{
  "ok": true,
  "name": "verify.residua.cloud",
  "gateways": [
    "https://gateway.pinata.cloud",
    "https://ipfs.io",
    "https://dweb.link"
  ],
  "gateway": "https://gateway.pinata.cloud",
  "configured_releases": {
    "v0.4.0": {
      "release_root_cid": "bafkreid3o7uwwjkubwwqwslgdoxe4lzrgq7cguxni76cjkkg7sjwwmpdca",
      "manifest_url": "https://gateway.pinata.cloud/ipfs/bafkreid3o7uwwjkubwwqwslgdoxe4lzrgq7cguxni76cjkkg7sjwwmpdca",
      "verify_url": "https://verify.residua.cloud/v0.4.0/verify"
    }
  },
  "framing": "WEIGHTED-TRUST check, not a verify: recomputes sha256 of each asset's gateway-served bytes vs the release_root.json recorded sha256. Pinata = availability provider, NOT a trust root. Trust root remains the keyless cosign signature + Rekor inclusion of SHA256SUMS (proof_root step 1); use `cosign verify-blob` + the residua-side checker for end-to-end trust."
}