{
  "kind": "crawlcheck-conformance",
  "version": "v1",
  "built_at": "2026-10-01T14:39:35.511Z",
  "domain": "crawlcheck.io",
  "verifier": {
    "url": "https://crawlcheck.io/crawlcheck-verify.mjs?v=c96356e45adb8e56",
    "sha256": "c96356e45adb8e56980d94dc9c5491df4ade7ab069e8d70b2d9c9edcbc637a6b",
    "built_with": "46206b177cc941e18259fca734716b9f53c65641261c59891bc07189a2f7e402"
  },
  "runner": "https://crawlcheck.io/conformance/run.mjs",
  "bundle_checks": [
    "manifest_hash",
    "key_id",
    "signature",
    "subject_hash",
    "subject_binds",
    "merkle_path",
    "ots_commits_root",
    "ots_attestations",
    "experience_root",
    "decision_root",
    "lineage_root"
  ],
  "receipt_checks": [
    "receipt_hash",
    "key_id",
    "signature",
    "key_published",
    "order"
  ],
  "rule": "a conforming verifier returns exactly the expected value (true / false / null) for every listed check and the expected overall verdict; null means the check cannot run and must say why, never pass",
  "fixtures": [
    {
      "name": "valid-v3-anchored",
      "group": "valid",
      "kind": "bundle",
      "what": "A manifest-v3 bundle of a Bitcoin-anchored day, with the subject and every leaf: every check runs and passes.",
      "file": "https://crawlcheck.io/conformance/valid-v3-anchored.json?sha=3cc62582b49cc4b9",
      "sha256": "3cc62582b49cc4b97d462516b5193345bd08a0f1ba5e5deba3d349075d4b4905",
      "bytes": 31867,
      "expected": {
        "verified": true,
        "checks": {
          "manifest_hash": true,
          "key_id": true,
          "signature": true,
          "subject_hash": true,
          "subject_binds": true,
          "merkle_path": true,
          "ots_commits_root": true,
          "ots_attestations": true,
          "experience_root": true,
          "decision_root": true,
          "lineage_root": true
        }
      },
      "published_kid": null,
      "must_reject": null
    },
    {
      "name": "valid-v2-legacy",
      "group": "legacy",
      "kind": "bundle",
      "what": "A manifest-v2 bundle (before sealed roots, 2026-09-30): the three root checks cannot run and say why; nothing fails.",
      "file": "https://crawlcheck.io/conformance/valid-v2-legacy.json?sha=ad9f5b3bfd4f7df8",
      "sha256": "ad9f5b3bfd4f7df808c370e3b96aebd9ca2f39d52c66ffa01ae7cb96f944d7ef",
      "bytes": 25667,
      "expected": {
        "verified": true,
        "checks": {
          "manifest_hash": true,
          "key_id": true,
          "signature": true,
          "subject_hash": true,
          "subject_binds": true,
          "merkle_path": true,
          "ots_commits_root": true,
          "ots_attestations": true,
          "experience_root": null,
          "decision_root": null,
          "lineage_root": null
        }
      },
      "published_kid": null,
      "must_reject": null
    },
    {
      "name": "valid-pre-manifest",
      "group": "legacy",
      "kind": "bundle",
      "what": "A record from before evidence manifests (2026-09-20): manifest, key and signature checks cannot run; the record digest still folds to its day's root.",
      "file": "https://crawlcheck.io/conformance/valid-pre-manifest.json?sha=7cae4d54c9a1a3b2",
      "sha256": "7cae4d54c9a1a3b23c330e92d1c5c4fcebaed4766b76cbcbd581bb833f888eaa",
      "bytes": 6032,
      "expected": {
        "verified": true,
        "checks": {
          "manifest_hash": null,
          "key_id": null,
          "signature": null,
          "subject_hash": true,
          "subject_binds": true,
          "merkle_path": true,
          "ots_commits_root": true,
          "ots_attestations": true,
          "experience_root": null,
          "decision_root": null,
          "lineage_root": null
        }
      },
      "published_kid": null,
      "must_reject": null
    },
    {
      "name": "incomplete-anonymous",
      "group": "incomplete",
      "kind": "bundle",
      "what": "The same record as downloaded without a licence: the subject and the leaves are withheld, so those checks cannot run - never a pass.",
      "file": "https://crawlcheck.io/conformance/incomplete-anonymous.json?sha=b9925990f7b754d3",
      "sha256": "b9925990f7b754d3028f13ab5e7c44937de09fa832b9f85ad340e453f608919a",
