Reference

CLI

One command, two stacks. As of 2.0 the CLI is tamper-signal whether it ships with the Python package or the npm package (on Python, receipts still works as a deprecated alias). The chains are interchangeable and the exit codes are identical.

The exit code is the light

Every verifying command returns the traffic light as its process exit code, so a shell or CI job can branch on it without parsing anything.

The tamper-signal command

Common flags

One command, both stacks

As of 2.0 the command is tamper-signal on both the Python and the Node install, with the same subcommands and the same exit codes. (On Python, receipts still works as a deprecated alias and prints a notice; it is scheduled for removal in 3.0.)

tamper-signal keygen --out keys/
tamper-signal ingest export.csv --origin "TikTok export, May 2026" --out receipts/
tamper-signal verify receipts/chain.json --pub keys/signing.pub --data current.csv
tamper-signal export receipts/chain.json --data current.csv   # writes receipts/table.json

Python-only subcommands

Every subcommand runs on both stacks except these, which are Python-only for now. The chains they produce are ordinary signed receipts that the Node install reads and verifies unchanged.

The JSON verdict

Both CLIs emit the same structured verdict with --json. This is what CI jobs and coding agents parse.

{
  "verdict": "green",            // green | yellow | red
  "exit_code": 0,
  "spec_version": "1.2",
  "receipts": 3,
  "transforms": 2,
  "stages": ["source", "clean", "aggregate"],
  "final_row_count": 304,
  "caveats": [],
  "caveat_details": [],      // typed period-over-period findings; [] when none
  "broken_link": {           // null when green
    "link": [1, 2],
    "stage": "aggregate",
    "expected_input_hash": "a3f1…9c",
    "found_input_hash": "77b2…d4",
    "totals_delta": ["row_count 4987 -> 304 (-4683)"]
  },
  "data_mismatch": null,
  "receipt_mismatch": null,
  "report": ["human-legible lines"],
  "anchor": []               // only when --anchor passed
}