ms2k/lazaret
SHA256
Watch
0
Code Releases 3 Activity

Implement generation-bound protocol cryptography

Browse source
This commit is contained in:
ms2k 2026-07-15 15:55:08 +09:00
commit af8669c165
1 changed files with 1882 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

16
docs/schema.md
View file

@ -869,6 +869,22 @@ classDiagram
Host Coordinator. It is not a distinct Host Coordinator principal. Physical
encoding, signing, size, and validation rules are defined by the specification.
For embedded signed claims, the field order shown above is the Postcard field
order. A protocol credential ID is SHA-256 over the minimally encoded claim
fields excluding `credential_id` and `issuer_signature`. A Session Request
Capability ID is SHA-256 over the minimally encoded claim fields excluding
`capability_id` and `coordinator_signature`. A Trust Manifest digest is SHA-256
over the complete minimally encoded manifest, including its issuer signature.
The manifest issuer signs its minimally encoded fields excluding
`issuer_signature`.
Every signature input is the ASCII `lazaret/v1/` prefix plus the lower-kebab
record name, followed by the unsigned 64-bit big-endian payload length and the
exact payload bytes. Mailbox signatures use the bytes carried in
`SignedProtocolRecord`; verification occurs before decoding those payload bytes.
Result stream digests are SHA-256 over the ordered concatenation of bytes for
that stream.
### Participant ownership
```mermaid