AEF 1200: Verifier Requirements

1. Status#

AEF 1200 v0.2 is an early draft and will change. It is a consolidating revision: no check is invented here, and every change pays a recorded debt. v0.1 remains readable at its own path.

What changed, enumerated. Four challenges are ruled, resolutions 0001 through 0004 in the challenge record, recorded before this text was written to reflect them: V22 is scoped, V29 is split, V27 tests the claimed form, and V25's emission is conditional on the declaration's bound. Twelve requirement ids are issued, V43 through V54, for the checks that existed in the reference verifier without them and the two additions AEF 1300 v0.2 forced. The qualification registry catches up: the twelve classes that earned their way in through OTHER are admitted, plus the margin class, and OTHER remains for the next one. V13 is restated over supplied material, closing the carve-out AEF 1201 section 15 finding 1 forced. V35 is restated over a supplied deprecation list, per AEF 1400 T11. Per-check status enters the result form, the revision AEF 1300 section 14.2 called the most substantive of its candidates. Everything else, including the outcome vocabulary, the negative claims block, the honest-floor target, provenance, the language rules, and v0.1's recorded terms, carries forward, with the terms re-collected in section 20 rather than dropped.

Its requirements bind a verifier. Requirements on records belong to AEF 1300, cited here at v0.2. AEF 1000 is the source of authority; AEF 1001 supplies the vocabulary; AEF 1100 is cited by threat id; AEF 1101, AEF 1201, AEF 1301, and AEF 1400 by section and requirement id.

Versions are dated, kept at their own paths, and recorded in CHANGELOG.md beside this document.

2. The rulings, and where each lands#

Every disposition is in the challenge record as an appended resolution entry; this section is the account, and the revised text in sections 6 through 9 is the law.

Challenge-0001, V22 versus R18: adopted in part, resolution-0001. AEF 1300 keeps chaining required in both forms it defines, so a chainless record claiming either form contradicts its own claimed version, and the failure is fatal, which is what the verifier did. V22's qualification survives for record forms that do not require chaining, of which none exist, so ORDER-UNCHAINED is currently unproducible by any conformant input, and the coverage declaration says so beside the fact. The reading-independent half is ruled with it: qualifications that arose before a fatal check ride on FAIL results, per section 6, so a qualification's non-emission on inputs where its condition cannot occur is conformance, not omission.

Challenge-0002, V29's fatality: adopted, resolution-0002. Where the declaration states an approval was required and none is present, absence is fatal; where none was required, absence stays qualified; the emission of APPROVAL-ABSENT is unconditional on both branches. Section 8.7's failure paragraph now carries the exception its letter lacked, and the reason is the one the challenge stated: a free-to-ignore requirement is an operator's favorite kind.

Challenge-0003, V27's form: adopted, resolution-0003. The form a record's claimed version defines is the form the check tests: R24's three members for a `1300/0.1` record, AEF 1301 A3's closed set for `1300/0.2`. Within a v0.1 record, an approval carrying any of A3's distinguishing members claims A3's semantics and is held to them, discriminator included, so stripping the `type` member from a full approval dodges nothing, and the roles disclosure still emits V30's self-assertion report wherever the relation check did not run. The disputed behavior was wrong for the challenge's own input, a bare three-member approval, which the verifier now accepts with the report that only presence was examined; that fixture is retired with its reason and re-pinned under the ruling. The ruling's first draft reached a second fixture it had no challenge for, and this session's hostile review reversed the reach before publication, which section 19 counts on the right side of the ledger.

Challenge-0004, V25's emission: adopted, resolution-0004. The bound that discharges the emission is the declaration's, per AEF 1400 T8, the only bound the series defines. The interval is always computed and reported; the qualification marks the undeclared case, and the declared case is the seal-latency check's finding, met or exceeded.

3. Normative language#

The key words MUST, MUST NOT, REQUIRED, SHALL, SHALL NOT, SHOULD, SHOULD NOT, RECOMMENDED, MAY, and OPTIONAL are to be interpreted as described in RFC 2119 and RFC 8174, and only when they appear in all capitals.

Requirements V1 through V42 keep their numbers, with revised text marked; V43 through V54 are issued by this version and are stable within it.

4. What this document owes the series#

The debts arriving here are AEF 1201 section 15's findings 1 and 2, the V13 expressibility repair and the unnumbered checks, together with the findings ledgers of AEF 1301 section 16 and AEF 1400 section 16. Their disposition: the six unnumbered checks get ids in section 8; the approval checks get theirs in section 8.7; V13's carve-out closes in section 8.2; the registry catches up in section 7.4; per-check status enters in section 6; and the four challenges are ruled in section 2. What this document still owes after this version is collected in section 17 and is short.

