{
  "tool_id": "art-424-witness-cosignature-verifier",
  "note": "golden_hash computed at fixture generation time.",
  "vectors": [
    {
      "name": "both-witnesses-pass",
      "policy_parameters": {
        "anchored_hash": "sha256:1a48948724b049112cff2467561ab5307cf76b60dd11b63847449daf155c5485",
        "log_origin": "witness-verify-1-fixture-log.example.org",
        "checkpoint_note": "witness-verify-1-fixture-log.example.org\n42\nGkiUhySwSREs/yRnVhq1MHz3a2DdEbY4R0SdrxVcVIU=\n\n— witness-ed25519-1 ug/AhAAAAABobWYAaccGWkwwp5YCyD1NxFIT3tTt3sa+GKUYMe5QfPIbsGhNlhVvMOYbOyFwWb4Ie4qmw1veCD/8fadoGxyR72/XAg==\n— witness-mldsa44-1 PRYuZQAAAABobWYAkHDvvAg2CW6/CJJNYus8I8IV+Rl4y+hdLFcjKha052gCVoSr/u3rfbUZmcCcBFole8q/UVGgB7ZkDMB5pgF5UkBfy7KvoZ/ZRSIXTJECqcab8PEQSWvg9xU9NXwl4dwNFUuibZ4Cy4d/t1tBuJ0yCo2qn1SCO7RfEFnoIu88UHi+kpQB3ApZrVbbptjT9CdB00xyKJ494lwUY4pfJBFwGZ4zEM1oB6RzNUY4dediT0fnfdAzIxY5tHhGPjWdA+NUIbQO9OP3k2I1DNHvpKld+W6xhxVTRxqBlvXaYx0bBMhGq27qXi7sc1zFHqos7Me+n6FG6iDMrn9FUBMS6POda+VPLlv+Yv/ui7VEZFg5zkF4+IYz/pEcx4BquDbaDr529ZPgoxTKRVnji5N5CkXsfavdUYG3+AnhUhEeyzbF9ICs4FhB5+mOUM+dAztEIKDtiZ6+x3pf0oZdZ9iEI5xTm5OvnVbijWJ4E7ufHUVm/8QKKezlwdVDsCvx53wQtiwai6XctvQE+24OAc5OquFCyuLv1K8ctN7Y7RNdoozjlE2Ut/7ex7R5jKoCYFImz4qdDVDKOVFpWRSqn1dhL4SjjY/SKviZkarT87jPGA+HNDdfw7PwjDaY+SlpaQSVaBUEMqbsbm4wKMZuNJ0YiUglo/f7a7Kf6aHZxIsGntXxKgDvxydeTaWvkhILNsBPekeDvg2Q6eVSrW4Si4gGQWZWCU2CFCM5/nzFle/F9PSKMBybKpZ260IprVo+tXsCVkVVXTopXLA8dyvG5OzQvOz1jOGyCw2sgIT0fN+rUOOYt2nbKZ6pTqB9kqDixvKSilcNJAwTW5oQDXUrwltyIyea6VkN6/8UkRtkn/aG0nodd/3OJMG05lOsxqo6o/PWLplmhDXgFeI9gHUfOmynjbliHg/cCz1cUXlE0mQ7XSZIHP31LtV7ZifpcbSzV9IUhYNSf+4I8lT05vfm99nTX9qt3NNAKHGWO03syqfZ7SZQukAmdMR7nMVEve9lV234w+PmOGHgvh7ZFS8s4o3Ehhy3flHk/DuXB4I1mxChjbBpYZ0B0XSa17br8qvayOV+YAFW5+bqudQiu8b1il0vIlP/QwDcicwQFK+Sfursen5Udzc+3y4FDT2H5vSnZUKX3KiHDxQ7Fsh6GZ28L5LHVdqU9CCcu2vJCEfCYBTiTP9pPb9NV7HZJWqctNSzkwuXAJ2S/kJsHIXzSEliGfA+2kIUynblTdAfufNNJxWigCzCHozjjPKGPj4kA+Z7/prnTSBjssKaNQL53+LUFtvSRj5SCzftkyhNabXtSN7Q5SkK1vhzE+GNHhfmSphgfaCUO4Hd6JvEpAHOSUqBfhwL93r92ECdCg+TRBn7ljhfJ9bhPDYUq6CP+n/PrI5YLDeN7vtVtSgT26d+q9gScqKcpB96pJu36Z8kKQkxkGti0rRB8Dg8Lg0EugN0aV0H6Mkm1cnCrqqmLVB4OCxRK9XqV4dAM68gxJEKtNkcaxGuVNQ0eVtbyaIrfdwnncSEGhj2CX1GsvVQ++6dJmvdxsOX003a6lGdRAt2aEvCCzCxNwR22e3YHGe6i1snQTV6oKVTSJPcXfhdVwX66JybG+9q4ocBEWIWMhqdeQD7Dk1qVUQDh6Fmmnr6wNDBxZJBNoWyV6UEwvSap0uj5tardQH0BN01E1kr2ll+8eiKQkvvcnvLJ0uVPEBQTrbkiPNBJLgzjWPFN6uF8X6bgV74STxwMcGc8e45qH3bcWZljFMVopYkQMTbhJAN/lXibIJcMRnxLXwCzLD5IVhmJ6zErqglRm0xpIMXmfYutzxYr82MW2Tt6LM/21DO1v/koqlk35GmFMJdjm+nHB56G6rom+Tlp1GPzO4w0+DERG0JzDRXFARzJiipRvb/lWt+FortMwCs2GOaWUH5g3EzwVwU2j5jkqtipIl5JraIFa3ZXA8CRh7D4xRNJ4YEsTtHd0BMSD2nUC6jFPmQEIxj40C1drzMCt0aMl8jd16exNbfBuS7LatMIaRaMHJZxT7HUzrgwz7sw0vJbLwKSLlqRpYAkmbfC/nLpiOFjhkDBjQZ7E/oI3OQ+HmB0XE5+496qRJSDKBHtBeL73kdjPANAlWFFDsLLV039osgPVfGScmYwUuNxtcmomtx2i9vzkOIXPVOLhM3PorHLRs8SH0UgMfnww8qICABStVvRCP1dJdWizC27KQkocHsa+ny4JKZmnwaLBskoIX6ma3t8pVgHaEQwuhN46VNJW//eFGy6d0kplbYTR4P/6YR7vJN8kJy/FGIHInGrfA36zUDmKmx+B6UZC6vYCmyRCQnJqDqRl/0moaHoj2IKu5GaF+QUtr9j9h1KH95nXc8ehHCdLf6d/CIK2xgiU/ctD87iFJmQBqP8m6Jl6Su2bnrKFTo+M/EuGHVfJS2W0abzlmhflPl5t3PMXdEzkRaUR2rEDszup6cZ03AZRTIjaAKmRY6GTRWBEVanizXc4k8yVcYOvdqbxSnZECxtEqXwKF3hP/F2J84xdbpiIjBRjmWDzC7jHMrEznrFmYQlWtVFfG1zS1W8fbMuAGN+aXPO2P/6+cvYRwnlAB/CRrk5zP73ENQD29hs+v9ZxhsMfRIir1+V3+ntv7dfWFZuoeypch1d2yk9Q7Ea3iND4gYF89HpcHfppYDFdUqBrE7h+gXGKYkMWm+PFh3ZpugJgzIgqt0UyhQStzLcbsvmSDk99Ig726O01uYSkcYKpL08SO2s6MLbaUYwM+0t5TJrF5UbM3weU1rZJsRYuO/yIhBROZtRt19+wo3OuerMDGrMo2AuQyeGu0mTJjyA6R7K8iU726KtkIQO/Q9TYLC86TcEbnsO4rt0Z4jZ7TcEjTlNgqykONfAdvMATmBCEGSY/gsccA4YvfzBcExepDhiYKz0+or3sx+Av6IRc0zByjZ+cYLfx4lZlpO86VGd6EA5f+rlYmKVJkrJ3XGzfVW6V9CGljIa6NkYl09nqF5jqWU9aeuJx2iSt7zooV16Yx4Pdb+vkpzTBbSpGljq1A7et3ti7we6Cx5kFcAznvekMZ3FLityRsPalgSNuqKVbRcieFsIrn48tkaC3Voa1+kgCBkZNcEGVGAja21u87f+QEbHCImMkx7fIOFjJCTlLG7zPUWGh0jKzlCUlNXWlxjam1zdIKIlqayvcvW19zj8fb8L0NkeH6Bn6Cjs7bkAAAAAAAAAAsePUk=\n",
        "witness_keys": [
          {
