transport, response, or supported format was unavailable or indeterminate. No proof claim is made.