diff --git a/README.md b/README.md index 11f62b3..d18ae74 100644 --- a/README.md +++ b/README.md @@ -207,15 +207,18 @@ The log uses: - `RFC9162_SHA256` Merkle leaf/node hashing with `0x00` leaf and `0x01` node domain separation. - Signed Tree Heads over canonical JSON tree-head payloads. - OpenSSL Ed25519 signatures today. -- An additive `SLH-DSA-SHA2-128s` / FIPS 205 slot: verify path proven (fips205-slhdsa-verified, checked by `pacta-verify-slhdsa` built from the pinned proven source); signing deterministic and parameter-locked; published heads remain Ed25519-only until the next publication. +- An additive `SLH-DSA-SHA2-128s` / FIPS 205 slot: verify path proven (fips205-slhdsa-verified, checked by `pacta-verify-slhdsa` built from the pinned proven source); signing deterministic and parameter-locked. Since tree size 14 (2026-08-08) every published head carries this co-signature alongside Ed25519; earlier heads keep their single signature, recorded as absent-not-failed. - An explicit `ML-DSA-65` / FIPS 204 signature slot that is `unavailable` unless the host has a real backend. If an agent policy requires both signatures, verification fails closed. The deployed instance ([ltl.zkdefi.org](https://ltl.zkdefi.org), mirror [`lean-transparency-log`](https://github.com/saymrwulf/lean-transparency-log)) -is live at **13 leaves**. Entry 13 (2026-07-16) attests the log's own +is live at **19 leaves** (2026-08-08). Entry 12 (2026-07-16) attests the log's own accumulator machinery — a kernel-checked mechanization of the log's security analysis ([`ltl-accumulator-verified`](https://github.com/saymrwulf/ltl-accumulator-verified)), -appended into the log itself and scoped to the mechanized model. The +appended into the log itself and scoped to the mechanized model; entries +13–16 re-attest the four Ed25519 forks at 44 certificates each, entry 17 +the accumulator's hardened model, and entry 18 the SLH-DSA verify path — +the log's first post-quantum entry. The producer path that generated it now emits a `scope` block into each leaf (guarantees / exclusions / deployment-constraints), so a leaf carries its own honest scope, not just a claim card.