Verification
Trust in Knolo has layers: artifact integrity, publisher attestation, and independent quality signals. Hub verification is a Workflow, not a request.
01Artifact integrity
The workflow hashes Blob bytes against the content-addressed pathname, recognizes V4 or V5, checks section bounds and digests (including VQF-1 envelopes on compressed V5 segments), records a state root for V5, inspects agent registry metadata, secret-scans reconstructed logical text, and runs sample queries. The verifier is @knolo/core 5.5.0. Failed jobs stay failed with per-check output.
02Publisher attestation
License declared (SPDX), source notes supplied, intended use supplied, and rights attested. Release is blocked until these are present and the GitHub user owns the publisher handle.
03What verification does not mean
Artifact verification does not guarantee that the contained knowledge is factually correct. Hub does not execute agent metadata, run tools, call an LLM, or host retrieval. Quality and audit states are communicated separately from the digest check.