Verify a real GLEIF vLEI credential chain
Honesty boundary: interop EVIDENCE vs real GLEIF testnet artifacts — NOT a certified/accredited verifier, NOT legal vLEI status (testnet = sandbox); reference verifier (SHA2/SHA3+Blake3 subset; OOR/ECR, multisig, registry-rotation, IPEX-F out of scope).
✓ verified a REAL GLEIF GEDA→QVI→Legal-Entity chain end-to-end, and rejected every tampering.
Verified Legal Entity Identifier (LEI): 506700GE1G29325QX363
· GLEIF root (GEDA): EL6IkWNHu1Jo9vGIm5ntdF1Q…
Verification steps
- ✓ real GLEIF schema SAIDs recompute (Blake3) — 7/7 byte-exact
- ✓ QVI credential (GEDA-issued, anchored) — issued, not revoked
- ✓ Legal-Entity credential (QVI-issued, backed 'bis', edge->QVI) — issued, not revoked
- ✓ edge-DAG: LE -> verified QVI credential — SAID-exact link
Tamper scenarios (each must be rejected)
- ✓ forge a claim (LEI) — acdc: top SAID mismatch (tampered or forged)
- ✓ forge the schema SAID — anchored credential: schema SAID 'ENPXp1vQzRF6JwIuS-mp2U8Uf1MoADoP_GqQ62VsDZWY' does not match the pinned expected schema 'EZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ'
- ✓ swap the edge target — dangling edge -> unknown ACDC 'EOLAhB27vuPzZ3wol1POccysJJLTK35EtXNUsVtMVr4V'
- ✓ drop the TEL issuance — TEL incomplete: a KEL-anchored event for this credential is missing from the presented TEL (revocation suppression)
Reproduce: python products/vlei-verify/demo_vlei_chain.py