Conversation
…tes (VOKF-2)
`@verifiable-okf/signer` attaches a `provenance` block (content_hash +
Ed25519 signature over the §6 payload) by appending it at the end of the
frontmatter, before the closing `---`. The original frontmatter text and
the body are preserved verbatim — only the provenance block is added.
Deterministic (idempotent): RFC 8032 Ed25519 + timestamps are inputs.
- keys.ts: Ed25519 (via @noble/curves), did:key derivation (multicodec
ed25519-pub + base58btc multibase).
- sign.ts: signConcept(); signs over JCS(frontmatter* incl. provenance
without signature.value) || 0x0A || canonical_body; issuer defaults to
the did:key of the signing seed.
- cli.ts: `vokf-sign` (key from hex/file, never logged or written out).
- fixtures/{unsigned,signed}/ga4-event.md golden (fixed test seed +
timestamps).
Tests (7): reproduces fixtures/signed from fixtures/unsigned; idempotent;
adds only provenance (body + original frontmatter byte-identical);
content_hash matches canon; signature verifies over the reconstructed
payload; private key never leaks into output; did:key issuer derived.
build + full suite green (35 tests total).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Without a topological dependency on the build task, turbo could build `signer` in parallel with `canon`, so signer's tsc ran before canon's dist/ existed and failed to resolve @verifiable-okf/canon. Local builds passed only because canon's dist/ already existed; a clean CI checkout surfaced the race. Adding "dependsOn": ["^build"] makes dependency packages build first (mirroring the test task). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
S2 —
@verifiable-okf/signer(VOKF-2)Attaches a
provenanceblock (content_hash + Ed25519 signature) to an OKF concept without mutating any other byte. Depends on the@verifiable-okf/canoncore from S1 (PR #1).Implements
provenanceat the end of the frontmatter (before closing---); original frontmatter text + body kept verbatim.did:keyissuer derived from the seed when not supplied.vokf-signCLI — private key read from hex/file, never logged or written to output.fixtures/{unsigned,signed}/ga4-event.md(fixed test seed + timestamps).DoD（VOKF-2）
provenanceキーのみ追加、既存frontmatter/body を1バイトも変えない（diffテスト）fixtures/unsigned→fixtures/signedを再現（golden一致）スコープ調整（共有）
当初S2案にあった schema検証 / DID 解決 は、それらを実際に使う verifier（S3） にまとめます。S2では署名に必要な did:key 生成 のみ実装。
次
S3：verifier（§10 アルゴリズム）＋ schema検証 ＋ did:web/did:key 解決 ＋
fixtures/tampered＋ 公開準備。🤖 Generated with Claude Code