What a verifier result means

appliance verify and appliance report-verify end with one result. Each has its own exit code, so scripts can tell them apart.

appliance verify [-trust KEY]... [-prev previous.zip] [-anchor checkpoint.txt]... [-json] pack.zip (or -answer answer.zip).

Result	Exit	Means	What to do
PASS	0	every check that could run passed	file the report; if check 6 is NOT CHECKED, note it in the workpapers
UNKNOWN SIGNER	3	the pack is intact, but signed by a key you did not trust, and no valid handoff leads to it from one you did	compare the key ID with the registration sheet; ask the bank for the sheet if you do not have it
TAMPERED	4	a signature, a file digest, the checkpoint or an entry does not match; the reason names which	do not rely on the pack; ask for the original download
HISTORY REWRITTEN	5	an earlier pack’s checkpoint, or one you supplied, does not match this pack’s log	the log was rolled back, forked or rewritten; ask the bank to explain, and read any discontinuity notices
INCONSISTENT	6	the data files disagree with the entries: a total, a cited row, a discontinuity, a bulk sign-off, or (for an answer) the replay in step 8	do not rely on the pack; the reason names what differs
MALFORMED	7	the ZIP or a file in it is not in the published format	ask for the original download; a ZIP made again from a folder is MALFORMED
HISTORY NOT CHECKED	8	a checkpoint you supplied with -anchor could not be compared (wrong log, newer than the pack, older than its entries with no proof, or it did not authenticate)	check that the anchor is from the same appliance and older than the pack
usage	2	the command line was wrong	appliance verify -h
other error	1	the verifier could not run (a file it could not read, for example)	read the message

With no outside checkpoint, check 6 reads “NOT CHECKED: no independent checkpoint (previous pack, SIEM or email) was supplied”, the result can still be PASS and the exit code is 0. A pack alone cannot prove that history before it was not rewritten. Supply the previous pack (-prev) or a checkpoint from the bank’s SIEM (-anchor) to check it. Only a supplied checkpoint that cannot be compared is HISTORY NOT CHECKED (exit 8).

Line	Means
Assurance tier	how the signing key is protected: software_protected today
Crosswalk	the frameworks the appliance’s controls view refers to (a label, not a mapping document)
FIPS 140-3 mode	whether the build selected Go’s FIPS 140-3 module
Anchored to	the off-box checkpoints the appliance knows about, or CHECKPOINTS NOT ANCHORED
Separation	SINGLE-OPERATOR MODE when one person held Admin and Reviewer
Devices	counts by status; scan-only devices are counted separately as “seen by network scan (point-in-time)”
History	whether check 6 ran against an independent checkpoint, and any discontinuity

appliance report-verify -trust KEY-ID [-json] board-report.zip.

Result	Exit	Means
PASS	0	signature, digests, proofs and the embedded pack verify, and every figure was recomputed byte for byte
UNKNOWN SIGNER	3	as for packs
TAMPERED	4	as for packs
PACK FAILED	6	the evidence pack inside the report did not verify
MALFORMED	7	the ZIP or a file in it is not in the format
NUMBERS DIFFER	10	the files are signed, but a figure, a CSV or the page does not follow from the log
usage, other error	2, 1

These codes are the published evidence-pack contract, so they differ from the general exit-code classes the other modes use.