cluster-verify

Verify a rebuilt fleet once per class, then borrow the verdict. It clusters the hosts by their operator features (a candidate generator — it proposes who might share a build, it never decides it), runs a full verify on one representative per class, and puts every other member through the membership gate: a host whose attestation carries a build-determinant triple digest byte-identical to the representative's borrows that representative's signed verdict with no target read; any mismatch, or an absent proof, falls back to a full direct verify. A mismatched host is never granted a borrowed verdict. Also available as verify-fleet.

The output separates verified-directly from verified-by-class-membership counts, so a borrowed verdict is never presented as an independent one. --sign signs each representative's report and needs credentials; borrowed reports inherit the representative's signature by design and are not re-signed. Like verify, each verified representative claims a billable seat (402-gated, never metered) rather than recording a usage event; borrowed verdicts claim nothing new, so a whole class costs one seat.

vrtmv cluster-verify --manifest rebuilt-fleet.txt -o fleet/
vrtmv cluster-verify --manifest rebuilt-fleet.txt --sign --json
vrtmv verify-fleet --manifest rebuilt-fleet.txt -o fleet/

Each manifest line names a rebuilt host, its source (which clusters it), the migrate attestation carrying the membership proof, and the rebuilt target a direct verify reads:

<name> source=<kind>:<loc> attest=<path> target=<kind>:<loc>

where <kind> is root, image, or ssh.