Locally verified means your machine ran the checks. Mantyl Verified means Mantyl’s own infrastructure independently re-executed them and staked a signature on the result. This page explains exactly what happens, because a trust mark you cannot inspect is just a badge. A verification costs one credit, bought per project at checkout (£29 per project, with a 14-day no-questions money-back guarantee); the CLI opens the checkout for you when you run the command.
The command refuses a dirty working tree, because an accreditation binds a commit and an uncommitted tree is not a commit. It shows you the file count and size before anything uploads, and only git-tracked files are ever bundled: local state, ignored files and secret env files never make the list.
The verification worker downloads your bundle into an ephemeral working copy, first proving the bundle digest matches what the CLI uploaded. It then recomputes the passport’s file manifest against the extracted source, which proves the uploaded code is byte-for-byte the code the passport describes. The recorded verification plan re-executes in an isolated Docker sandbox with network cut after dependency install, exactly as your own machine runs it. Only when every check reproduces as passed does the worker sign. The working copy is destroyed after every run, pass or fail, and the uploaded bundle is deleted the moment the job completes.
The accreditation is an Ed25519 signature over a canonical record containing the passport digest, the evidence digest, the commit, the policy identifier and version, the verifier version and the verification time. Change any of those and the signature fails. Move the accreditation to a different passport and it fails with that exact reason. The hosted passport page re-verifies the signature every time it renders, so a mark that stops verifying simply disappears rather than lingering.
The signing public key is published at /api/signing-key. Any Ed25519 implementation can verify an accreditation offline: the signed bytes are the canonical JSON of the record, and the key never changes without notice in the changelog. The private key exists only on the verification worker, never in the CLI, never in the web app.
One credit verifies one project at one commit, £29, one price for everyone. The limits in hard numbers: up to 10,000 git-tracked files and a 4 MB compressed upload (most projects compress well under that). The CLI counts your tracked files and states the bundle size before anything uploads, so you hear about a limit before paying, never after. The run gets up to 45 minutes of execution in the sandbox, and a check whose result does not match the recording is automatically re-executed once before the run is judged, which absorbs ordinary flakiness. Bigger builds are coming; if yours is over the limit today, tell us at /contact.
A credit is refundable until its verification runs, and every purchase carries a 14-day no-questions money-back guarantee after it. If our infrastructure breaks mid-run, the credit is never consumed: the job requeues and runs again. And a run that completes with failed checks includes one free re-run within 14 days: fix what the verification found, run mantyl verified again from the same project, and the CLI applies the re-run automatically at no charge.
An accreditation proves the recorded checks passed on independent infrastructure against exactly the claimed source at exactly the claimed commit. It does not prove the software is secure, correct or fit for purpose, and the passport itself says so. Evidence, not certification, at every layer.