            "name": "witness-ed25519-1",
            "algorithm": "ed25519",
            "public_key_b64": "0fN6s6H2ctimNrsDRNlBLbK1wST+50DANLqoPidppTY="
          },
          {
            "name": "witness-mldsa44-1",
            "algorithm": "ml-dsa-44",
            "public_key_b64": "tf0mhz7oIabShCTchLbxRpMiL8zFDKsGRcGbU0hBqbL6/ZegtljiRLQ67FBEOjHg0En+FiD2GifLWua1n+q2pO4JHiTmZibhukyZauWwGZAZTgZHBgi2JljF5aIa0aNwLhupiLuoiK2AroNKZJy29fgEaFRj7T0znwn8Djw8bAmzFkGcMdKDSjutv60wQA3ng4fpeg+BPGvpNIcThRP/dLyC0HOQqlc9WZKucXeYIvwgF5Od8m4sgc9CNuqfCWV075gMOx+oZz+VMfw9/eHK5mezqBh7Fo2dXRc1LURTChnbO5SoCT/AQ+dUu+WI6yfTJT5kfYr7TLJWosqlfiq+j1y156Mp4OZywFJH4BuHKruwGGgjYwg+RR3RnpJpuI500UKE+qu6HGvZgsxjHeIvEGHw7Lxubi4cnQ2ZP5h0mjXOpIf/mKTkNElY/Rr0YJq4whvFzQ9xWjhV9tn6bs5DRq6IM7Cs0GgRW0YlRvTdRxNuOD66wuLDXHo6RiobU1RQAbvjCRGU8f1EeLtZfCleVosyjPzmYVR3f24qvCizyitMtAI5iMOAhQGIaetTLVlQQFkOAhExAiIm5snNccg+UiUJODTeQ2vc+F2g1Smlcxd+nVuONYmb10U0e7O6EPXN3xFapS02wJeh7ezW4A8gC1hwnKj51QLOuOVHHIeLlzIZkNUmFVVs4OQ1/QGSnkCFbTkt+fjWYGdRz8JyLte23wVXPCJBBvv2fFRPLnKu+C/d2SzLS2OHWW3HoUlMcniEb9ZotMl4jghWTq38pa6r9AApL3S1Rbz8dbEOEd2vCiIVGNn9aYctCMaT1oxwTgZ3k9zJHjBI9TvfV5yIM0Yxgxn6yecSWDEl4fhIFZB037+dRx+0salm/Xzc35cOjcOoOWLfFOnezdOyi0qdVgMjmLNVSn2S5CLyF0lo/wEGnnJsUmB/KzBg4micLBzQhSul/ZxmBMAulN05KpnCtp+A4nxIlBBc44PcAFovohrPjcWW81vzewDhU+UwyVj/BwQxkZesRrfSAKTZhedQfpU5eKC0uT5dPSIMNbQyp44TeKHdhdnJXbLaF57xfiBfS4Xq+TPgDJXH35b+z2/WThMUYwG2urTBCa4mr1BDkXNQucZ2z+TpJyTJs+9klEK4cNCl12sQ3ATo99pPpQq68PTZhu+yAzfLtRiaSkwwpslCp3DNkkpxGaNz/XolsDXl2Qn2V1joQQkokrLKwszfbPxsFHevIg2cJjCdUTp9f0bJ2EeP3HCs+Jxb46b0oz77b3DFdfUmIWcJITLAFVpehZ/5ih3xyyyGVx7JBIlVi8AgxByja5LU5hVWiIMcikFidxo8Dk0KFelTFc8OElxtqPMwgtAUAtoQzFuW4KFBwVXzQvEdJqLLIxo+WsGHacyVwMhUWT5prYip7WzoI9vI3X+dvGzH8hdJ3C4K4FVJEcMSJLeqzNxKiKzNZNTyX1nj9fMQX/WFPxHf/MuKKKDvmhMhDb1KZMPprwN5yMHaT8yCfB1v5g3qCXQFDGHTytnfwIF55xqMEDKKLHLE5gm8j9ezMtmu0wtKWYXE/DnVK46w87AB1d3w42F+lGlU2+Y8xBy2RPE/UCDdKFiKrtL59c63rhBhHZ/RlyI/R3q2G8pGnZDdTJesCvWNWaYB2bu6W0T8AhW17GJ/w2BPF6yWv4hNpWF2MvlUZn4x5bUS5FbDS8I13xYbQUGvwlmHHZfnfILr3UDQaGmvv5fddEOl7+igVg=="
          }
        ],
        "threshold": 2
      },
      "output_payload": {
        "origin": "witness-verify-1-fixture-log.example.org",
        "note_size": 42,
        "note_root_hash": "1a48948724b049112cff2467561ab5307cf76b60dd11b63847449daf155c5485",
        "anchored_hash_match": true,
        "origin_match": true,
        "threshold": 2,
        "valid_witness_count": 2,
        "cosignatures": [
          {
            "name": "witness-ed25519-1",
            "algorithm": "ed25519",
            "present": true,
            "keyid_match": true,
            "timestamp": "1752000000",
            "valid": true
          },
          {
            "name": "witness-mldsa44-1",
            "algorithm": "ml-dsa-44",
            "present": true,
            "keyid_match": true,
            "timestamp": "1752000000",
            "valid": true
          }
        ],
        "witness_verification_result": "PASS",
        "structural_error": null,
        "not_proven": [
          {
            "item": "Log honesty or completeness",
            "detail": "A witness cosignature closes anchor equivocation (one root shown to two verifiers) but says nothing about whether the log operator omitted entries or is otherwise dishonest."
          },
          {
            "item": "Witness key ownership",
            "detail": "This tool verifies signatures against the pinned public keys supplied by the caller. It does not establish that those keys belong to the parties they claim to be — that trust decision is made before pinning, not by this verification."
          },
          {
            "item": "Inclusion of any specific artifact leaf",
            "detail": "This tool verifies the checkpoint root and its witness cosignatures only. It does not recompute or verify a Merkle inclusion path for any individual leaf (see SPEC.md §20.1 for that check)."
