Ed25519. The seed is the private key — anyone holding it can sign as this producer. It exists only on this page; nothing leaves the browser.
In-memory only — gone on reload. Download it to keep it; load a saved store to continue a lineage. Stored bundles are offered as parents at seal time and provided automatically during lineage verification.
Cases derived from the corpus cases cited in the specification text (T01–T06, T10, T11, T13, T14, T15 semantics, plus stub-algorithm, policy, HITL, and indeterminate paths). This is not the published 40-test conformance corpus — per §16.3, conformance claims remain provisional until run against the published suite. Load it below when you have the file.
The audit companion's twelve mutations, run against the bundle in the Verify tab (or a freshly sealed sample if none). Each mutation shows the full state machine's typed outcome and the v1.0.0 quick verifier's outcome for parity.
Loader for the published 40-test corpus JSON: { bundles, contexts, keys, side_info?, tests:[{case, bundle, context, profile, provided, budgets, expected, notes}] }
Live means implemented and tested here. Stub means the identifier is recognized and honestly declared unimplemented — selecting it returns not-defined-in-this-version. Nothing is silently accepted.
The specification leaves these unpinned; this build's choices are declared rather than hidden.
'PB-HITL-1|' + canonicalJSON({hdr, meta(attestation_b64u zeroed to ""), payload}), computed before the Merkle commitment so the construction is non-circular. Pending spec errata.side_info_decl entry with bound:"required" and external:true that is not provided returns indeterminate; without the external flag it returns missing-side-info.spec_ver edit to an unimplemented version gates as unknown-version here, while the v1.0.0 quick verifier (integrity-only) reports it as a signature failure. Both views are shown in the mutation audit.hdr/meta/payload/merkleRoot/sig). The v1.0.0 document format (payload_b64u + seal) is not implemented; such bundles return malformed with schema detail. spec_ver: "1.0.0" is accepted on v1.0.0-shaped bundles.d is correct, but GX and GY do not satisfy the curve equation (GY ≠ 4/5 mod p). SubtleCrypto masks this in modern browsers; when the fallback actually runs, it fails closed — every valid signature is rejected. This build derives the base point from its defining equations and validates it three ways (curve membership, L·G = identity, cross-check against an independent Ed25519 implementation). Correct values:GX = 15112221349535400772501151409588531511454012693041857206046113283949847762202
GY = 46316835694926478169428394003475163141307993866256225615783033603165251855960This exact engine was executed headless before shipping. Cryptographic claims were checked against an independent implementation (node:crypto), not against the engine itself.