5. What a verifier is not asked to do#

Unchanged from v0.1, and restated by reference rather than repeated: a verifier does not establish that work was done as described, does not judge scope adequacy, does not certify, does not decide re-verification differences, and does not establish its own correctness, which remains AEF 1201's subject.

6. The verification result#

V1 through V7 carry forward unchanged: the AEF 1101 section 11 form, one outcome from the vocabulary, qualifications with class and condition, the failing check named on FAIL and INCONCLUSIVE, the negative claims block, no PASS alongside a qualification, and registry classes with OTHER for the uncovered.

V54 (new). Every check the result reports MUST carry a per-check status: `held`, `failed`, `not-run`, or `qualified`. The result-level outcome remains section 7.1's vocabulary unchanged; the per-check status is what lets a check that could not run inside an otherwise sound verification say so, which AEF 1300 section 14.2 found the result form could not express. A fatal check with status `not-run` forces INCONCLUSIVE per V36; a non-fatal `failed` is a finding that does not move the outcome, the shape AEF 1400's seal-latency check established.

Qualifications on FAIL results, ruled per resolution-0001. Qualifications that arose before a fatal check failed MUST ride on the FAIL result. A qualification whose condition cannot occur on a given input is not omitted by not appearing.

7. Outcomes, qualifications, and the honest floor#

Sections 7.1 through 7.3 and 7.5 carry forward unchanged: the four-value vocabulary, the unreachable PASS, the qualification and standing-limitation split, and the floor-sentence design target.

7.4, the registry, caught up. The v0.2 registry admits the twelve classes that entered through OTHER exactly as V7 designed, each now citable by class: ELEMENT-UNSUPPORTED, SEAL-TIME-UNANCHORED, VERIFIER-SELF-AUTHORED, TRUST-BASE-SELF-ASSERTED, ARTIFACTS-NONE-BOUND, APPROVAL-IS-SELF-ASSERTION, APPROVER-INDEPENDENCE-NOT-ESTABLISHED, PRESENTED-BYTES-UNVERIFIED, ACCEPTANCE-ABSENT, ANCHOR-PROOF-UNVERIFIED, ANCHOR-ORDER-NOT-ESTABLISHED, and ANCHOR-RENEWAL-LAPSED, joined by UNAUTHENTICATED-SEAL-MARGIN from AEF 1300 v0.2's transition. The original twelve remain. OTHER remains, because the mechanism that filled this list is not done: APPROVAL-SEMANTICS-UNEVALUATED entered through it the day resolution-0003 landed, and it is the first candidate for v0.3.

8. The checks#

The organization and the unchanged checks carry forward: 8.1 seal integrity (V8, V9), 8.3 scope and declared elements (V15 through V17), 8.4 artifacts (V18 through V20), 8.8 roles (V30, V31). Revisions and issued ids follow.

8.0 (new): the record form. V53. The verifier MUST determine the record's claimed form from its `aefVersion` member, per AEF 1300 v0.2 R2, MUST select every form-dependent expectation from it, and MUST test the record's top-level member set against the one its claimed form fixes, with a violation fatal, because the record contradicts its own claim. Where the form is unknown, the verifier MUST report it as undeterminable and check nothing else, with the outcome INCONCLUSIVE per V36. Guessing at a form is reporting conclusions the verifier did not establish, V40's general sin in its most tempting instance. Within what a form permits, an approval's own carried members select between R24 and A3 semantics per V27, which is reading the record's claims, not guessing.

8.2 revised: V13 over supplied material. The per-mechanism obligations stand, restated so that every branch operates on what the reviewer supplies, per AEF 1201 section 15 finding 1: for X.509, the chain is verified to a reviewer-designated root against supplied, stapled revocation data current as of a stated moment, and the staleness of that moment is reported; for Certificate Transparency, the inclusion proof is checked against a supplied signed tree head, and whether a monitoring party is named in the trust base statement is reported; liveness, whether a log still answers or an authority still stands, is the reviewer's procedure and the trust base comparison's subject, never the check's premise. The carve-out AEF 1201 section 7.2 cut for these branches closes: they are expressible by pinned fixture from this version forward. They remain unimplemented in the reference verifier, which is a running-list entry, and expressible-but-undone is a different debt than inexpressible.

8.5 revised: V21 and V22 per resolution-0001. V21 stands: carried chaining is verified and a broken link is fatal. V22 v0.2: where the record's claimed form does not require chaining and entries carry none, the verifier MUST emit ORDER-UNCHAINED; where the claimed form requires chaining, absence is the record contradicting its claimed version, and the failure is fatal. No current form makes chaining optional, so the qualification's condition is presently unproducible, stated here so the registry entry does not imply otherwise.

