feat(verifier): §10 verify + schema + did + fixtures (VOKF-3/4/5/6 / S3) - #3
Merged
Conversation
…/4/5/6)
`@verifiable-okf/verifier` implements the SPEC §10 algorithm and completes
the M0 sign→verify loop.
- verify.ts: status {unverified|verified|failed} + reason codes, in §10
order (schema → content_hash → resolve issuer → signature → validity
→ policy attestations). unverified and unknown keys always pass through.
- schema.ts: §11 JSON Schema validation via Ajv 2020 (draft 2020-12) →
schema_invalid; schema embedded with a drift test vs the repo file.
- did.ts: did:key (offline) + did:web (HTTPS, TLS required, injectable
fetch) → Ed25519 public key, else issuer_unresolved.
- cli.ts: `vokf-verify` → machine-readable JSON; exit 0/1/2.
- fixtures/tampered/{body-modified,bad-signature,schema-invalid,
unresolvable-issuer}.md each map to the exact reason code; signed/
with-attestation.md drives unsupported_scheme / attestation_failed
via policy. expired / not_yet_valid covered with a fixed `now`.
- README: real < 5-minute sign → verify quickstart.
Tests (22): signed → verified; each tampered → exact reason; validity
window + 60s skew; attestation policy paths; did:key round-trip; did:web
via stub fetch; schema drift + accept/reject. Full suite green
(canon 28 + signer 7 + verifier 22 = 57). Clean build orders all three
packages; CLI quickstart reproduces the golden and flags tampering.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
S3 —
@verifiable-okf/verifier+ conformance + publish-prepCompletes M0 (the launch-gating MVP): the full sign → verify loop with conformance fixtures.
Implements
verify.ts): trust status + reason codes, in spec order — schema → content_hash → resolve issuer → signature → validity (≤60s skew) → policy attestations.unverifiedand unknown extra keys always pass through (base-OKF compatible).schema.ts): Ajv 2020 (draft 2020-12) →schema_invalid. Schema embedded in the package with a drift test vsschemas/provenance.schema.json.did.ts):did:keyoffline +did:webover HTTPS (TLS required, injectable fetch) → Ed25519 key, elseissuer_unresolved.vokf-verifyCLI → machine-readable JSON, exit 0/1/2.fixtures/tampered/{body-modified,bad-signature,schema-invalid,unresolvable-issuer}.md;signed/with-attestation.mdforunsupported_scheme/attestation_failed.DoD（VOKF-3/4/5/6）
fixtures/signed→ 全件 verifiedfixtures/tamperedの各ケース → 期待 reason code 一致（integrity_mismatch / signature_invalid / schema_invalid / issuer_unresolved / expired / not_yet_valid / unsupported_scheme / attestation_failed）unverified（provenance 不在）・不明キーは通すschema_invalidパステスト・drift ガードissuer_unresolvedM0 完了 → 公開
S1〜S3 で M0 完了です。public 化は mayumi さんの明示 GO で実施します（現状 private）。次は M1（attestation 1本 e2e / visualizer / 実バンドル例）。
🤖 Generated with Claude Code