From 6057c231391483ced2c4aa10afa1692a1a167f85 Mon Sep 17 00:00:00 2001 From: xgreenx Date: Mon, 5 Oct 2026 14:18:17 +0100 Subject: [PATCH 1/2] docs: cite platform-ceremonies 4.1 for the attested-data bytes Ceremony-common section 9.1 holds the attestation verification and fee rules and fixes no byte layout. The attested-data format the notary signs and GoogleJwtRoots.rotate decodes is platform-ceremonies section 4.1, "Attested data". Assisted-by: Claude Opus 5.5 Signed-off-by: xgreenx --- src/jwks/mod.rs | 8 ++++---- src/proof.rs | 6 +++--- tests/e2e_real.rs | 4 ++-- 3 files changed, 9 insertions(+), 9 deletions(-) diff --git a/src/jwks/mod.rs b/src/jwks/mod.rs index 0d4b83b..9e20398 100644 --- a/src/jwks/mod.rs +++ b/src/jwks/mod.rs @@ -20,10 +20,10 @@ //! The entry point is [`prover::notarize_jwks`]: it runs the MPC-TLS prover //! against a live notary over any async socket and reads the record back. -/// The record as the notary hands it back: the section 9.1 attested data and -/// the notary's signature over it, and nothing else. An alias of -/// libid-transcript's wire struct, so the keeper and the notary agree on the -/// frame by construction. +/// The record as the notary hands it back: the platform-ceremonies section +/// 4.1 attested data and the notary's signature over it, and nothing else. An +/// alias of libid-transcript's wire struct, so the keeper and the notary agree +/// on the frame by construction. pub type NotarizedSession = libid_transcript::AttestationWire; /// Errors from building or obtaining a JWKS reading. diff --git a/src/proof.rs b/src/proof.rs index 20d88b1..142022c 100644 --- a/src/proof.rs +++ b/src/proof.rs @@ -1,9 +1,9 @@ //! Obtaining a [`NotarizedSession`] — the notarized reading of Google's JWKS: //! an MPC-TLS session against a running libid notary's TCP wire port, driven //! by this crate's own prover-side helpers -//! ([`crate::jwks::prover::notarize_jwks`]). What comes back is the section -//! 9.1 bytes and the notary's signature over them — exactly what -//! `GoogleJwtRoots.rotate` takes. +//! ([`crate::jwks::prover::notarize_jwks`]). What comes back is the +//! platform-ceremonies section 4.1 bytes and the notary's signature over +//! them — exactly what `GoogleJwtRoots.rotate` takes. use crate::jwks::NotarizedSession; use anyhow::{ diff --git a/tests/e2e_real.rs b/tests/e2e_real.rs index 19ae66c..9604540 100644 --- a/tests/e2e_real.rs +++ b/tests/e2e_real.rs @@ -137,8 +137,8 @@ struct DeclaredContracts { notary_service: Address, } -/// The notary's `createdAt`: bytes 32..40 of the section 9.1 record, -/// big-endian, right after the 32-byte authority id. +/// The notary's `createdAt`: bytes 32..40 of the platform-ceremonies section +/// 4.1 record, big-endian, right after the 32-byte authority id. fn created_at(attested_data: &[u8]) -> u64 { u64::from_be_bytes(attested_data[32..40].try_into().unwrap()) } From e9595c61dd2f3d80983acee5736ba607b44e08ab Mon Sep 17 00:00:00 2001 From: xgreenx Date: Mon, 5 Oct 2026 14:38:44 +0100 Subject: [PATCH 2/2] docs: keep "section 4.1" on one line in the citations A citation split across a line break escapes `grep 'section 4.1'`, so a later sweep of spec references would miss two of the three. Assisted-by: Claude Opus 5.5 Signed-off-by: xgreenx --- src/jwks/mod.rs | 8 ++++---- tests/e2e_real.rs | 4 ++-- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/src/jwks/mod.rs b/src/jwks/mod.rs index 9e20398..9365a21 100644 --- a/src/jwks/mod.rs +++ b/src/jwks/mod.rs @@ -20,10 +20,10 @@ //! The entry point is [`prover::notarize_jwks`]: it runs the MPC-TLS prover //! against a live notary over any async socket and reads the record back. -/// The record as the notary hands it back: the platform-ceremonies section -/// 4.1 attested data and the notary's signature over it, and nothing else. An -/// alias of libid-transcript's wire struct, so the keeper and the notary agree -/// on the frame by construction. +/// The record as the notary hands it back: the platform-ceremonies +/// section 4.1 attested data and the notary's signature over it, and nothing +/// else. An alias of libid-transcript's wire struct, so the keeper and the +/// notary agree on the frame by construction. pub type NotarizedSession = libid_transcript::AttestationWire; /// Errors from building or obtaining a JWKS reading. diff --git a/tests/e2e_real.rs b/tests/e2e_real.rs index 9604540..1a58bb4 100644 --- a/tests/e2e_real.rs +++ b/tests/e2e_real.rs @@ -137,8 +137,8 @@ struct DeclaredContracts { notary_service: Address, } -/// The notary's `createdAt`: bytes 32..40 of the platform-ceremonies section -/// 4.1 record, big-endian, right after the 32-byte authority id. +/// The notary's `createdAt`: bytes 32..40 of the platform-ceremonies +/// section 4.1 record, big-endian, right after the 32-byte authority id. fn created_at(attested_data: &[u8]) -> u64 { u64::from_be_bytes(attested_data[32..40].try_into().unwrap()) }