sdk.html: verification is not independent of our uptime - #29
Merged
Conversation
…us list is not a static file Second finding from reading sdk.html end to end, after editing it earlier in the pass without reading it. Editing is not covering, including when I do it. "The DID document is public, the schema URLs are frozen and immutable, and revocation status lists are static public files. Verification requires neither our permission nor our uptime." Two of the three components are false and so is the conclusion: - `onUnreachable: 'cache-then-deny'` is the ONLY implemented mode (src/core/config.ts:73 throws on any other value; types.ts:266 documents it as "refresh-first; cache under maxStalenessHours; deny otherwise"). A revocation list we fail to serve becomes a DENIAL once the cache is stale. That is a dependency on our uptime, and a deliberate one. - Observer's own clause-zero status list is served by api.observerprotocol.org/api/v1/demo/clause-zero/status-list, measured 200 application/json. It is an API endpoint, not a static public file. index.html already states this correctly — "It fails closed, and it will refuse us too" — so the correction reuses that sentence rather than adding a third phrasing of it. The permission half IS true and is kept: there is nothing to authenticate to and nothing we can withhold to make a credential stop verifying. This instance was untagged and invisible to claimPatterns for the third distinct vocabulary reason in one pass: "neither our permission nor our uptime" shares no wording with "call back to us" or "nothing from us". Added "our uptime" and "permission from us" as patterns. The subject keeps being spelled a new way, so the answer is to keep widening the matcher from the site's own examples rather than to trust that the last sweep found the last variant. Base case re-run: removing this tag fails the check, restoring it passes.
✅ Deploy Preview for observerprotocol ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Second finding from reading
sdk.htmlend to end — after I had already edited it earlier in this pass without reading it. Editing is not covering, including when I do it.The claim
Two of the three supporting components are false, and so is the conclusion.
Uptime.
onUnreachable: 'cache-then-deny'is the only implemented mode —src/core/config.ts:73throws on any other value, andtypes.ts:266documents it as "refresh-first; cache undermaxStalenessHours; deny otherwise". A revocation list we fail to serve becomes a denial once the cache goes stale. That is a dependency on our uptime, and a deliberate one.Static files. Observer's own clause-zero status list is served by
api.observerprotocol.org/api/v1/demo/clause-zero/status-list— measured200 application/json. It is an API endpoint, not a static public file.index.htmlalready says this correctly ("It fails closed, and it will refuse us too"), so the correction reuses that sentence rather than adding a third phrasing.The permission half is true and is kept: there is nothing to authenticate to and nothing we can withhold to make a credential stop verifying.
Why the check did not catch it
This instance was untagged and invisible to
claimPatternsfor the third distinct vocabulary reason in one pass: "neither our permission nor our uptime" shares no wording with "call back to us" or "nothing from us". Addedour uptimeandpermission from usas patterns.The lesson is not that the pattern list is now complete. It is that the subject keeps getting spelled a new way, so the matcher has to keep being widened from the site's own examples — and a sweep that found three variants is not evidence there was no fourth.
Base case re-run: removing this tag fails the check, restoring it passes. All three checks green.