# GENESIS Continuity 1

Status: bounded reference implementation. Fresh registry observations, signed
witness file exchange, a browser recovery drill, and a separate Python verifier.
No independent witness deployment, third-party audit, physical-device validation,
or production registration activation is claimed.

Origin receipt bytes, succession rules, HAP signed authority grammar, the
five-second PULSE lease, stop and revoke remain unchanged. A GENESIS check cannot
grant/restore permission, spend a budget, execute an effect, or prove humanity.
Existing Echo ID and HAP keys are unchanged.

## Fresh observations

An authentic old receipt may belong to a superseded key that can still sign.
This profile asks the pinned issuer which successor it considers current in one
validated durable snapshot. Inclusion alone cannot prove absence of a successor.

`statusVerifier(bundle, trustedPins, audience)` verifies the baseline, then creates
an ephemeral verifier with a random 128-bit nonce and a 30-second half-open
window. This is observation-only; PULSE remains five seconds. One attempt is
consumed before asynchronous checks, including invalid attempts. Reconnect/reload
creates a new nonce. There is no pending-verifier import or replay API.

POST canonical `{"action":"observe","challenge":<challenge>}` to
`/api/genesis/origin`. Profile prefix: `echo-genesis/continuity/1`.

| Schema suffix | Exact fields |
| --- | --- |
| `/challenge` | `schema registry issuer number receiptHash checkpoint audience nonce issuedAt expiresAt` |
| `/observation` | `schema challenge bundleHash observedAt signature` |
| `/response` | `schema observation bundle` |
| `/witness-view` | `schema registry issuer checkpoint endorsement signature` |
| `/comparison` | `schema left right consistency` |

The entire challenge and SHA-256 of the canonical response bundle are signed by
the issuer. `observedAt` must be within the challenge window but is still an
issuer time claim. Signature bytes follow the existing GENESIS rule:
`schema + "\n" + canonical(object without signature)`.

The issuer selects the latest receipt for that number in one validated snapshot,
checks the baseline belongs to its lineage, and returns inclusion and prefix
consistency proofs. Its clock cannot precede the last committed event; it checks
the deadline again before return. Observations do not write registration events.
The client verifies exact challenge equality, signatures, complete succession,
inclusion, prefix continuity and local time before/after verification. Exact
deadline expiry, observed clock rollback, replay or session mismatch refuses.

| Result | Meaning |
| --- | --- |
| `ISSUER_REPORTS_CURRENT` | The issuer identifies the baseline receipt as current in its snapshot. |
| `SUPERSEDED` | The signed response contains a validated successor of the baseline. |
| `freshResponseVerified: true` | Only a live one-shot verifier may establish this within its locally checked window. |
| `freshResponseVerified: false` | Archive verification; saved evidence does not establish a new session. |

Current selection is an **issuer assertion**. An issuer can lie, omit updates,
present split views, or commit another update after its snapshot. A nonce or
witness agreement cannot prove global freshness. `currentControlVerified`,
`globalFreshnessVerified`, `independentOperatorsVerified` and `authorityGranted`
remain false. Witnesses prove only the checkpoint statements they actually sign.

The browser returns status to unknown on expiry, observed clock rollback, hiding,
lock or owner change. Same-key observations advance the encrypted workspace
checkpoint only after prefix verification and CAS persistence. A superseded key
is never silently replaced. Export its public evidence and retain it separately.
A new device's old backup needs external trusted history or fresh authenticated
registry status. Complete rollback of all retained evidence cannot be detected
from that evidence alone. No lost private key is reconstructed.

## Witness exchange

A wrapper carries an unchanged `echo-witness/checkpoint/2` endorsement and
issuer-signed checkpoint. The witness additionally signs the wrapper under
`/witness-view`, binding its registry and both inner objects. Relabeling fails
even when an issuer key was reused across namespaces. Pins are independently
supplied; files cannot select their own trusted keys. Duplicate witness IDs/keys
in a pin file refuse.

`createWitness` uses durable atomic compare-and-swap. Enrollment starts at a
signed size-one checkpoint, followed by verified prefix extensions. A signed
wrapper commits before return. Concurrent conflicting appends cannot both commit
to one witness. Missing/corrupt state refuses without automatic re-enrollment.
The CLI uses exclusive locks, fsync and atomic rename on reliable local storage,
not NFS/multi-host storage. A crash-held lock needs operator investigation.