          }
        ]
      },
      "golden_hash": "07661db6ec5437c9b4757c935d2ecababd5dff60cd870d321f3a7fc30d0aded8"
    },
    {
      "name": "tampered-ed25519-signature-fails",
      "policy_parameters": {
        "anchored_hash": "sha256:1a48948724b049112cff2467561ab5307cf76b60dd11b63847449daf155c5485",
        "log_origin": "witness-verify-1-fixture-log.example.org",
        "checkpoint_note": "witness-verify-1-fixture-log.example.org\n42\nGkiUhySwSREs/yRnVhq1MHz3a2DdEbY4R0SdrxVcVIU=\n\n— witness-ed25519-1 ug/AhAAAAABobWYAaccGWkwwp5YCyD1NxFIT3tTt3sa+GKUYMe5QfPIbsGhNlhVvMOYbOyFwWb4Ie4qmw1veCD/8fadoGxyR72/X/Q==\n— witness-mldsa44-1 PRYuZQAAAABobWYAkHDvvAg2CW6/CJJNYus8I8IV+Rl4y+hdLFcjKha052gCVoSr/u3rfbUZmcCcBFole8q/UVGgB7ZkDMB5pgF5UkBfy7KvoZ/ZRSIXTJECqcab8PEQSWvg9xU9NXwl4dwNFUuibZ4Cy4d/t1tBuJ0yCo2qn1SCO7RfEFnoIu88UHi+kpQB3ApZrVbbptjT9CdB00xyKJ494lwUY4pfJBFwGZ4zEM1oB6RzNUY4dediT0fnfdAzIxY5tHhGPjWdA+NUIbQO9OP3k2I1DNHvpKld+W6xhxVTRxqBlvXaYx0bBMhGq27qXi7sc1zFHqos7Me+n6FG6iDMrn9FUBMS6POda+VPLlv+Yv/ui7VEZFg5zkF4+IYz/pEcx4BquDbaDr529ZPgoxTKRVnji5N5CkXsfavdUYG3+AnhUhEeyzbF9ICs4FhB5+mOUM+dAztEIKDtiZ6+x3pf0oZdZ9iEI5xTm5OvnVbijWJ4E7ufHUVm/8QKKezlwdVDsCvx53wQtiwai6XctvQE+24OAc5OquFCyuLv1K8ctN7Y7RNdoozjlE2Ut/7ex7R5jKoCYFImz4qdDVDKOVFpWRSqn1dhL4SjjY/SKviZkarT87jPGA+HNDdfw7PwjDaY+SlpaQSVaBUEMqbsbm4wKMZuNJ0YiUglo/f7a7Kf6aHZxIsGntXxKgDvxydeTaWvkhILNsBPekeDvg2Q6eVSrW4Si4gGQWZWCU2CFCM5/nzFle/F9PSKMBybKpZ260IprVo+tXsCVkVVXTopXLA8dyvG5OzQvOz1jOGyCw2sgIT0fN+rUOOYt2nbKZ6pTqB9kqDixvKSilcNJAwTW5oQDXUrwltyIyea6VkN6/8UkRtkn/aG0nodd/3OJMG05lOsxqo6o/PWLplmhDXgFeI9gHUfOmynjbliHg/cCz1cUXlE0mQ7XSZIHP31LtV7ZifpcbSzV9IUhYNSf+4I8lT05vfm99nTX9qt3NNAKHGWO03syqfZ7SZQukAmdMR7nMVEve9lV234w+PmOGHgvh7ZFS8s4o3Ehhy3flHk/DuXB4I1mxChjbBpYZ0B0XSa17br8qvayOV+YAFW5+bqudQiu8b1il0vIlP/QwDcicwQFK+Sfursen5Udzc+3y4FDT2H5vSnZUKX3KiHDxQ7Fsh6GZ28L5LHVdqU9CCcu2vJCEfCYBTiTP9pPb9NV7HZJWqctNSzkwuXAJ2S/kJsHIXzSEliGfA+2kIUynblTdAfufNNJxWigCzCHozjjPKGPj4kA+Z7/prnTSBjssKaNQL53+LUFtvSRj5SCzftkyhNabXtSN7Q5SkK1vhzE+GNHhfmSphgfaCUO4Hd6JvEpAHOSUqBfhwL93r92ECdCg+TRBn7ljhfJ9bhPDYUq6CP+n/PrI5YLDeN7vtVtSgT26d+q9gScqKcpB96pJu36Z8kKQkxkGti0rRB8Dg8Lg0EugN0aV0H6Mkm1cnCrqqmLVB4OCxRK9XqV4dAM68gxJEKtNkcaxGuVNQ0eVtbyaIrfdwnncSEGhj2CX1GsvVQ++6dJmvdxsOX003a6lGdRAt2aEvCCzCxNwR22e3YHGe6i1snQTV6oKVTSJPcXfhdVwX66JybG+9q4ocBEWIWMhqdeQD7Dk1qVUQDh6Fmmnr6wNDBxZJBNoWyV6UEwvSap0uj5tardQH0BN01E1kr2ll+8eiKQkvvcnvLJ0uVPEBQTrbkiPNBJLgzjWPFN6uF8X6bgV74STxwMcGc8e45qH3bcWZljFMVopYkQMTbhJAN/lXibIJcMRnxLXwCzLD5IVhmJ6zErqglRm0xpIMXmfYutzxYr82MW2Tt6LM/21DO1v/koqlk35GmFMJdjm+nHB56G6rom+Tlp1GPzO4w0+DERG0JzDRXFARzJiipRvb/lWt+FortMwCs2GOaWUH5g3EzwVwU2j5jkqtipIl5JraIFa3ZXA8CRh7D4xRNJ4YEsTtHd0BMSD2nUC6jFPmQEIxj40C1drzMCt0aMl8jd16exNbfBuS7LatMIaRaMHJZxT7HUzrgwz7sw0vJbLwKSLlqRpYAkmbfC/nLpiOFjhkDBjQZ7E/oI3OQ+HmB0XE5+496qRJSDKBHtBeL73kdjPANAlWFFDsLLV039osgPVfGScmYwUuNxtcmomtx2i9vzkOIXPVOLhM3PorHLRs8SH0UgMfnww8qICABStVvRCP1dJdWizC27KQkocHsa+ny4JKZmnwaLBskoIX6ma3t8pVgHaEQwuhN46VNJW//eFGy6d0kplbYTR4P/6YR7vJN8kJy/FGIHInGrfA36zUDmKmx+B6UZC6vYCmyRCQnJqDqRl/0moaHoj2IKu5GaF+QUtr9j9h1KH95nXc8ehHCdLf6d/CIK2xgiU/ctD87iFJmQBqP8m6Jl6Su2bnrKFTo+M/EuGHVfJS2W0abzlmhflPl5t3PMXdEzkRaUR2rEDszup6cZ03AZRTIjaAKmRY6GTRWBEVanizXc4k8yVcYOvdqbxSnZECxtEqXwKF3hP/F2J84xdbpiIjBRjmWDzC7jHMrEznrFmYQlWtVFfG1zS1W8fbMuAGN+aXPO2P/6+cvYRwnlAB/CRrk5zP73ENQD29hs+v9ZxhsMfRIir1+V3+ntv7dfWFZuoeypch1d2yk9Q7Ea3iND4gYF89HpcHfppYDFdUqBrE7h+gXGKYkMWm+PFh3ZpugJgzIgqt0UyhQStzLcbsvmSDk99Ig726O01uYSkcYKpL08SO2s6MLbaUYwM+0t5TJrF5UbM3weU1rZJsRYuO/yIhBROZtRt19+wo3OuerMDGrMo2AuQyeGu0mTJjyA6R7K8iU726KtkIQO/Q9TYLC86TcEbnsO4rt0Z4jZ7TcEjTlNgqykONfAdvMATmBCEGSY/gsccA4YvfzBcExepDhiYKz0+or3sx+Av6IRc0zByjZ+cYLfx4lZlpO86VGd6EA5f+rlYmKVJkrJ3XGzfVW6V9CGljIa6NkYl09nqF5jqWU9aeuJx2iSt7zooV16Yx4Pdb+vkpzTBbSpGljq1A7et3ti7we6Cx5kFcAznvekMZ3FLityRsPalgSNuqKVbRcieFsIrn48tkaC3Voa1+kgCBkZNcEGVGAja21u87f+QEbHCImMkx7fIOFjJCTlLG7zPUWGh0jKzlCUlNXWlxjam1zdIKIlqayvcvW19zj8fb8L0NkeH6Bn6Cjs7bkAAAAAAAAAAsePUk=\n",
        "witness_keys": [
          {
