spec: separate dataplane Merkle-root integrity from authority-layer signed receipts - #210
Merged
Merged
Conversation
…igned receipts New spec doc (docs/spec-two-layer-integrity.md) canonizing the two-layer model: the dataplane layer (per-org event hash chain + retained checkpoints, plutus verify) proves the store did not silently change; the authority layer (AAR receipts binding actor, boundary, evidence, action, result) proves who authorized what. Each layer verifies independently of the other, neither implies the other, and the two failure cases — tampered store with valid receipts, and valid store with revoked/absent signature — are distinguishable outcomes. ledger-integrity.md gets a layer-boundary callout pointing to the spec (plus one pre-existing MD049 emphasis-style fix so the touched file lints clean). Closes #206
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Canonizes the two-layer integrity model as a written spec:
docs/spec-two-layer-integrity.md— defines the dataplane layer (per-org event hash chain + retained checkpoints;plutus verifyproves the store did not silently change) and the authority layer (AAR receipts binding actor, boundary, evidence, action, result, committed as opaque validated references). Each layer is verifiable independently of the other; neither implies the other. Failure-case table makes the two distinguishable outcomes explicit: tampered store + valid receipts → storage verdict broken, authority verdict intact; valid store + revoked/absent signature → storage intact, authority failed. Composition and non-goals included.docs/ledger-integrity.md— layer-boundary callout at the top pointing to the spec (plus a one-word pre-existing MD049 emphasis-style fix so the touched file lints clean).Gates (run locally, actual output)
git diff --check→ cleannpx markdownlint-cli --disable MD013 MD033 MD024 MD025 MD060 -- docs/spec-two-layer-integrity.md docs/ledger-integrity.md→ exit 0 (LINT-OK)Acceptance criteria
plutus verify/verify-checkpointstake no receipt material) and vice versa (AAR authority checks take no chain root)Closes #206