saymrwulf/lean-transparency-log
1
0
Fork 0
mirror of https://github.com/saymrwulf/lean-transparency-log.git synced 2026-09-04 20:03:43 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

README: align the two remaining scope phrasings with the corrected homepage

Browse source 
Doc-freshness audit (2026-07-19): the homepage received these two
round-10 scope corrections in Tier 2 but the mirror README kept the old
wording — 'sole trust anchor' -> sole cryptographic identity anchor
(truth rests on each leaf's stated assumptions); 'the git hash is the
content hash' -> the commit identifies the committed git tree, not
dependencies or toolchains.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
mrwulf 2026-07-19 13:04:53 +02:00
parent 52179bdaf1
commit 130d5b305a
1 changed files with 4 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
README.md
View file

@ -23,7 +23,7 @@ Layout:
| `receipts/<component>.receipt.json` | inclusion proof binding that attestation to the latest signed head |
| `sth-history.jsonl` | **every** Signed Tree Head ever issued — the witness channel: all cloners see the same heads |
| `latest-sth.json` | the current head |
| `provider.ed25519.pub` | the provider's public key (the sole trust anchor) |
| `provider.ed25519.pub` | the provider's public key — the sole cryptographic identity anchor; each statement's truth additionally rests on the assumptions stated in its leaf |
| `verify.py` | standalone verifier (Python stdlib + the `openssl` binary; fails closed without them; `--all` covers every published receipt) |
| `verify_selftest.py` | adversarial self-test: proves the verifier's fail-closed paths reject mutated receipts |
@ -41,8 +41,9 @@ The provider tooling, agent tooling, and course materials:
**https://github.com/saymrwulf/proof-aware-crypto-tooling-agent**
Honesty notes, always in force: attestations cover Rust **source** at a
pinned commit (clone it — the git hash is the content hash — and build it
yourself; compilers are declared trusted base). The log deliberately
pinned commit (clone it — the commit identifies the committed git tree,
not dependencies or toolchains — and build it yourself; compilers are
declared trusted base). The log deliberately
retains early leaves recording a **failed** audit run: an append-only
trust ledger keeps its history. Tree heads are signed by the merkleized,
proof-attested Ed25519 library itself, and each signature embeds the