Sanctions cleared.
Signed. Done.
Sanctions, risk, and AML flags checked and signed before the agent moves money. 4.4 ms on live traffic. Six sources reconciled into one answer.
Five steps. 7 ms.
Two cache reads, one assemble, one signature, one return. The signature is the only network hop. Everything else lives in memory.
Smoke test against the production endpoint signs a fresh attestation for did:ethr:8453:0xababab…ab in 4.4ms total, well under the 15ms p99 budget.
Redis SISMEMBER veris:sanctions:active
subject_address membership lookup
Redis HGETALL veris:risk:{addr}
tier · drift_score · last_eval
Assemble VerisAttestation proto
canonical deterministic serialization
Vault Transit · BLS12-377 sign
hash to G2 · sign · mTLS gRPC
Return AttestResponse
serialized attestation + BLS sig + trace
Six sources.
One clean answer.
OFAC, UN, EU, Chainalysis, TRM, and our own AML feed merge into one set. Every attestation names the exact list that matched, so the regulator never asks twice.
OFAC and fraud hits push to the on chain list in under 30 seconds. Drift and anomaly flags follow within the hour.
Six crates.
Zero production unwraps.
veris-core
Attestation builder, risk-tier rule engine, heuristic anomaly detector. The shape of every signed bundle the network sees.
veris-bls
arkworks-bls12-377. Hash-to-G2 over canonical proto bytes, Vault Transit gRPC sign, aggregate addition.
veris-feed
OFAC · UN · EU pollers, Chainalysis & TRM delta adapters, internal Kafka consumer, reconciler with provenance preservation.
veris-state
Sanctions SET membership, per-entity risk hash, revocation-push channel into L5. DB 2 on a dedicated Redis instance.
veris-grpc
Tonic server. Attest, AttestBatch, SubscribeRevocations, Health, SignerKey. mTLS, rate-limit.
veris-bin
Bootstrap + config + OpenTelemetry exporter. Multi-stage Rust 1.85 → debian:bookworm-slim, 135MB final, non-root uid 10001.
Twelve checks.
Eleven green.
Every check audited and signed off before the next layer started. One item parked behind a production key binding. The rest are live.
Verify it yourself.
Run the verifier inside your own VPC. Pull our public keys. Check every signature against a regulator-grade source. No black boxes.