            "name": "witness-ed25519-1",
            "algorithm": "ed25519",
            "public_key_b64": "0fN6s6H2ctimNrsDRNlBLbK1wST+50DANLqoPidppTY="
          },
          {
            "name": "witness-mldsa44-1",
            "algorithm": "ml-dsa-44",
            "public_key_b64": "tf0mhz7oIabShCTchLbxRpMiL8zFDKsGRcGbU0hBqbL6/ZegtljiRLQ67FBEOjHg0En+FiD2GifLWua1n+q2pO4JHiTmZibhukyZauWwGZAZTgZHBgi2JljF5aIa0aNwLhupiLuoiK2AroNKZJy29fgEaFRj7T0znwn8Djw8bAmzFkGcMdKDSjutv60wQA3ng4fpeg+BPGvpNIcThRP/dLyC0HOQqlc9WZKucXeYIvwgF5Od8m4sgc9CNuqfCWV075gMOx+oZz+VMfw9/eHK5mezqBh7Fo2dXRc1LURTChnbO5SoCT/AQ+dUu+WI6yfTJT5kfYr7TLJWosqlfiq+j1y156Mp4OZywFJH4BuHKruwGGgjYwg+RR3RnpJpuI500UKE+qu6HGvZgsxjHeIvEGHw7Lxubi4cnQ2ZP5h0mjXOpIf/mKTkNElY/Rr0YJq4whvFzQ9xWjhV9tn6bs5DRq6IM7Cs0GgRW0YlRvTdRxNuOD66wuLDXHo6RiobU1RQAbvjCRGU8f1EeLtZfCleVosyjPzmYVR3f24qvCizyitMtAI5iMOAhQGIaetTLVlQQFkOAhExAiIm5snNccg+UiUJODTeQ2vc+F2g1Smlcxd+nVuONYmb10U0e7O6EPXN3xFapS02wJeh7ezW4A8gC1hwnKj51QLOuOVHHIeLlzIZkNUmFVVs4OQ1/QGSnkCFbTkt+fjWYGdRz8JyLte23wVXPCJBBvv2fFRPLnKu+C/d2SzLS2OHWW3HoUlMcniEb9ZotMl4jghWTq38pa6r9AApL3S1Rbz8dbEOEd2vCiIVGNn9aYctCMaT1oxwTgZ3k9zJHjBI9TvfV5yIM0Yxgxn6yecSWDEl4fhIFZB037+dRx+0salm/Xzc35cOjcOoOWLfFOnezdOyi0qdVgMjmLNVSn2S5CLyF0lo/wEGnnJsUmB/KzBg4micLBzQhSul/ZxmBMAulN05KpnCtp+A4nxIlBBc44PcAFovohrPjcWW81vzewDhU+UwyVj/BwQxkZesRrfSAKTZhedQfpU5eKC0uT5dPSIMNbQyp44TeKHdhdnJXbLaF57xfiBfS4Xq+TPgDJXH35b+z2/WThMUYwG2urTBCa4mr1BDkXNQucZ2z+TpJyTJs+9klEK4cNCl12sQ3ATo99pPpQq68PTZhu+yAzfLtRiaSkwwpslCp3DNkkpxGaNz/XolsDXl2Qn2V1joQQkokrLKwszfbPxsFHevIg2cJjCdUTp9f0bJ2EeP3HCs+Jxb46b0oz77b3DFdfUmIWcJITLAFVpehZ/5ih3xyyyGVx7JBIlVi8AgxByja5LU5hVWiIMcikFidxo8Dk0KFelTFc8OElxtqPMwgtAUAtoQzFuW4KFBwVXzQvEdJqLLIxo+WsGHacyVwMhUWT5prYip7WzoI9vI3X+dvGzH8hdJ3C4K4FVJEcMSJLeqzNxKiKzNZNTyX1nj9fMQX/WFPxHf/MuKKKDvmhMhDb1KZMPprwN5yMHaT8yCfB1v5g3qCXQFDGHTytnfwIF55xqMEDKKLHLE5gm8j9ezMtmu0wtKWYXE/DnVK46w87AB1d3w42F+lGlU2+Y8xBy2RPE/UCDdKFiKrtL59c63rhBhHZ/RlyI/R3q2G8pGnZDdTJesCvWNWaYB2bu6W0T8AhW17GJ/w2BPF6yWv4hNpWF2MvlUZn4x5bUS5FbDS8I13xYbQUGvwlmHHZfnfILr3UDQaGmvv5fddEOl7+igVg=="
          }
        ],
        "threshold": 2
      },
      "output_payload": {
        "origin": "witness-verify-1-fixture-log.example.org",
        "note_size": 42,
        "note_root_hash": "1a48948724b049112cff2467561ab5307cf76b60dd11b63847449daf155c5485",
        "anchored_hash_match": true,
        "origin_match": true,
        "threshold": 2,
        "valid_witness_count": 1,
        "cosignatures": [
          {
            "name": "witness-ed25519-1",
            "algorithm": "ed25519",
            "present": true,
            "keyid_match": true,
            "timestamp": "1752000000",
            "valid": false
          },
          {
            "name": "witness-mldsa44-1",
            "algorithm": "ml-dsa-44",
            "present": true,
            "keyid_match": true,
            "timestamp": "1752000000",
            "valid": true
          }
        ],
        "witness_verification_result": "FAIL",
        "structural_error": null,
        "not_proven": [
          {
            "item": "Log honesty or completeness",
            "detail": "A witness cosignature closes anchor equivocation (one root shown to two verifiers) but says nothing about whether the log operator omitted entries or is otherwise dishonest."
          },
          {
            "item": "Witness key ownership",
            "detail": "This tool verifies signatures against the pinned public keys supplied by the caller. It does not establish that those keys belong to the parties they claim to be — that trust decision is made before pinning, not by this verification."
          },
          {
            "item": "Inclusion of any specific artifact leaf",
            "detail": "This tool verifies the checkpoint root and its witness cosignatures only. It does not recompute or verify a Merkle inclusion path for any individual leaf (see SPEC.md §20.1 for that check)."
