Verifiers don’t call the Vault or the Identity Service.

They only need:

• the proof bundle
• the latest identity_commitment
• the template definition / verification key

6.1 Core Check

Conceptually:

VerifyProof(
    template_id,
    proof,
    public_inputs,
    commitment
) == true

And:

• template_id must correspond to an approved template in the registry.
• commitment must match the one registered for this identity_id (via LivreID / Identity Registry).
• nonce must match the original request (no replay).
• expires_at must be in the future.

If all pass → the statement holds.