8.6 revised: V25 per resolution-0004. V25 v0.2. The verifier MUST compute and report the capture-to-seal interval. Where the declaration states no `sealLatency` bound, it MUST emit CAPTURE-TO-SEAL-INTERVAL-UNBOUNDED. Where a bound is declared, in either form per AEF 1300 v0.2 R7's one-member grandfather, the emission does not arise and the comparison is V51, the seal-latency check: declared and met is held; declared and exceeded is a non-fatal `failed`, a finding inside a declared boundary, per AEF 1400 T8. The interval is read from the seal's recorded time, which under the v0.1 form is in the unauthenticated margin, and the check's detail says which form it read.

8.7 revised: the approval set, per resolutions 0002 and 0003 and AEF 1301. V27 v0.2 tests the form the record's claimed version defines, closed member set included for v0.2 records; malformed or wrongly typed is fatal; a bare three-member R24-form approval in a v0.1 record is form-conformant and carries the qualification that only presence was examined, while an approval carrying any of A3's distinguishing members claims A3's semantics and is held to them wherever it appears, which closes the discriminator-stripping path a lenient reading would open. V29 v0.2: absence is qualified with APPROVAL-ABSENT, emitted unconditionally, and additionally fatal where the declaration required an approval. V45 approval-binding, V46 approval-relation, V47 approval-timing, and V48 acceptance-binding adopt AEF 1301 section 13's checks as numbered requirements, fatality as stated there: binding, relation contradiction, and timing violations are fatal for the record, acceptance failures fatal for the supplied acceptance, absence of an acceptance never fatal. V28's negative claim stands.

8.9 (new): binding and termination, the two checks AEF 1300 section 14.2 found unnumbered. V43 declaration-binding: the record's `declarationSeal` matches the supplied sealed declaration and that envelope's own seal verifies under its claimed form; mismatch fatal; a withheld envelope is a fatal check that cannot run. V44 termination: the record ends where its declaration said, per AEF 1300 R12 and R13; violation fatal.

8.10 (new): the anchor set, adopting AEF 1400 section 12 as numbered requirements. V49 anchor-form: carried evidence well formed and binding the sealed bytes, on whichever seals carry it; malformed or mismatched evidence fatal; absence qualified with SEAL-TIME-UNANCHORED. V50 anchor-ordering: where both seals are anchored, report whether the pair establishes the before-relation; never fatal; the late case emits ANCHOR-ORDER-NOT-ESTABLISHED. V52 anchor-renewal: supplied renewals bind the record's whole digest; mismatch fatal; the proof-unverified qualification emitted once however many anchors and renewals are carried.

9. Re-verification#

Sections 9.1 through 9.3 carry forward unchanged: V32 through V34's comparison obligations and difference types, and the comparison's limit over self-certified statements.

9.4 revised: V35 over the supplied deprecation list, per AEF 1400 T11. V35 v0.2. The verifier MUST evaluate algorithm standing against a reviewer-supplied deprecation list naming algorithms and the moments they became unreliable, reading the record's algorithms from signed content and the anchor's own algorithm where one is carried, and MUST report which of the two cases applies: an anchor predating the break, preserving the content's anchored existence as far as the anchor's own algorithm and party stand, or no such anchor, leaving the record unplaceable before the break. ANCHOR-RENEWAL-LAPSED names an unextended chain per AEF 1400 T10's rule. The first case, which v0.1 said was unavailable, is available and pinned. V36 stands unchanged.

10 through 13. Trust base handling, imposed-on-nothing, provenance, and language#

V37 through V42 carry forward unchanged. Section 11's discipline survives with one addition to its exception list: the two absence conditions that are fatal are joined by required-and-absent approvals per V29 v0.2 and by form-required members per V27 v0.2 and V53, in every case because the record contradicts its own claims rather than merely omitting something.

14. Requirement count and classification#

Fifty-four requirements: V1 through V42 as revised, V43 through V54 issued. The v0.1 classification carries forward for the carried requirements. Of the twelve issued: checkable only by running the verifier against fixtures: ten, V43 through V52, eight of which have pinned fixtures whose entries cite their ids in the coverage declaration, while V43 and V44 are exercised by generated required-to-fail tests only, discharging AEF 1201 C7's wider accounting and not C5's, a gap the declaration's own accounting shows; and with two stated exceptions inside the ten: V50 and the standing-evaluation half of V35 have no failing state by design, they report and decide nothing, so AEF 1201 C7's required-to-fail obligation is discharged for them by the statement that there is nothing to fail, which the declaration carries per check. Checkable by inspecting output and by fixture together: two, V53, whose unknown-form branch is pinned and whose reporting half is read off any result, and V54, carried by every result and asserted wherever a test reads a check's status.