          }
        ]
      },
      "golden_hash": "709f65d55255114fe097ec9eb30d547f4f0d1631ccfee49f5c405d8b2a827d28"
    },
    {
      "name": "below-threshold-only-one-witness-fails",
      "policy_parameters": {
        "anchored_hash": "sha256:1a48948724b049112cff2467561ab5307cf76b60dd11b63847449daf155c5485",
        "log_origin": "witness-verify-1-fixture-log.example.org",
        "checkpoint_note": "witness-verify-1-fixture-log.example.org\n42\nGkiUhySwSREs/yRnVhq1MHz3a2DdEbY4R0SdrxVcVIU=\n\n— witness-ed25519-1 ug/AhAAAAABobWYAaccGWkwwp5YCyD1NxFIT3tTt3sa+GKUYMe5QfPIbsGhNlhVvMOYbOyFwWb4Ie4qmw1veCD/8fadoGxyR72/XAg==\n",
        "witness_keys": [
          {
            "name": "witness-ed25519-1",
            "algorithm": "ed25519",
            "public_key_b64": "0fN6s6H2ctimNrsDRNlBLbK1wST+50DANLqoPidppTY="
          },
          {
            "name": "witness-mldsa44-1",
            "algorithm": "ml-dsa-44",
            "public_key_b64": "tf0mhz7oIabShCTchLbxRpMiL8zFDKsGRcGbU0hBqbL6/ZegtljiRLQ67FBEOjHg0En+FiD2GifLWua1n+q2pO4JHiTmZibhukyZauWwGZAZTgZHBgi2JljF5aIa0aNwLhupiLuoiK2AroNKZJy29fgEaFRj7T0znwn8Djw8bAmzFkGcMdKDSjutv60wQA3ng4fpeg+BPGvpNIcThRP/dLyC0HOQqlc9WZKucXeYIvwgF5Od8m4sgc9CNuqfCWV075gMOx+oZz+VMfw9/eHK5mezqBh7Fo2dXRc1LURTChnbO5SoCT/AQ+dUu+WI6yfTJT5kfYr7TLJWosqlfiq+j1y156Mp4OZywFJH4BuHKruwGGgjYwg+RR3RnpJpuI500UKE+qu6HGvZgsxjHeIvEGHw7Lxubi4cnQ2ZP5h0mjXOpIf/mKTkNElY/Rr0YJq4whvFzQ9xWjhV9tn6bs5DRq6IM7Cs0GgRW0YlRvTdRxNuOD66wuLDXHo6RiobU1RQAbvjCRGU8f1EeLtZfCleVosyjPzmYVR3f24qvCizyitMtAI5iMOAhQGIaetTLVlQQFkOAhExAiIm5snNccg+UiUJODTeQ2vc+F2g1Smlcxd+nVuONYmb10U0e7O6EPXN3xFapS02wJeh7ezW4A8gC1hwnKj51QLOuOVHHIeLlzIZkNUmFVVs4OQ1/QGSnkCFbTkt+fjWYGdRz8JyLte23wVXPCJBBvv2fFRPLnKu+C/d2SzLS2OHWW3HoUlMcniEb9ZotMl4jghWTq38pa6r9AApL3S1Rbz8dbEOEd2vCiIVGNn9aYctCMaT1oxwTgZ3k9zJHjBI9TvfV5yIM0Yxgxn6yecSWDEl4fhIFZB037+dRx+0salm/Xzc35cOjcOoOWLfFOnezdOyi0qdVgMjmLNVSn2S5CLyF0lo/wEGnnJsUmB/KzBg4micLBzQhSul/ZxmBMAulN05KpnCtp+A4nxIlBBc44PcAFovohrPjcWW81vzewDhU+UwyVj/BwQxkZesRrfSAKTZhedQfpU5eKC0uT5dPSIMNbQyp44TeKHdhdnJXbLaF57xfiBfS4Xq+TPgDJXH35b+z2/WThMUYwG2urTBCa4mr1BDkXNQucZ2z+TpJyTJs+9klEK4cNCl12sQ3ATo99pPpQq68PTZhu+yAzfLtRiaSkwwpslCp3DNkkpxGaNz/XolsDXl2Qn2V1joQQkokrLKwszfbPxsFHevIg2cJjCdUTp9f0bJ2EeP3HCs+Jxb46b0oz77b3DFdfUmIWcJITLAFVpehZ/5ih3xyyyGVx7JBIlVi8AgxByja5LU5hVWiIMcikFidxo8Dk0KFelTFc8OElxtqPMwgtAUAtoQzFuW4KFBwVXzQvEdJqLLIxo+WsGHacyVwMhUWT5prYip7WzoI9vI3X+dvGzH8hdJ3C4K4FVJEcMSJLeqzNxKiKzNZNTyX1nj9fMQX/WFPxHf/MuKKKDvmhMhDb1KZMPprwN5yMHaT8yCfB1v5g3qCXQFDGHTytnfwIF55xqMEDKKLHLE5gm8j9ezMtmu0wtKWYXE/DnVK46w87AB1d3w42F+lGlU2+Y8xBy2RPE/UCDdKFiKrtL59c63rhBhHZ/RlyI/R3q2G8pGnZDdTJesCvWNWaYB2bu6W0T8AhW17GJ/w2BPF6yWv4hNpWF2MvlUZn4x5bUS5FbDS8I13xYbQUGvwlmHHZfnfILr3UDQaGmvv5fddEOl7+igVg=="
          }
        ],
        "threshold": 2
      },
      "output_payload": {
        "origin": "witness-verify-1-fixture-log.example.org",
        "note_size": 42,
        "note_root_hash": "1a48948724b049112cff2467561ab5307cf76b60dd11b63847449daf155c5485",
        "anchored_hash_match": true,
        "origin_match": true,
        "threshold": 2,
        "valid_witness_count": 1,
        "cosignatures": [
          {
            "name": "witness-ed25519-1",
            "algorithm": "ed25519",
            "present": true,
            "keyid_match": true,
            "timestamp": "1752000000",
            "valid": true
          },
          {
            "name": "witness-mldsa44-1",
            "algorithm": "ml-dsa-44",
            "present": false,
            "valid": false,
            "keyid_match": false,
            "error": "no cosignature line matched this witness name"
          }
        ],
        "witness_verification_result": "FAIL",
        "structural_error": null,
        "not_proven": [
          {
            "item": "Log honesty or completeness",
            "detail": "A witness cosignature closes anchor equivocation (one root shown to two verifiers) but says nothing about whether the log operator omitted entries or is otherwise dishonest."
          },
          {
            "item": "Witness key ownership",
            "detail": "This tool verifies signatures against the pinned public keys supplied by the caller. It does not establish that those keys belong to the parties they claim to be — that trust decision is made before pinning, not by this verification."
          },
          {
            "item": "Inclusion of any specific artifact leaf",
            "detail": "This tool verifies the checkpoint root and its witness cosignatures only. It does not recompute or verify a Merkle inclusion path for any individual leaf (see SPEC.md §20.1 for that check)."