Comparison authenticates both wrappers, endorsements and issuer checkpoints:

| Status | Meaning |
| --- | --- |
| `MATCHING_CHECKPOINT` | Same issuer, registry, size and root. |
| `CONSISTENT_EXTENSION` | A supplied proof preserves the shorter committed prefix. |
| `ISSUER_EQUIVOCATION` | Valid issuer signatures cover different roots at the same log size. Preserve both signed views. |
| `CONTINUITY_UNPROVEN` | Different sizes without a valid prefix proof. This is not proof of a fork. |

Repeating a witness is not independence. `distinctWitnessKeys` is reported
separately; distinct keys cannot establish separate operators, administrative
control, location, availability or honesty. Comparisons are historical. This
release uses manual authenticated file exchange; it deploys no peer discovery,
background network gossip or consensus daemon. Private keys are never exchanged.

### Separate witness process

Generate a dedicated key with `origin-cli.mjs keygen`. Prepare independently
verified pins containing the issuer and witness ID/public key. Keep operators'
keys and state separately controlled. Never enroll fixture or sandbox keys.

```sh
node genesis-reference/witness-cli.mjs init witness-key.json trusted-pins.json alpha witness-state.json
node genesis-reference/witness-cli.mjs retain witness-key.json trusted-pins.json alpha witness-state.json checkpoint.json consistency.json
node genesis-reference/witness-cli.mjs view witness-key.json trusted-pins.json alpha witness-state.json > witness-view.json
node genesis-reference/witness-cli.mjs compare comparison.json trusted-pins.json
```

`init` refuses overwrite. First retain requires the size-one signed checkpoint
saved with the first committed registration and canonical `[]` consistency.
An empty newly initialized registry has no size-one checkpoint. Later retains require
a proof from the witness's retained size. Obtain proofs from the validated log;
never reset a witness to skip missing history. Retain views outside its restore
set. A restored witness can still authenticate old state; comparison alone cannot
date its view or prove which peer is freshest. A comparison file uses the schema
above with an empty consistency array for equal-size checkpoints.

## Independent-language verifier

`genesis-reference/verify.py` implements canonical parsing, Origin bindings,
succession, Merkle inclusion/consistency, witness endorsements, wrapper signatures
and archived observations in Python. It neither imports JS nor calls a service.
Ed25519 uses `cryptography`; cryptographic primitives are not reimplemented.
This is a second implementation by the same project, not a third-party audit.

```sh
python3 -m venv .genesis-verifier
.genesis-verifier/bin/pip install cryptography==46.0.0
.genesis-verifier/bin/python genesis-reference/verify.py evidence.json trusted-pins.json
.genesis-verifier/bin/python genesis-reference/verify.py receipt.json trusted-pins.json --previous checkpoint.json
.genesis-verifier/bin/python genesis-reference/verify.py public/genesis/continuity-fixtures.json --fixtures
```

Install the dependency first, then disconnect for verification. Inputs require
canonical wire JSON with at most one trailing LF. Reformatting, CRLF conversion,
duplicate fields, alternate numbers, unknown fields, noncanonical base64 and
unsupported profiles refuse. Pins stay separate from evidence. A verified
conflict artifact establishes a conflict, not successful continuity.

Both implementations run the same hostile corpus. CI also copies only Python and
fixture data into an isolated directory with no JS implementation. Archived
evidence never establishes a fresh session, current key control or authority.

## Browser drill and deployment boundary

The page creates a disposable origin, encrypts a backup, commits dual-key
succession, decrypts the old backup and checks the newer local registry. Historical
evidence and old-key signatures remain valid while status is superseded. Two
local witnesses compare successive checkpoints. Export observations, pins and
comparisons for Python verification. No real registration request, shared counter
write, saved-workspace change or HAP action occurs during the drill.

Tests cover tampering, wrong pins, relabeled namespaces, old nonces, deadlines,
reconnects, concurrent consumption, retired keys, concurrent witness forks,
restart/rollback, corrupt state, odd/even Merkle shapes and translated UI.
Existing actual PostgreSQL issuance/CAS tests remain in CI.

Production registration still needs dedicated issuer/database provisioning and
perimeter request limits as described in GENESIS-ORIGIN.md. The 512-event /
32-revision reference capacity is unchanged. Increasing it needs a separately
reviewed, versioned storage migration; never reset history or replace the issuer
to free capacity.