{
  "suite": "signing",
  "description": "Ed25519 over the canonical pre-image, from a FIXED key so every implementation reproduces the same bytes. `preimageUtf8` is the exact string that gets signed; `signature` is base64url of the raw 64-byte Ed25519 signature.",
  "notes": [
    "THE SIGNATURE COVERS ITS OWN METADATA. custody, signer, context and created are inside the pre-image. If only the payload were signed, a valid signature could be lifted and custody rewritten from HOSTED to SELF, silently upgrading 'the hosting instance signed as the authority' into 'the authority signed' on a signature that still verifies. Anything a relying party reads off a signature has to be covered by it.",
    "THE CONTEXT IS DOMAIN SEPARATION and it is in the prefix, not merely in the JSON. A signature made for one context must not verify in another, or a record signature becomes a secretariat action signature.",
    "VERIFYING A SIGNATURE IS NOT AUTHORIZATION. It answers only whether the bytes are a valid signature by the key the signature NAMES. Whether that key belongs to a registered, unrevoked authority is a lookup against the registry's key directory; treating ok:true as authorization accepts a key an attacker generated thirty seconds ago.",
    "A keyId that does not match its own publicKey is REFUSED, which is otherwise a full bypass of any verifier that checks trust by keyId and cryptography by publicKey."
  ],
  "key": {
    "privateKeySeedBase64Url": "AQIDBAUGBwgJCgsMDQ4PEBESExQVFhcYGRobHB0eHyA",
    "privateKeySeedHex": "0102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f20",
    "publicKeyBase64Url": "ebVWLo_mVPlAeLES6KmLp5AfhTrmlb7X4OORC60ElmQ",
    "keyId": "ed25519:ZbYGc9btiEvwHCwiLYKtoHQPKawzVdapJcgfF_R6J7g",
    "fingerprint": "65b6 0673 d6ed 884b f01c 2c22 2d82 ada0 740f 29ac 3355 d6a9 25c8 1f17 f47a 27b8"
  },
  "cases": [
    {
      "id": "record-signature-self-custody",
      "meta": {
        "context": "record",
        "signer": {
          "kind": "AUTHORITY",
          "id": "acme"
        },
        "custody": "SELF",
        "created": "2026-01-02T00:00:00Z"
      },
      "payload": {
        "schemaVersion": "1.0",
        "id": "GAVR-A7K2QXR8",
        "state": "PUBLISHED",
        "meta": {
          "9": "nine",
          "10": "ten",
          "alpha": 1
        }
      },
      "expect": {
        "canonicalPayload": "{\"id\":\"GAVR-A7K2QXR8\",\"meta\":{\"10\":\"ten\",\"9\":\"nine\",\"alpha\":1},\"schemaVersion\":\"1.0\",\"state\":\"PUBLISHED\"}",
        "preimageUtf8": "GAVR-SIG/v1/record\n{\"meta\":{\"algorithm\":\"ed25519\",\"context\":\"record\",\"created\":\"2026-01-02T00:00:00Z\",\"custody\":\"SELF\",\"keyId\":\"ed25519:ZbYGc9btiEvwHCwiLYKtoHQPKawzVdapJcgfF_R6J7g\",\"publicKey\":\"ebVWLo_mVPlAeLES6KmLp5AfhTrmlb7X4OORC60ElmQ\",\"signer\":{\"id\":\"acme\",\"kind\":\"AUTHORITY\"}},\"payload\":{\"id\":\"GAVR-A7K2QXR8\",\"meta\":{\"10\":\"ten\",\"9\":\"nine\",\"alpha\":1},\"schemaVersion\":\"1.0\",\"state\":\"PUBLISHED\"}}",
        "preimageHex": "474156522d5349472f76312f7265636f72640a7b226d657461223a7b22616c676f726974686d223a2265643235353139222c22636f6e74657874223a227265636f7264222c2263726561746564223a22323032362d30312d30325430303a30303a30305a222c22637573746f6479223a2253454c46222c226b65794964223a22656432353531393a5a6259476339627469457677484377694c594b746f4851504b61777a566461704a636766465f52364a3767222c227075626c69634b6579223a22656256574c6f5f6d56506c41654c4553364b6d4c703541666854726d6c623758344f4f52433630456c6d51222c227369676e6572223a7b226964223a2261636d65222c226b696e64223a22415554484f52495459227d7d2c227061796c6f6164223a7b226964223a22474156522d41374b3251585238222c226d657461223a7b223130223a2274656e222c2239223a226e696e65222c22616c706861223a317d2c22736368656d6156657273696f6e223a22312e30222c227374617465223a225055424c4953484544227d7d",
        "signature": "2fFM3ZVNrPeC1q1EEvCAEURmMKgUvV7a-KPIirQW_5dnhSTQqOFmWLuFlZuNmtsJfpI_vUzGV6gLG_Fb-mCHCg",
        "digest": "b80b8816ad5b70a3058ac18d77f39fb7cdef7c96ac55d16d62ff3cf9b3ac4c8a"
      }
    }
  ],
  "keyIdCases": [
    {
      "id": "key-id-derives-from-the-public-key",
      "publicKeyBase64Url": "ebVWLo_mVPlAeLES6KmLp5AfhTrmlb7X4OORC60ElmQ",
      "expect": {
        "keyId": "ed25519:ZbYGc9btiEvwHCwiLYKtoHQPKawzVdapJcgfF_R6J7g"
      }
    }
  ]
}