          }
        ]
      },
      "golden_hash": "c7186f4e7f47b920d585eae463364b56324e8596e725c516bd7bf1ef3bb6c381"
    },
    {
      "name": "origin-mismatch-fails",
      "policy_parameters": {
        "anchored_hash": "sha256:1a48948724b049112cff2467561ab5307cf76b60dd11b63847449daf155c5485",
        "log_origin": "a-different-origin.example.org",
        "checkpoint_note": "witness-verify-1-fixture-log.example.org\n42\nGkiUhySwSREs/yRnVhq1MHz3a2DdEbY4R0SdrxVcVIU=\n\n— witness-ed25519-1 ug/AhAAAAABobWYAaccGWkwwp5YCyD1NxFIT3tTt3sa+GKUYMe5QfPIbsGhNlhVvMOYbOyFwWb4Ie4qmw1veCD/8fadoGxyR72/XAg==\n— witness-mldsa44-1 PRYuZQAAAABobWYAkHDvvAg2CW6/CJJNYus8I8IV+Rl4y+hdLFcjKha052gCVoSr/u3rfbUZmcCcBFole8q/UVGgB7ZkDMB5pgF5UkBfy7KvoZ/ZRSIXTJECqcab8PEQSWvg9xU9NXwl4dwNFUuibZ4Cy4d/t1tBuJ0yCo2qn1SCO7RfEFnoIu88UHi+kpQB3ApZrVbbptjT9CdB00xyKJ494lwUY4pfJBFwGZ4zEM1oB6RzNUY4dediT0fnfdAzIxY5tHhGPjWdA+NUIbQO9OP3k2I1DNHvpKld+W6xhxVTRxqBlvXaYx0bBMhGq27qXi7sc1zFHqos7Me+n6FG6iDMrn9FUBMS6POda+VPLlv+Yv/ui7VEZFg5zkF4+IYz/pEcx4BquDbaDr529ZPgoxTKRVnji5N5CkXsfavdUYG3+AnhUhEeyzbF9ICs4FhB5+mOUM+dAztEIKDtiZ6+x3pf0oZdZ9iEI5xTm5OvnVbijWJ4E7ufHUVm/8QKKezlwdVDsCvx53wQtiwai6XctvQE+24OAc5OquFCyuLv1K8ctN7Y7RNdoozjlE2Ut/7ex7R5jKoCYFImz4qdDVDKOVFpWRSqn1dhL4SjjY/SKviZkarT87jPGA+HNDdfw7PwjDaY+SlpaQSVaBUEMqbsbm4wKMZuNJ0YiUglo/f7a7Kf6aHZxIsGntXxKgDvxydeTaWvkhILNsBPekeDvg2Q6eVSrW4Si4gGQWZWCU2CFCM5/nzFle/F9PSKMBybKpZ260IprVo+tXsCVkVVXTopXLA8dyvG5OzQvOz1jOGyCw2sgIT0fN+rUOOYt2nbKZ6pTqB9kqDixvKSilcNJAwTW5oQDXUrwltyIyea6VkN6/8UkRtkn/aG0nodd/3OJMG05lOsxqo6o/PWLplmhDXgFeI9gHUfOmynjbliHg/cCz1cUXlE0mQ7XSZIHP31LtV7ZifpcbSzV9IUhYNSf+4I8lT05vfm99nTX9qt3NNAKHGWO03syqfZ7SZQukAmdMR7nMVEve9lV234w+PmOGHgvh7ZFS8s4o3Ehhy3flHk/DuXB4I1mxChjbBpYZ0B0XSa17br8qvayOV+YAFW5+bqudQiu8b1il0vIlP/QwDcicwQFK+Sfursen5Udzc+3y4FDT2H5vSnZUKX3KiHDxQ7Fsh6GZ28L5LHVdqU9CCcu2vJCEfCYBTiTP9pPb9NV7HZJWqctNSzkwuXAJ2S/kJsHIXzSEliGfA+2kIUynblTdAfufNNJxWigCzCHozjjPKGPj4kA+Z7/prnTSBjssKaNQL53+LUFtvSRj5SCzftkyhNabXtSN7Q5SkK1vhzE+GNHhfmSphgfaCUO4Hd6JvEpAHOSUqBfhwL93r92ECdCg+TRBn7ljhfJ9bhPDYUq6CP+n/PrI5YLDeN7vtVtSgT26d+q9gScqKcpB96pJu36Z8kKQkxkGti0rRB8Dg8Lg0EugN0aV0H6Mkm1cnCrqqmLVB4OCxRK9XqV4dAM68gxJEKtNkcaxGuVNQ0eVtbyaIrfdwnncSEGhj2CX1GsvVQ++6dJmvdxsOX003a6lGdRAt2aEvCCzCxNwR22e3YHGe6i1snQTV6oKVTSJPcXfhdVwX66JybG+9q4ocBEWIWMhqdeQD7Dk1qVUQDh6Fmmnr6wNDBxZJBNoWyV6UEwvSap0uj5tardQH0BN01E1kr2ll+8eiKQkvvcnvLJ0uVPEBQTrbkiPNBJLgzjWPFN6uF8X6bgV74STxwMcGc8e45qH3bcWZljFMVopYkQMTbhJAN/lXibIJcMRnxLXwCzLD5IVhmJ6zErqglRm0xpIMXmfYutzxYr82MW2Tt6LM/21DO1v/koqlk35GmFMJdjm+nHB56G6rom+Tlp1GPzO4w0+DERG0JzDRXFARzJiipRvb/lWt+FortMwCs2GOaWUH5g3EzwVwU2j5jkqtipIl5JraIFa3ZXA8CRh7D4xRNJ4YEsTtHd0BMSD2nUC6jFPmQEIxj40C1drzMCt0aMl8jd16exNbfBuS7LatMIaRaMHJZxT7HUzrgwz7sw0vJbLwKSLlqRpYAkmbfC/nLpiOFjhkDBjQZ7E/oI3OQ+HmB0XE5+496qRJSDKBHtBeL73kdjPANAlWFFDsLLV039osgPVfGScmYwUuNxtcmomtx2i9vzkOIXPVOLhM3PorHLRs8SH0UgMfnww8qICABStVvRCP1dJdWizC27KQkocHsa+ny4JKZmnwaLBskoIX6ma3t8pVgHaEQwuhN46VNJW//eFGy6d0kplbYTR4P/6YR7vJN8kJy/FGIHInGrfA36zUDmKmx+B6UZC6vYCmyRCQnJqDqRl/0moaHoj2IKu5GaF+QUtr9j9h1KH95nXc8ehHCdLf6d/CIK2xgiU/ctD87iFJmQBqP8m6Jl6Su2bnrKFTo+M/EuGHVfJS2W0abzlmhflPl5t3PMXdEzkRaUR2rEDszup6cZ03AZRTIjaAKmRY6GTRWBEVanizXc4k8yVcYOvdqbxSnZECxtEqXwKF3hP/F2J84xdbpiIjBRjmWDzC7jHMrEznrFmYQlWtVFfG1zS1W8fbMuAGN+aXPO2P/6+cvYRwnlAB/CRrk5zP73ENQD29hs+v9ZxhsMfRIir1+V3+ntv7dfWFZuoeypch1d2yk9Q7Ea3iND4gYF89HpcHfppYDFdUqBrE7h+gXGKYkMWm+PFh3ZpugJgzIgqt0UyhQStzLcbsvmSDk99Ig726O01uYSkcYKpL08SO2s6MLbaUYwM+0t5TJrF5UbM3weU1rZJsRYuO/yIhBROZtRt19+wo3OuerMDGrMo2AuQyeGu0mTJjyA6R7K8iU726KtkIQO/Q9TYLC86TcEbnsO4rt0Z4jZ7TcEjTlNgqykONfAdvMATmBCEGSY/gsccA4YvfzBcExepDhiYKz0+or3sx+Av6IRc0zByjZ+cYLfx4lZlpO86VGd6EA5f+rlYmKVJkrJ3XGzfVW6V9CGljIa6NkYl09nqF5jqWU9aeuJx2iSt7zooV16Yx4Pdb+vkpzTBbSpGljq1A7et3ti7we6Cx5kFcAznvekMZ3FLityRsPalgSNuqKVbRcieFsIrn48tkaC3Voa1+kgCBkZNcEGVGAja21u87f+QEbHCImMkx7fIOFjJCTlLG7zPUWGh0jKzlCUlNXWlxjam1zdIKIlqayvcvW19zj8fb8L0NkeH6Bn6Cjs7bkAAAAAAAAAAsePUk=\n",
        "witness_keys": [
          {
            "name": "witness-ed25519-1",
            "algorithm": "ed25519",
            "public_key_b64": "0fN6s6H2ctimNrsDRNlBLbK1wST+50DANLqoPidppTY="
          },
          {
            "name": "witness-mldsa44-1",
            "algorithm": "ml-dsa-44",
            "public_key_b64": "tf0mhz7oIabShCTchLbxRpMiL8zFDKsGRcGbU0hBqbL6/ZegtljiRLQ67FBEOjHg0En+FiD2GifLWua1n+q2pO4JHiTmZibhukyZauWwGZAZTgZHBgi2JljF5aIa0aNwLhupiLuoiK2AroNKZJy29fgEaFRj7T0znwn8Djw8bAmzFkGcMdKDSjutv60wQA3ng4fpeg+BPGvpNIcThRP/dLyC0HOQqlc9WZKucXeYIvwgF5Od8m4sgc9CNuqfCWV075gMOx+oZz+VMfw9/eHK5mezqBh7Fo2dXRc1LURTChnbO5SoCT/AQ+dUu+WI6yfTJT5kfYr7TLJWosqlfiq+j1y156Mp4OZywFJH4BuHKruwGGgjYwg+RR3RnpJpuI500UKE+qu6HGvZgsxjHeIvEGHw7Lxubi4cnQ2ZP5h0mjXOpIf/mKTkNElY/Rr0YJq4whvFzQ9xWjhV9tn6bs5DRq6IM7Cs0GgRW0YlRvTdRxNuOD66wuLDXHo6RiobU1RQAbvjCRGU8f1EeLtZfCleVosyjPzmYVR3f24qvCizyitMtAI5iMOAhQGIaetTLVlQQFkOAhExAiIm5snNccg+UiUJODTeQ2vc+F2g1Smlcxd+nVuONYmb10U0e7O6EPXN3xFapS02wJeh7ezW4A8gC1hwnKj51QLOuOVHHIeLlzIZkNUmFVVs4OQ1/QGSnkCFbTkt+fjWYGdRz8JyLte23wVXPCJBBvv2fFRPLnKu+C/d2SzLS2OHWW3HoUlMcniEb9ZotMl4jghWTq38pa6r9AApL3S1Rbz8dbEOEd2vCiIVGNn9aYctCMaT1oxwTgZ3k9zJHjBI9TvfV5yIM0Yxgxn6yecSWDEl4fhIFZB037+dRx+0salm/Xzc35cOjcOoOWLfFOnezdOyi0qdVgMjmLNVSn2S5CLyF0lo/wEGnnJsUmB/KzBg4micLBzQhSul/ZxmBMAulN05KpnCtp+A4nxIlBBc44PcAFovohrPjcWW81vzewDhU+UwyVj/BwQxkZesRrfSAKTZhedQfpU5eKC0uT5dPSIMNbQyp44TeKHdhdnJXbLaF57xfiBfS4Xq+TPgDJXH35b+z2/WThMUYwG2urTBCa4mr1BDkXNQucZ2z+TpJyTJs+9klEK4cNCl12sQ3ATo99pPpQq68PTZhu+yAzfLtRiaSkwwpslCp3DNkkpxGaNz/XolsDXl2Qn2V1joQQkokrLKwszfbPxsFHevIg2cJjCdUTp9f0bJ2EeP3HCs+Jxb46b0oz77b3DFdfUmIWcJITLAFVpehZ/5ih3xyyyGVx7JBIlVi8AgxByja5LU5hVWiIMcikFidxo8Dk0KFelTFc8OElxtqPMwgtAUAtoQzFuW4KFBwVXzQvEdJqLLIxo+WsGHacyVwMhUWT5prYip7WzoI9vI3X+dvGzH8hdJ3C4K4FVJEcMSJLeqzNxKiKzNZNTyX1nj9fMQX/WFPxHf/MuKKKDvmhMhDb1KZMPprwN5yMHaT8yCfB1v5g3qCXQFDGHTytnfwIF55xqMEDKKLHLE5gm8j9ezMtmu0wtKWYXE/DnVK46w87AB1d3w42F+lGlU2+Y8xBy2RPE/UCDdKFiKrtL59c63rhBhHZ/RlyI/R3q2G8pGnZDdTJesCvWNWaYB2bu6W0T8AhW17GJ/w2BPF6yWv4hNpWF2MvlUZn4x5bUS5FbDS8I13xYbQUGvwlmHHZfnfILr3UDQaGmvv5fddEOl7+igVg=="
