{
  "aefVersion": "1101/0.1",
  "subject": "Verification of AEF example record run-0001 by the reference verifier at packages/aef.",
  "closureCutAt": "hardware vendor",
  "closureCutBecause": "Below the hardware vendor the author has no visibility and would be enumerating categories rather than parties, which AEF 1101 section 5.1 rules out.",
  "dependencies": [
    {
      "n": 1,
      "whatIsTrusted": "That the Ed25519 private key that sealed this record was held only by the party named as operator.",
      "controllingParty": "Grant Stellmacher, operating grantstell.com",
      "ifMisplaced": "Any record in this series can be forged or repudiated at will, and every conclusion below is void.",
      "externality": {
        "operatorCannotAlter": false,
        "operatorCannotCauseWithdrawal": false,
        "reviewerCanObtainWithoutOperator": false
      },
      "reduction": "A hardware-backed key or a threshold scheme would remove sole custody by this party. Neither is used: the key is generated by Node's crypto module on the build host, which is the weakest option and is recorded as such."
    },
    {
      "n": 2,
      "whatIsTrusted": "That the sealing key belongs to the party the record names. Nothing asserts this.",
      "controllingParty": "No party. The key binding mechanism is 'none', so no third party makes this assertion.",
      "ifMisplaced": "Not applicable, because no assertion is made. The verifier reaches continuity of use and reports IDENTITY-NOT-ESTABLISHED.",
      "externality": {
        "operatorCannotAlter": false,
        "operatorCannotCauseWithdrawal": false,
        "reviewerCanObtainWithoutOperator": false
      },
      "reduction": "Certificate Transparency or a key transparency deployment would supply an assertion plus equivocation detection, per AEF 1101 section 9. Neither is used, because the author operates no published key binding and naming one that does not exist would be the defect AEF 1101 section 6 warns about."
    },
    {
      "n": 3,
      "whatIsTrusted": "That recorded times reflect real time.",
      "controllingParty": "Grant Stellmacher, operating grantstell.com, via the host system clock",
      "ifMisplaced": "Every recorded time is an assertion, and the record establishes ordering relative to itself and nothing about when anything happened (AEF 1100 threat 10.3).",
      "externality": {
        "operatorCannotAlter": false,
        "operatorCannotCauseWithdrawal": false,
        "reviewerCanObtainWithoutOperator": false
      },
      "reduction": "An RFC 3161 timestamp authority or a public transparency log would move this outside the operator. Neither is used, and AEF 1400 has not yet stated what a time source must be."
    },
    {
      "n": 4,
      "whatIsTrusted": "That the verifier a reviewer runs is the verifier whose source is published.",
      "controllingParty": "GitHub, Inc., as the distribution host for github.com/0xGrainzy/grantstell-com",
      "ifMisplaced": "A reviewer runs a program other than the one they read, which is AEF 1100 threat 9.3.",
      "externality": {
        "operatorCannotAlter": true,
        "operatorCannotCauseWithdrawal": false,
        "reviewerCanObtainWithoutOperator": true
      },
      "reduction": "A reproducible build with published digests, per AEF 1200 V39, would let a reviewer confirm correspondence between binary and source. The verifier here is TypeScript run from source, which sidesteps the build step and does not address whether the source is correct (AEF 1100 threat 9.1)."
    },
    {
      "n": 5,
      "whatIsTrusted": "That the golden fixtures cover the cases that matter.",
      "controllingParty": "Grant Stellmacher, as the author of both the verifier and its fixtures",
      "ifMisplaced": "The verifier passes everything anyone thought to test, and fails nothing else (AEF 1100 threat 9.2).",
      "externality": {
        "operatorCannotAlter": false,
        "operatorCannotCauseWithdrawal": false,
        "reviewerCanObtainWithoutOperator": true
      },
      "reduction": "An independently authored fixture set would remove the author from this dependency. None exists. AEF 1201 is the document that would specify adequacy."
    },
    {
      "n": 6,
      "whatIsTrusted": "That the Ed25519 signature and SHA-256 implementations behave as specified.",
      "controllingParty": "The OpenSSL Project and the Node.js project, whose crypto module wraps it",
      "ifMisplaced": "Forgery or collision goes undetected and seal integrity means nothing.",
      "externality": {
        "operatorCannotAlter": true,
        "operatorCannotCauseWithdrawal": true,
        "reviewerCanObtainWithoutOperator": true
      },
      "reduction": "No construction removes a cryptographic implementation from a signing system. This dependency is structural."
    },
    {
      "n": 7,
      "whatIsTrusted": "That the language runtime executes the verifier as written.",
      "controllingParty": "The Node.js project (OpenJS Foundation)",
      "ifMisplaced": "The verifier's behaviour differs from its published source.",
      "externality": {
        "operatorCannotAlter": true,
        "operatorCannotCauseWithdrawal": true,
        "reviewerCanObtainWithoutOperator": true
      },
      "reduction": "Running the verifier under a second independent runtime would make divergence detectable rather than removing the dependency. Not done."
    },
    {
      "n": 8,
      "whatIsTrusted": "That the TypeScript toolchain compiles the verifier as written.",
      "controllingParty": "Microsoft, as the TypeScript maintainer, and the tsx maintainers",
      "ifMisplaced": "Thompson's attack, and nothing in the record detects it (AEF 1101 section 5.2).",
      "externality": {
        "operatorCannotAlter": true,
        "operatorCannotCauseWithdrawal": true,
        "reviewerCanObtainWithoutOperator": true
      },
      "reduction": "Diverse double compilation is the known construction. It is not used, on cost grounds."
    },
    {
      "n": 9,
      "whatIsTrusted": "That published artifacts remain retrievable and unaltered at rest.",
      "controllingParty": "Vercel Inc. for the published site, GitHub, Inc. for the repository",
      "ifMisplaced": "Records are lost or withheld, which is AEF 1100 threat 11.2.",
      "externality": {
        "operatorCannotAlter": true,
        "operatorCannotCauseWithdrawal": false,
        "reviewerCanObtainWithoutOperator": true
      },
      "reduction": "Publication to an append-only log the operator cannot retract from would remove the withholding path, per AEF 1101 section 10. Not used."
    },
    {
      "n": 10,
      "whatIsTrusted": "That the hardware executes instructions as specified.",
      "controllingParty": "The cloud provider operating the build host, and its silicon vendors",
      "ifMisplaced": "Everything above is void.",
      "externality": {
        "operatorCannotAlter": true,
        "operatorCannotCauseWithdrawal": true,
        "reviewerCanObtainWithoutOperator": true
      },
      "reduction": "None known. This is the declared cut-off."
    }
  ]
}