autonomy lock verify

Verify a lock file fingerprint (JSON: BLAKE3; TOML legacy: SHA-256)

Synopsis

JSON input (--lock *.json) — canonical MVP path:
  Verifies the stored behavioral_fingerprint (BLAKE3) against the recomputed
  value.  Equivalent to "autonomy lock fingerprint --verify --in <file>".
  --golden is not used for JSON input.

TOML input (--lock *.toml) — legacy / dev-only path:
  Prints a deprecation warning.  Computes the SHA-256 fingerprint and compares
  it against --golden.  Exits non-zero on mismatch when --strict is set.

Usage

autonomy lock verify [flags]

Options

      --golden string   path to committed golden fingerprint file (TOML legacy only) (default "legacy_golden.fingerprint.txt")
      --lock string     path to lock file (.json preferred; .toml = legacy) (default "autonomy.lock.json")
      --strict          exit non-zero on any mismatch

Options inherited from parent commands

      --require-signed-manifest   Refuse to start if the SHA256SUMS release manifest or its cosign signature is missing/invalid (Tier 2 binary-integrity check; default: build-time compile-in via -ldflags -X, build-hardened artifacts=true, all others=false)

See also