          }
        ],
        "threshold": 2
      },
      "output_payload": {
        "origin": "witness-verify-1-fixture-log.example.org",
        "note_size": 42,
        "note_root_hash": "1a48948724b049112cff2467561ab5307cf76b60dd11b63847449daf155c5485",
        "anchored_hash_match": true,
        "origin_match": false,
        "threshold": 2,
        "valid_witness_count": 2,
        "cosignatures": [
          {
            "name": "witness-ed25519-1",
            "algorithm": "ed25519",
            "present": true,
            "keyid_match": true,
            "timestamp": "1752000000",
            "valid": true
          },
          {
            "name": "witness-mldsa44-1",
            "algorithm": "ml-dsa-44",
            "present": true,
            "keyid_match": true,
            "timestamp": "1752000000",
            "valid": true
          }
        ],
        "witness_verification_result": "FAIL",
        "structural_error": null,
        "not_proven": [
          {
            "item": "Log honesty or completeness",
            "detail": "A witness cosignature closes anchor equivocation (one root shown to two verifiers) but says nothing about whether the log operator omitted entries or is otherwise dishonest."
          },
          {
            "item": "Witness key ownership",
            "detail": "This tool verifies signatures against the pinned public keys supplied by the caller. It does not establish that those keys belong to the parties they claim to be — that trust decision is made before pinning, not by this verification."
          },
          {
            "item": "Inclusion of any specific artifact leaf",
            "detail": "This tool verifies the checkpoint root and its witness cosignatures only. It does not recompute or verify a Merkle inclusion path for any individual leaf (see SPEC.md §20.1 for that check)."
          }
        ]
      },
      "golden_hash": "ef6d6f191c0e32528575f8ac3483055de862238e53cde165216d664a87361ef2"
    },
    {
      "name": "empty-input-finite",
      "policy_parameters": {},
      "output_payload": {
        "origin": null,
        "note_size": null,
        "note_root_hash": null,
        "anchored_hash_match": false,
        "origin_match": false,
        "threshold": 1,
        "valid_witness_count": 0,
        "cosignatures": [],
        "witness_verification_result": "FAIL",
        "structural_error": "note has no header/signature separator (blank line)",
        "not_proven": [
          {
            "item": "Log honesty or completeness",
            "detail": "A witness cosignature closes anchor equivocation (one root shown to two verifiers) but says nothing about whether the log operator omitted entries or is otherwise dishonest."
          },
          {
            "item": "Witness key ownership",
            "detail": "This tool verifies signatures against the pinned public keys supplied by the caller. It does not establish that those keys belong to the parties they claim to be — that trust decision is made before pinning, not by this verification."
          },
          {
            "item": "Inclusion of any specific artifact leaf",
            "detail": "This tool verifies the checkpoint root and its witness cosignatures only. It does not recompute or verify a Merkle inclusion path for any individual leaf (see SPEC.md §20.1 for that check)."
          }
        ]
      },
      "golden_hash": "dc79eea2d171c5c79787101f970aed495109433cdd92488cabd2ce133bfb0a9d"
    },
    {
      "name": "consistency-proof-pass",
      "policy_parameters": {
        "mode": "consistency_proof",
        "log_origin": "av-consistency-1-fixture-log.example.org",
        "old_checkpoint_note": "av-consistency-1-fixture-log.example.org\n4\ngcGy/aFjRew13+5Bs233Z8+iEmMA0HUhHOUBzjRg8As=\n\n",
        "new_checkpoint_note": "av-consistency-1-fixture-log.example.org\n7\nRcbcJicEobonZ30ajy1fSGjEaTkEQwvBXpw2DGsEa7k=\n\n",
        "consistency_proof": [
          "6OU+KwJvBIgr+d4lALtazwgcGiUOC9M7A5qmrloRcZI="
        ]
      },
      "output_payload": {
        "mode": "consistency_proof",
        "old_origin": "av-consistency-1-fixture-log.example.org",
        "old_size": 4,
        "old_root_hash": "81c1b2fda16345ec35dfee41b36df767cfa2126300d075211ce501ce3460f00b",
        "new_origin": "av-consistency-1-fixture-log.example.org",
        "new_size": 7,
        "new_root_hash": "45c6dc262704a1ba27677d1a8f2d5f4868c4693904430bc15e9c360c6b046bb9",
        "origin_match": true,
        "size_order_valid": true,
        "consistency_verified": true,
        "consistency_failure_reason": null,
        "consistency_proof_result": "PASS",
        "structural_error": null,
        "not_proven": [
          {
            "item": "Log honesty before the old checkpoint",
            "detail": "A consistency proof shows the new tree is an append-only extension of the old tree. It says nothing about whether entries older than the old checkpoint were ever honestly logged."
