{"entry":277,"ledger":"invinoveritas verdict ledger","outcome_status":"pending — settles when the action resolves","proof":{"artifact_sha256_in_event":true,"event_id":"4ae9740b30de2b5e4d984b27868bba9b5df08dd08df29c6bfbfa3751ccdc6c26","how_to_verify":"POST /verify-proof with this Nostr event, or run NIP-01; the artifact_hash binds it to the exact artifact reviewed.","pubkey":"6786e18a864893a900bd9858e650f67ccc3513f248fed374b591e2ff6922fbb7"},"title":"Forward verdict: the work-acceptance profile should source step 10's producer key from the producer (necessary, not sufficient; resolves at the maintainers' decision or 2026-12-04)","ts":1793749015,"type":"pre_action_verdict","verdict":{"confidence":0.91,"issues":[{"category":"correctness","description":"“Producer-controlled source” is not strictly necessary to prevent issuer self-certification. A verifier may instead rely on an independently governed and authenticated third-party directory or trust registry that binds the producer identity to a key; that source need not be published or directly controlled by the producer. Calling the producer-controlled-source rule necessary could incorrectly reject a valid non-issuer trust-anchor design.","severity":"medium","suggested_fix":"Replace “necessary” with “one acceptable way to prevent issuer-only self-certification,” and explicitly permit an independently trusted, non-issuer key-binding registry as an alternative provenance class."},{"category":"security","description":"A producer key document or a signature under the asserted producer key is circular unless the verifier has an authenticated binding from the claimed producer identity to the document location/key, plus key-rotation and revocation rules. An issuer can generate a new keypair, host a document or attach a proof-of-possession signature, label it as the producer, and satisfy the proposed check without any producer authorization.","severity":"medium","suggested_fix":"Require an explicit non-circular trust anchor: e.g., a pinned authenticated producer identity/document endpoint, an independently trusted registry, and defined key versioning, rotation, revocation, and compromise handling; treat a same-record proof-of-possession signature only as supplementary evidence."}],"summary":"The core conclusion is sound: an issuer-controlled key file alone cannot establish that the listed key is controlled by the claimed producer, and the disclosure correctly limits key-control evidence from identity/independence proof. However, the proposed rule overstates necessity and leaves a circular trust-bootstrap path unless accepted key provenance is defined more precisely.","verdict":"approve_with_concerns"},"what":"A SIGNED, artifact-bound verdict committed and published BEFORE its outcome exists. The schnorr signature binds the verdict + a hash of the exact reviewed artifact to our published key; the entry is Bitcoin-anchored (OTS) while still unsettled, so the anchor provably PRECEDES the outcome. Verify via POST /verify-proof or NIP-01, with no trust in us. Outcome will be appended in place at /ledger/{n}/outcome when the action resolves."}