15. Record fields these checks require#

v0.1's thirteen-item list is paid down by AEF 1300 v0.2 and AEF 1400: the declaration enumeration, the unsupported marker, chaining, roles, time sources, key binding mechanism, approval referent, approval-required flag, algorithm identifiers, the anchor member, and the trust base reference all exist. Still owed: reference resolution for unretained input state (AEF 1001 open question 2, with AEF 1300 R23 narrowing it), and nothing else. The spine this section was for has been built.

16. Findings for earlier and later documents#

1. AEF 1201 v0.2 inherits three. C12 needs the superseded-not-wrong retirement category this session exercised; C15 needs the resolution-entry mechanic the challenge record now uses; and C7 needs the nothing-to-fail discharge stated in section 14 for report-only checks.
2. AEF 1400 v0.2 inherits one: T3's margin language is form-dependent after AEF 1300 v0.2, per that document's section 14.
3. AEF 1100 v0.3's candidate table, from AEF 1400 section 16, stands as recorded there; nothing in this revision changes a disposition, and the rulings here are about verifier conduct, not threat standing.

17. Requirements with no observer, and what remains open#

The v0.1 audit carries forward where its subjects survive: V40 still binds judgment; qualification completeness still has no observer beyond fixtures, narrowed again by five pinned complete sets; V38's threshold and V39's performer remain undesignated. Newly stated: V53's guessing prohibition is observable only as its absence, a verifier that guessed would report a form it was never told, which only a reader comparing record to result can see. Open after this version: the V32 through V34 comparison remains unimplemented and unexercised pending a second verification of the same record; ORDER-UNCHAINED awaits a form that makes chaining optional; the reference verifier still performs no self-test, which is AEF 1201's C19 through C21 and not this document's to fix; whether verification results should be sealed remains the series' most-carried open question, now shared with the challenge record; and two questions v0.1 routed to this version are deferred again with the reason stated rather than dropped: whether the qualification and standing-limitation split is exhaustive, and whether INCONCLUSIVE should be subdivided, both untouched because no ruling this session needed either answered, and an answer manufactured without a forcing case would be doctrine without a debt.

18. Requirements the reference implementation currently fails#

Reported by running it, per the discipline the withdrawn version of this section taught. Verifier 0.4.0 implements the rulings, the form dispatch, the issued checks, and the registry; the suite pins them at fifty entries with six recorded retirements. It does not implement: V13's stapled branches, now expressible and undone; V32 through V34's comparison, which lacks a second result to compare; declaration-level member-set checking beyond R7's grandfather; supersession target verification, per AEF 1300 v0.2 R27; the v0.2 acceptance-envelope branch, implemented with no fixture; structural-malformation tolerance, since a record missing whole members the checks dereference can throw rather than report, V36's discipline unbuilt at the parse layer; and everything AEF 1201 C19 through C21 requires. Zero real anchors and zero mechanism proof verification, unchanged from AEF 1400 section 14.

19. Weaknesses in this document#

The rulings and the ruled are one party. Four challenges filed by the editor were dispositioned by the editor in the editor's favor three times out of four, with resolution-0003 the exception that ruled against the shipped behavior. The mechanism's records are public and its independence is still zero, which AEF 1201 section 9's uncomfortable sentence already covers and this revision does not improve.

Issuing ids after the fact rewards the implementation's choices. V43 through V52 number what the reference verifier already did, which means the specification is following its one implementation exactly where AEF 1000 section 5 warns a specification becomes documentation. The defense is that each check traces to a document's argued requirement, not to convenience; the residue is that no second implementer pressured any of them.

Fifty-four requirements is drift in the direction of unfalsifiability by volume. Each is individually checkable; the set is auditable by nobody in an afternoon, and the coverage declaration is now the only practical way to know what is exercised, which makes the suite's honesty the load-bearing member of the whole document's.

20. Terms used here that AEF 1001 does not define#

Following the practice of every document since AEF 1100, and re-collecting v0.1 section 21's terms rather than dropping them: outcome, qualification, standing limitation, negative claims block, trust anchor, and fatal, all as v0.1 recorded them. Added by this revision: per-check status (V54; AEF 1300 section 14.2 called the same thing check-level status, and this document picks one name and records both), resolution entry (the appended ruling mechanic the challenge record uses, owed to AEF 1201 C15's next version), and form dispatch (from AEF 1300 v0.2). Still undefined from earlier documents and used here: time source and key history, per the precedent AEF 1101 section 15 set for recording the wrong order.

21. License and citation#

Licensed under Creative Commons Attribution 4.0 International (CC BY 4.0).

Cite as:

Stellmacher, G. (2026). AEF 1200: Verifier Requirements, v0.2. 14 August 2026. https://grantstell.com/aef/1200

Cite the version and date, always.