          },
          {
            "item": "Authenticity of either checkpoint",
            "detail": "This mode assumes both checkpoint notes are ones you already trust (e.g. each independently verified via its own witness cosignatures — see this tool's cosignature mode). It does not re-verify signatures over either checkpoint here."
          },
          {
            "item": "Inclusion of any specific artifact leaf",
            "detail": "This mode verifies only that the new tree extends the old tree without rewriting it. It does not verify a Merkle inclusion path for any individual leaf (see SPEC.md §20.1 for that check)."
          }
        ]
      },
      "golden_hash": "042352b2dcacf3d71a8203364dec8374843df59e36b6db49783398ae1e0ad46e"
    },
    {
      "name": "consistency-proof-tampered-fails",
      "policy_parameters": {
        "mode": "consistency_proof",
        "log_origin": "av-consistency-1-fixture-log.example.org",
        "old_checkpoint_note": "av-consistency-1-fixture-log.example.org\n4\ngcGy/aFjRew13+5Bs233Z8+iEmMA0HUhHOUBzjRg8As=\n\n",
        "new_checkpoint_note": "av-consistency-1-fixture-log.example.org\n7\nRcbcJicEobonZ30ajy1fSGjEaTkEQwvBXpw2DGsEa7k=\n\n",
        "consistency_proof": [
          "F+U+KwJvBIgr+d4lALtazwgcGiUOC9M7A5qmrloRcZI="
        ]
      },
      "output_payload": {
        "mode": "consistency_proof",
        "old_origin": "av-consistency-1-fixture-log.example.org",
        "old_size": 4,
        "old_root_hash": "81c1b2fda16345ec35dfee41b36df767cfa2126300d075211ce501ce3460f00b",
        "new_origin": "av-consistency-1-fixture-log.example.org",
        "new_size": 7,
        "new_root_hash": "45c6dc262704a1ba27677d1a8f2d5f4868c4693904430bc15e9c360c6b046bb9",
        "origin_match": true,
        "size_order_valid": true,
        "consistency_verified": false,
        "consistency_failure_reason": "proof does not reconstruct the new checkpoint root",
        "consistency_proof_result": "FAIL",
        "structural_error": null,
        "not_proven": [
          {
            "item": "Log honesty before the old checkpoint",
            "detail": "A consistency proof shows the new tree is an append-only extension of the old tree. It says nothing about whether entries older than the old checkpoint were ever honestly logged."
          },
          {
            "item": "Authenticity of either checkpoint",
            "detail": "This mode assumes both checkpoint notes are ones you already trust (e.g. each independently verified via its own witness cosignatures — see this tool's cosignature mode). It does not re-verify signatures over either checkpoint here."
          },
          {
            "item": "Inclusion of any specific artifact leaf",
            "detail": "This mode verifies only that the new tree extends the old tree without rewriting it. It does not verify a Merkle inclusion path for any individual leaf (see SPEC.md §20.1 for that check)."
          }
        ]
      },
      "golden_hash": "8530c52f46ea842712bc8d8b13dca94410dd6b5416aafe8726357f5641369208"
    },
    {
      "name": "consistency-proof-origin-mismatch-fails",
      "policy_parameters": {
        "mode": "consistency_proof",
        "log_origin": "a-different-origin.example.org",
        "old_checkpoint_note": "av-consistency-1-fixture-log.example.org\n4\ngcGy/aFjRew13+5Bs233Z8+iEmMA0HUhHOUBzjRg8As=\n\n",
        "new_checkpoint_note": "av-consistency-1-fixture-log.example.org\n7\nRcbcJicEobonZ30ajy1fSGjEaTkEQwvBXpw2DGsEa7k=\n\n",
        "consistency_proof": [
          "6OU+KwJvBIgr+d4lALtazwgcGiUOC9M7A5qmrloRcZI="
        ]
      },
      "output_payload": {
        "mode": "consistency_proof",
        "old_origin": "av-consistency-1-fixture-log.example.org",
        "old_size": 4,
        "old_root_hash": "81c1b2fda16345ec35dfee41b36df767cfa2126300d075211ce501ce3460f00b",
        "new_origin": "av-consistency-1-fixture-log.example.org",
        "new_size": 7,
        "new_root_hash": "45c6dc262704a1ba27677d1a8f2d5f4868c4693904430bc15e9c360c6b046bb9",
        "origin_match": false,
        "size_order_valid": true,
        "consistency_verified": true,
        "consistency_failure_reason": null,
        "consistency_proof_result": "FAIL",
        "structural_error": null,
        "not_proven": [
          {
            "item": "Log honesty before the old checkpoint",
            "detail": "A consistency proof shows the new tree is an append-only extension of the old tree. It says nothing about whether entries older than the old checkpoint were ever honestly logged."
          },
          {
            "item": "Authenticity of either checkpoint",
            "detail": "This mode assumes both checkpoint notes are ones you already trust (e.g. each independently verified via its own witness cosignatures — see this tool's cosignature mode). It does not re-verify signatures over either checkpoint here."
          },
          {
            "item": "Inclusion of any specific artifact leaf",
            "detail": "This mode verifies only that the new tree extends the old tree without rewriting it. It does not verify a Merkle inclusion path for any individual leaf (see SPEC.md §20.1 for that check)."
          }
        ]
      },
      "golden_hash": "b575bc63fbe7d0ede7865e06155c3a8f3de834d8d78ee96ee803409ef9526fec"
    },
    {
      "name": "consistency-proof-empty-input-finite",
      "policy_parameters": {
        "mode": "consistency_proof"
      },
      "output_payload": {
        "mode": "consistency_proof",
        "old_origin": null,
        "old_size": null,
        "old_root_hash": null,
        "new_origin": null,
        "new_size": null,
        "new_root_hash": null,
        "origin_match": false,
        "size_order_valid": false,
        "consistency_verified": false,
        "consistency_failure_reason": null,
        "consistency_proof_result": "FAIL",
        "structural_error": "note has no header/signature separator (blank line)",
        "not_proven": [
          {
            "item": "Log honesty before the old checkpoint",
            "detail": "A consistency proof shows the new tree is an append-only extension of the old tree. It says nothing about whether entries older than the old checkpoint were ever honestly logged."
          },
          {
            "item": "Authenticity of either checkpoint",
            "detail": "This mode assumes both checkpoint notes are ones you already trust (e.g. each independently verified via its own witness cosignatures — see this tool's cosignature mode). It does not re-verify signatures over either checkpoint here."
          },
          {
            "item": "Inclusion of any specific artifact leaf",
            "detail": "This mode verifies only that the new tree extends the old tree without rewriting it. It does not verify a Merkle inclusion path for any individual leaf (see SPEC.md §20.1 for that check)."
          }
        ]
      },
      "golden_hash": "4231950cdd29e495029fca948239e1db5e1968c98e3f41ffa7a14268e1cf2960"
    }
  ]
}