Read it before you run it.

Setup instructions

# Metergrade Setup Kit

This kit helps you check the economics of your Azure API Management AI
traffic. It is plain text, KQL, and a workbook definition — read it before
running it.

## What this is not

No installer. No daemon. No agent runtime. No outbound network calls to
Metergrade. No credentials.

## Two ways to use it

**Economic Control Check** (no account, nothing transferred) — import the
workbook, run the queries, read the results in your own Azure environment.

**Metergrade Free** (saved baseline) — produce a supported export locally,
sign in to Metergrade, and upload it yourself.

## With an AI agent

Hand `AGENT-INSTRUCTIONS.md` to the assistant you already use. It runs in
your environment with your credentials.

## Without an AI agent

Every step is human-followable: `economic-control-check/` holds the
workbook and queries, `metergrade-free/export-apim.md` describes the
export.

## Verifying this kit

The trust chain, in the only direction it works:

    Sigstore identity  authenticates  manifest.json
    manifest.json      authenticates  the verifier and every kit artifact
    the verifier       checks         the complete kit policy

The verifier bundled here is convenience. **Sigstore and the signed
manifest are the authority.** There is no Metergrade key, no Metergrade
endpoint, and nothing to trust that you cannot check with standard tools.

### Normal use

    ./verify              (macOS, Linux)
    verify.cmd            (Windows)

Needs Node 18+ and [cosign](https://github.com/sigstore/cosign). It prints
a report and exits:

| Exit | Meaning |
|---|---|
| `0` | Verified. Signed by the Metergrade release, and the files match the signed manifest. |
| `1` | **Do not run this kit.** It is not what it claims to be. |
| `3` | Contents are internally consistent, but the signature was not checked (`--no-signature`, or cosign missing). Nothing here shows Metergrade produced it. |

A missing cosign is a failure, not a skip. A check that turns "could not
run" into success is how a green result comes to mean nothing.

Optional: `./verify --archive path/to/kit.zip` also checks the downloaded
archive against the published `archive_sha256`.

### High assurance

If you are auditing, do not start by running our code. Establish the
manifest first, then use it to establish the verifier, then run it.

**1. cosign authenticates the manifest.** The identity is pinned to the
release workflow. Do not relax it to a wildcard — that accepts a signature
from anyone, and proves only that a signature exists.

    cosign verify-blob \
      --signature manifest.json.sig \
      --certificate manifest.json.pem \
      --certificate-identity-regexp '^https://github\.com/Metergrade/metergrade-platform/\.github/workflows/release-setup-kit\.yml@refs/' \
      --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
      manifest.json

**2. The authenticated manifest establishes the verifier.** Compare the
`metergrade-verify.mjs` entry in `manifest.json` with the file on disk:

    sha256sum metergrade-verify.mjs

**3. Now run it.**

    node metergrade-verify.mjs .

Or skip step 3 entirely: `manifest.json` lists every artifact with its
`sha256`, and `checksums.sha256` is the same data in `sha256sum -c` form.
Two things that check does not do for you, and the verifier does — check
that no file is present which the manifest does **not** list (every
declared hash still matches when something undeclared has been added), and
recompute `content_hash` from the files rather than reading it back out of
the manifest.

### What the archive checksum is not

`archive_sha256` in `RELEASE.json` verifies only that the ZIP bytes arrived
intact. It is not the kit's identity — a ZIP embeds timestamps and
ordering, so two honest builds of the same contents produce different ZIP
bytes. `RELEASE.json` is published beside the archive rather than inside
it, since it records that archive's own digest.

Every released kit is retrievable at an immutable versioned URL.

## Removing it

Delete the imported workbook and, if you enabled diagnostic settings only
for this check, revert them. Nothing else was changed.