SBO3L Verify

Verify a capsule: here (paste below) | via HTTP API | via CLI | drag-and-drop a .json file anywhere on this page

Verify a SBO3L Passport capsule

Paste a capsule JSON and click Verify. The verifier runs entirely in your browser via the sbo3l-core Rust crate compiled to WebAssembly — no daemon, no network call. v2 capsules with embedded policy_snapshot and audit_segment verify all 6 cryptographic checks self-contained; v1 capsules pass the structural and request-hash checks and honestly report the others as SKIPPED.

idle

No capsule? Click Load sample capsule above to drop in a known-good v2 capsule (mainnet ENS agent · KeeperHub executor · 6/6 checks pass), then click Verify. Or browse /kh-fleet for 5 real Passport capsules from a live KeeperHub workflow run; each row's "Verify →" link deep-pastes the capsule into this verifier.

Where do capsules come from? 3 ways

A Passport capsule is the signed JSON output of a SBO3L policy decision. You don't write one by hand — the SBO3L runtime produces it for every agent action it gates.

1. Try the browser playground no install

/playground is a browser-side mock decision engine. Pick a scenario (allow, deny-aprp-expired, prompt-injection, swap-rug-token, etc.), edit the APRP + policy, click Decide. You get a synthetic capsule (mock-signed; will fail strict-mode verify) — useful for understanding what flows through the daemon in production.

For real signed capsules from a live daemon: /playground/live →

2. CLI — sbo3l passport run cargo install

Drop the daemon out entirely and run a one-shot offline: 

cargo install sbo3l-cli --version 1.2.2
sbo3l passport run path/to/aprp.json \
  --db /tmp/sbo3l-judge.db \
  --agent research-agent.team.eth \
  --ens-fixture test-corpus/ens/research-agent.eth.json \
  --executor keeperhub \
  --out /tmp/capsule.json
sbo3l passport verify --strict --path /tmp/capsule.json

Full flag reference at docs.sbo3l/cli/passport-run.

3. Run the demo script git clone

5 known-good capsules from a deterministic 13-gate demo: 

git clone --depth=1 https://github.com/B2JK-Industry/SBO3L-ethglobal-openagents-2026
cd SBO3L-ethglobal-openagents-2026
bash demo-scripts/run-openagents-final.sh
ls demo-scripts/artifacts/  # → 5 capsule .json files

No install? Use the sample

Click Load sample capsule above to drop a known-good fixture into the verifier without leaving this page. Or browse /kh-fleet for 5 real capsules from a live KeeperHub workflow run.

Verify via HTTP API curl / fetch / any language

Hosted SBO3L verifier endpoint. Same Rust crate (sbo3l-core v1.2.0 → WASM) as this page, exposed as a stateless HTTP API so any agent / CI / chat-bot can verify a capsule with one POST instead of bundling the WASM themselves.

Endpoint

POST https://sbo3l-playground-api.vercel.app/api/v1/verify
Content-Type: application/json
Body: {"capsule": <object>} OR {"capsule_json": "<string>"}

CORS: open (Access-Control-Allow-Origin: *) so browser-side agent SDKs can hit it directly without a proxy. 1 MiB body cap. Cold-start ~500 ms; warm ~50 ms.

curl

curl -X POST https://sbo3l-playground-api.vercel.app/api/v1/verify \
  -H 'Content-Type: application/json' \
  -d '{"capsule_json": "{\"schema\":\"sbo3l.passport_capsule.v2\", ...}"}'
# → {"ok": true, "checks": [...], "verifier": {...}}

JavaScript / TypeScript

const report = await fetch(
  "https://sbo3l-playground-api.vercel.app/api/v1/verify",
  {
    method: "POST",
    headers: { "Content-Type": "application/json" },
    body: JSON.stringify({ capsule: capsuleObject }),
  },
).then((r) => r.json());
console.log(report.ok, report.checks);

Python

import requests, json
report = requests.post(
    "https://sbo3l-playground-api.vercel.app/api/v1/verify",
    json={"capsule_json": json.dumps(capsule)},
).json()
print(report["ok"], report["checks"])

Response shape: ok, any_failed, any_skipped, checks (array of label + outcome + detail?), and a verifier object with core_version + endpoint. outcome is PASSED / SKIPPED / FAILED; ok is true iff all 6 checks PASSED.

Health probe

curl https://sbo3l-playground-api.vercel.app/api/v1/healthz
# → {"status":"ok","version":"...","env":{...}}