Protected properties
- A malformed or altered grant/proof cannot verify.
- A proof cannot be reused for another grant, request, operation, endpoint, holder, invocation, time/nonce context, or selector-disallowed argument.
- Standard JWS signing input, JCS, JWK thumbprints, URI normalization, and request digests have one exact byte interpretation.
- Unknown versions, fields, algorithms, extensions, or alternate encodings cannot become permissive compatibility.
- Untrusted input, decoded structs, or caller-provided facts cannot select an issuer key, expected server context, or operational authority.
- Over-limit input is rejected before attacker-amplified allocation or cryptography.
- Product/private dependencies, state, I/O, clock, randomness, signing, or secrets cannot enter the public package unnoticed.
- Errors remain fixed/value-free;
GrantFactsandEnvelopeFactsinspection remains fixed/redacted; tracked fixtures contain no private key or seed. Other public inputs, hints, configuration, and explicitly unverified values retain ordinary Elixir inspection. - A missing or surplus manifest fingerprint cannot hide keyed test material.
- A truncated, reordered, relinked, cross-chain, wrong-generation, or trailing-byte archive cannot satisfy exact caller boundaries and complete-object verification.
- An unauthenticated, reordered, duplicated, cyclic, reverse-time, or out-of-window key transition cannot advance the historical verification key.
Primary adversaries
- a caller controlling grant/proof bytes and model-selected arguments;
- a bearer-token thief without the holder private key;
- a holder attempting request, selector, operation, URI, algorithm, header, claim, encoding, or time/nonce substitution;
- a consumer treating pure verified facts as live authority;
- a contributor adding a trust-selection seam, accepting a forgeable intermediate, or weakening a bound;
- a fixture producer whose implementation agrees only with itself or whose manifest omits a key;
- an input sender using duplicate fields, alternate base64url, private JWK members, HTTP or ambiguous URIs, malformed Ed25519 points/signatures, or maximum-plus-one structures.
- an archive controller supplying a validly signed shorter history, relinked omission, stale object generation, incomplete chunk stream, or forged historical-key path.
Required controls
- closed bounded decoding and emitting before expensive cryptography;
- exact named structured inputs, field revalidation, explicit trusted key/context/time/bounds, and raw compact credentials at verification boundaries;
- exact RFC 7515 JWS, RFC 8785 JCS, RFC 7638/8037 OKP thumbprints, RFC 9449 DPoP, HTTPS URI, request digest, temporal, nonce, and semantic selector rules;
- no trust discovery, private key, callback, live state, side effect, or implicit clock;
- raw fixed-size hash/fingerprint comparisons and fixed value-free errors;
- official and independent public-only vectors, exact two-way key-census equality, meaningful-byte tamper, duplicate/encoding, property/fuzz, timing/allocation, and source-isolated mutation-red gates;
- architecture/package tests rejecting runtime, product, private, encoder, or inspection leaks.
- mandatory caller chain/anchor/transition/digest/object-version context; exact archive EOF; lower-inclusive/upper-exclusive historical windows; authenticated positional rollover; and constant-time fixed-width hash/fingerprint comparisons.
Adjacent controls outside this library
Trusted-key resolution, key custody, issuance, revocation ordering, replay reservation, execution claims, evidence appends, archive privileges, witnesses, readiness, transport authentication, and host business authorization remain mandatory but are owned by the private runtime or host.