From 130d5b305a6102bf832e82409da803c1efea8948 Mon Sep 17 00:00:00 2001 From: mrwulf Date: Sun, 19 Jul 2026 13:04:53 +0200 Subject: [PATCH] README: align the two remaining scope phrasings with the corrected homepage MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Doc-freshness audit (2026-07-19): the homepage received these two round-10 scope corrections in Tier 2 but the mirror README kept the old wording — 'sole trust anchor' -> sole cryptographic identity anchor (truth rests on each leaf's stated assumptions); 'the git hash is the content hash' -> the commit identifies the committed git tree, not dependencies or toolchains. Co-Authored-By: Claude Fable 5 --- README.md | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/README.md b/README.md index 8ea45f6..c55d01c 100644 --- a/README.md +++ b/README.md @@ -23,7 +23,7 @@ Layout: | `receipts/.receipt.json` | inclusion proof binding that attestation to the latest signed head | | `sth-history.jsonl` | **every** Signed Tree Head ever issued — the witness channel: all cloners see the same heads | | `latest-sth.json` | the current head | -| `provider.ed25519.pub` | the provider's public key (the sole trust anchor) | +| `provider.ed25519.pub` | the provider's public key — the sole cryptographic identity anchor; each statement's truth additionally rests on the assumptions stated in its leaf | | `verify.py` | standalone verifier (Python stdlib + the `openssl` binary; fails closed without them; `--all` covers every published receipt) | | `verify_selftest.py` | adversarial self-test: proves the verifier's fail-closed paths reject mutated receipts | @@ -41,8 +41,9 @@ The provider tooling, agent tooling, and course materials: **https://github.com/saymrwulf/proof-aware-crypto-tooling-agent** Honesty notes, always in force: attestations cover Rust **source** at a -pinned commit (clone it — the git hash is the content hash — and build it -yourself; compilers are declared trusted base). The log deliberately +pinned commit (clone it — the commit identifies the committed git tree, +not dependencies or toolchains — and build it yourself; compilers are +declared trusted base). The log deliberately retains early leaves recording a **failed** audit run: an append-only trust ledger keeps its history. Tree heads are signed by the merkleized, proof-attested Ed25519 library itself, and each signature embeds the