statecraft.
Catalog/spec-spine

068-a-verifier-checks-the-bytes-it-was-given

A verifier checks the bytes it was given

Lifecycle approvedImplementation completeVerification unknownQualification unknown

`verify-attestation` decides on a different object from the one it was handed. It deserializes the attestation without refusing members it does not know, and it checks the seal against a hash of its own re-serialization of what it parsed, never against the file's bytes. Measured at 75181a5: a sealed attestation with an injected `"prCouple": {"ok": true}` verifies as `match` and `valid` at exit 0, in both the corpus and the per-spec scope, and so does a reformatted copy. Separately, the corpus recompute never compares `schemaVersion`, so an attestation claiming `9.0.0` recomputes as `match` at exit 0, while the per-spec path reports an unnamed content mismatch. Spec 021 AC-4 already requires a single tampered payload byte to fail the signature, and the attestation module documents that loaders reject an unknown MAJOR, so this spec extends rather than amends: the verifier reads the file once, both modes decide on those bytes, every attestation and seal DTO refuses unknown members at exit 3, an unknown schema MAJOR is refused at exit 3 in the loaders' own words, and the corpus recompute compares the version. Nothing `attest` emits changes, and every attestation and seal it has ever written still verifies, provided the bytes were kept.

Read the full pinned specification ↗

Relationships

Claimed units

  • establishes
    {
  "kind": "file",
  "path": "crates/spec-spine-cli/tests/verify_attestation_bytes.rs"
}
  • extends
    {
  "nature": "additive",
  "spec": "021-ledger-seal",
  "unit": {
    "kind": "file",
    "path": "crates/spec-spine-types/src/attest.rs"
  }
}
  • extends
    {
  "nature": "additive",
  "spec": "021-ledger-seal",
  "unit": {
    "kind": "file",
    "path": "crates/spec-spine-cli/src/verify_attestation.rs"
  }
}
  • extends
    {
  "nature": "additive",
  "spec": "021-ledger-seal",
  "unit": {
    "kind": "file",
    "path": "crates/spec-spine-core/src/attest.rs"
  }
}
  • extends
    {
  "nature": "additive",
  "spec": "001-compile-registry",
  "unit": {
    "kind": "file",
    "path": "crates/spec-spine-core/src/lib.rs"
  }
}
  • extends
    {
  "nature": "additive",
  "spec": "021-ledger-seal",
  "unit": {
    "kind": "file",
    "path": "crates/spec-spine-core/tests/attest.rs"
  }
}
  • extends
    {
  "nature": "additive",
  "spec": "057-the-docs-name-what-adopters-derived",
  "unit": {
    "kind": "file",
    "path": "docs/schema-versioning.md"
  }
}

Source headings

  1. 068: A verifier checks the bytes it was given
  2. 1. Purpose
  3. 2. Territory
  4. 3. Behavior
  5. 3.1 The bytes are read once, and both modes decide on them
  6. 3.2 An unknown member is refused
  7. 3.3 An unknown schema MAJOR is refused, and the corpus recompute compares the version
  8. 3.4 The facade holds the same rules
  9. 3.5 The documentation says what is true
  10. 3.6 What must keep working
  11. 4. Out of scope
  12. 5. Resolved decisions
  13. Verification

Frozen anchors

No frozen anchors declared.