From edf0f46370be9b0b6c72fa1a1beab4d1955f1bd0 Mon Sep 17 00:00:00 2001 From: Boyd Cohen Date: Sat, 8 Aug 2026 23:55:31 -0600 Subject: [PATCH] sdk.html: verification is not independent of our uptime, and the status list is not a static file MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Second finding from reading sdk.html end to end, after editing it earlier in the pass without reading it. Editing is not covering, including when I do it. "The DID document is public, the schema URLs are frozen and immutable, and revocation status lists are static public files. Verification requires neither our permission nor our uptime." Two of the three components are false and so is the conclusion: - `onUnreachable: 'cache-then-deny'` is the ONLY implemented mode (src/core/config.ts:73 throws on any other value; types.ts:266 documents it as "refresh-first; cache under maxStalenessHours; deny otherwise"). A revocation list we fail to serve becomes a DENIAL once the cache is stale. That is a dependency on our uptime, and a deliberate one. - Observer's own clause-zero status list is served by api.observerprotocol.org/api/v1/demo/clause-zero/status-list, measured 200 application/json. It is an API endpoint, not a static public file. index.html already states this correctly — "It fails closed, and it will refuse us too" — so the correction reuses that sentence rather than adding a third phrasing of it. The permission half IS true and is kept: there is nothing to authenticate to and nothing we can withhold to make a credential stop verifying. This instance was untagged and invisible to claimPatterns for the third distinct vocabulary reason in one pass: "neither our permission nor our uptime" shares no wording with "call back to us" or "nothing from us". Added "our uptime" and "permission from us" as patterns. The subject keeps being spelled a new way, so the answer is to keep widening the matcher from the site's own examples rather than to trust that the last sweep found the last variant. Base case re-run: removing this tag fails the check, restoring it passes. --- scripts/shared-copy.json | 4 +++- sdk.html | 12 +++++++++--- 2 files changed, 12 insertions(+), 4 deletions(-) diff --git a/scripts/shared-copy.json b/scripts/shared-copy.json index f1ed7f1..9f4e8dc 100644 --- a/scripts/shared-copy.json +++ b/scripts/shared-copy.json @@ -48,7 +48,9 @@ "no network call to (us|Observer)", "no call to (us|Observer)", "no Observer Protocol API in the path", - "makes no network call at all" + "makes no network call at all", + "our uptime", + "permission from us" ], "claimPatternsAreRegex": "Case-insensitive regexes, matched by check-shared-copy.mjs. Written from the site's own examples rather than from one remembered sentence: the claim is spelled 'call back to us' on index.html and 'callback to Observer' on docs.html, and a literal lower-case list saw neither the capitalised heading nor the Observer variant. Four assertions were invisible to this block on 2026-08-09 for exactly that reason. When you add a home for the claim, add its WORDING here, not just its file.", "claimPatternNote": "Any occurrence of these in an HTML file MUST sit inside an element tagged data-shared-copy=\"offline-scope\". That is what makes a tenth instance a build failure rather than a discovery. Add the tag, or add the file to mustAppearIn if it is a new home for the claim. Some tagged instances REFER to the claim rather than asserting it (docs.html's resolution-hosting rationale is one). They are tagged anyway: the enumeration's job is to know everywhere the phrase appears, and a human scoping the claim decides per instance." diff --git a/sdk.html b/sdk.html index a631f04..7591ead 100644 --- a/sdk.html +++ b/sdk.html @@ -76,9 +76,15 @@

Verifying a credential

Everything it checks, you can re-check

-

- The DID document is public, the schema URLs are frozen and immutable, and revocation status lists - are static public files. Verification requires neither our permission nor our uptime. +

+ The DID document is public and the schema URLs are frozen and immutable, so verification needs no + permission from us: nothing to authenticate to, and nothing we can withhold to make a credential + stop verifying. It is not independent of reachability, though. + onUnreachable: 'cache-then-deny' is the only implemented mode, so a revocation list + that cannot be fetched is served from cache inside the staleness window and denied + outside it — and Observer's own clause-zero status list is served by + api.observerprotocol.org rather than as a static file. It fails closed, and it will + refuse us too.