Run the whole proof, not a canned screenshot.
One command creates a source dataset, signs its origin, applies and signs two transformations, builds a signed handoff, and verifies the result under a separate receiver policy.
- 01 · Get the source
Clone the public repository
The reference implementation, schemas, conformance fixtures, and demo live together so the page and the executable evidence can be reviewed against each other.
git clone https://github.com/makoto-project/makoto.git cd makoto - 02 · Prepare the environment
Install the locked dependencies
Makoto uses Python and
uv. The lockfile is part of the repository; the setup does not depend on an unpublished Makoto package.uv sync --locked --dev - 03 · Produce and receive
Run the acceptance proof
The script exercises the positive path and seven exact denial cases. It removes its temporary working directory when the run succeeds.
./scripts/demo-v0.2.sh --acceptance - 04 · Inspect the contract
Look past the green result
Open the signed statements, predecessor digests, private profile bindings, receiver policy, handoff manifest, verification report, and final artifact. The useful result is not only
ALLOW; it is the evidence explaining why.uv run makoto --help uv run makoto verify bundle --help find demos/v0.2-end-to-end/generated -type f | sort
What a successful run proves
| Check | Expected result |
|---|---|
| Unchanged, authorized handoff | ALLOW |
| Mutated final bytes | DENY on artifact digest |
| Edited signed metadata | DENY on signature validity |
| Missing or rewired predecessor | DENY on graph evidence |
| Private profile violation | DENY on organizational schema |
| Unauthorized signer | DENY on receiver policy |
If the proof does not run
uvis missing- Install it from the official uv instructions, then rerun the locked sync.
- The environment is already active
- Keep using
uv run; do not substitute a globally installed package with the same name. - A denial differs from the documented code
- Capture the complete output, operating system, checked-out commit, and command, then open an issue. A changed denial is a conformance finding, not noise to ignore.
Run it on a machine we did not configure.
The best contribution is a precise success or failure report from a clean checkout, especially when it exposes an undocumented dependency or ambiguous verification result.