Offline Mode

Offline mode provides full cryptographic attestation without requiring an API key. Perfect for development, testing, and air-gapped environments.

Quick Start

from glacis import Glacis

# No API key needed
glacis = Glacis(mode="offline")

receipt = glacis.attest(
    service_id="local-dev",
    operation_type="inference",
    input={"prompt": "What is 2+2?"},
    output={"response": "4"},
)

print(f"Receipt ID: {receipt.attestation_id}")     # oatt_xxx (offline attestation)
print(f"Witness status: {receipt.witness_status}") # "UNVERIFIED"
print(f"Signature: {receipt.signature[:32]}...")   # Ed25519 signature

How It Works

In offline mode, the SDK:

1. Generates a local Ed25519 keypair (or uses your provided seed)
2. Hashes payloads using SHA-256 with RFC 8785 canonical JSON
3. Signs receipts locally with the Ed25519 private key
4. Stores receipts in a local SQLite database at ~/.glacis/receipts.db

Note

Offline receipts use the same cryptographic primitives as online mode (Ed25519, SHA-256, RFC 8785). The only difference is the absence of independent witness anchoring.

Offline vs Online

Feature	Offline	Online
API key required	No	Yes
Signing	Local Ed25519	Glacis witness network
Merkle proofs	No	Yes
Transparency log	No	Yes
Verification URL	No	Yes
Witness status	"UNVERIFIED"	"VERIFIED"

Providing Your Own Seed

For reproducible testing, provide a fixed signing seed:

import os
from glacis import Glacis

# Provide a custom signing seed
seed = os.urandom(32)
glacis = Glacis(mode="offline", signing_seed=seed)

# Or derive from a passphrase (for testing only!)
import hashlib
seed = hashlib.sha256(b"my-test-seed").digest()
glacis = Glacis(mode="offline", signing_seed=seed)

Caution

Never use predictable seeds in production. For production offline use, let the SDK generate a cryptographically secure random seed.

Local Storage

Offline receipts are stored in SQLite:

# Default location
~/.glacis/receipts.db

# Query stored receipts
glacis = Glacis(mode="offline")
receipts = glacis.list_receipts(limit=10)
for r in receipts:
    print(f"{r.attestation_id}: {r.timestamp}")

Verifying Offline Receipts

glacis = Glacis(mode="offline")

# Create a receipt
receipt = glacis.attest(
    service_id="test",
    operation_type="inference",
    input={"prompt": "test"},
    output={"response": "result"},
)

# Verify the signature
result = glacis.verify(receipt)
print(f"Signature valid: {result.signature_valid}")  # True
print(f"Overall valid: {result.valid}")              # True

CLI Verification

Verify offline receipts from the command line:

# Save receipt to file
python -c "
from glacis import Glacis
import json

glacis = Glacis(mode='offline')
receipt = glacis.attest(
    service_id='test',
    operation_type='test',
    input={'test': True},
    output={'ok': True}
)
print(json.dumps(receipt.model_dump(), indent=2))
" > receipt.json

# Verify
python -m glacis verify receipt.json

Output:

Receipt: oatt_abc123...
Type: Offline

Status: VALID
  Signature: PASS

When to Use Offline Mode

Scenario	Recommendation
Local development	Offline mode
CI/CD testing	Offline mode
Air-gapped environments	Offline mode
Internal audits only	Offline mode (acceptable)
External audits	Online mode (recommended)
Customer due diligence	Online mode (required)
Published research	Online mode (recommended)

Upgrading to Online Mode

When you need third-party verifiability:

# Before: offline
glacis = Glacis(mode="offline")

# After: online
glacis = Glacis(api_key="glsk_live_...")

That’s it. The API is identical—only the witness status changes.