Verification algorithm

Specification index / generated stages

1. Bounded decode

   Reject oversized, malformed, non-canonical, duplicate, indefinite, tagged, floating-point, or trailing input before it can affect later stages.

2. Reference resolution

   Resolve the proof’s content-addressed object graph, require referenced objects, reject cycles and duplicates, and enforce plan limits.

3. Principal control

   Use installed immutable registries to verify signatures and carried evidence for each principal-control binding.

4. Authority branches

   Start at explicitly trusted roots, walk grant chains, and reject any expansion across protected authority dimensions.

5. Plan evaluation

   Evaluate proof, all-of, any-of, and K-of-N composition without allowing indeterminate branches to become authorization.

6. Action binding

   Match profile, action digest, body digest, audience, challenge, time, constraints, status, assurance, and local policy before constructing VerifiedAction.

Determinism

Identical proof, canonical action, trusted context, and executable registry produce the same result bytes. Evaluation time and every other varying fact are explicit inputs.

Execution is not a verifier stage

The kernel returns a sealed verified action. Profile decoding, replay and budget claims, transport policy, receipts, and execution occur downstream.