      "bytes": 29692,
      "expected": {
        "verified": true,
        "checks": {
          "manifest_hash": true,
          "key_id": true,
          "signature": true,
          "subject_hash": null,
          "subject_binds": null,
          "merkle_path": true,
          "ots_commits_root": true,
          "ots_attestations": true,
          "experience_root": true,
          "decision_root": null,
          "lineage_root": null
        }
      },
      "published_kid": null,
      "must_reject": null
    },
    {
      "name": "stale-unsealed",
      "group": "incomplete",
      "kind": "bundle",
      "what": "A record whose day has not been sealed yet: the seal and timestamp checks cannot run.",
      "file": "https://crawlcheck.io/conformance/stale-unsealed.json?sha=bd4012691089214a",
      "sha256": "bd4012691089214ab6faac0b654911b7b676ec91f9fc6c926b73b17c131577fc",
      "bytes": 27175,
      "expected": {
        "verified": true,
        "checks": {
          "manifest_hash": true,
          "key_id": true,
          "signature": true,
          "subject_hash": true,
          "subject_binds": true,
          "merkle_path": null,
          "ots_commits_root": null,
          "ots_attestations": null,
          "experience_root": true,
          "decision_root": true,
          "lineage_root": true
        }
      },
      "published_kid": null,
      "must_reject": null
    },
    {
      "name": "tampered-manifest-bytes",
      "group": "tampered",
      "kind": "bundle",
      "what": "One space appended to the manifest body: it no longer hashes to the digest that was signed.",
      "file": "https://crawlcheck.io/conformance/tampered-manifest-bytes.json?sha=77f0bd316ef7cc30",
      "sha256": "77f0bd316ef7cc30707af9203c370f36e875e9bebe0a2db52b6145512217135f",
      "bytes": 31868,
      "expected": {
        "verified": false,
        "checks": {
          "manifest_hash": false,
          "key_id": true,
          "signature": true,
          "subject_hash": true,
          "subject_binds": true,
          "merkle_path": true,
          "ots_commits_root": true,
          "ots_attestations": true,
          "experience_root": true,
          "decision_root": true,
          "lineage_root": true
        }
      },
      "published_kid": null,
      "must_reject": null
    },
    {
      "name": "tampered-signature",
      "group": "tampered",
      "kind": "bundle",
      "what": "One character of the signature changed.",
      "file": "https://crawlcheck.io/conformance/tampered-signature.json?sha=56669ee246962945",
      "sha256": "56669ee246962945d3dacc48f2c1f4e5e18a03ca5cef7b3346029268b81f09aa",
      "bytes": 31867,
      "expected": {
        "verified": false,
        "checks": {
          "manifest_hash": true,
          "key_id": true,
          "signature": false,
          "subject_hash": true,
          "subject_binds": true,
          "merkle_path": true,
          "ots_commits_root": true,
          "ots_attestations": true,
          "experience_root": true,
          "decision_root": true,
          "lineage_root": true
        }
      },
      "published_kid": null,
      "must_reject": null
    },
    {
      "name": "wrong-key",
      "group": "tampered",
      "kind": "bundle",
      "what": "The bundle carries a different public key under the original key id.",
      "file": "https://crawlcheck.io/conformance/wrong-key.json?sha=30ea6dc2a5af1819",
      "sha256": "30ea6dc2a5af181981939aec999fd3c88758260cf8c607581e855ce85e6525b8",
      "bytes": 31867,
      "expected": {
        "verified": false,
        "checks": {
          "manifest_hash": true,
          "key_id": false,
          "signature": false,
          "subject_hash": true,
          "subject_binds": true,
          "merkle_path": true,
          "ots_commits_root": true,
          "ots_attestations": true,
          "experience_root": true,
          "decision_root": true,
          "lineage_root": true
        }
      },
      "published_kid": null,
      "must_reject": null
    },
    {
      "name": "tampered-subject",
      "group": "tampered",
      "kind": "bundle",
      "what": "One character of the sealed subject changed: it no longer hashes to the record digest.",
      "file": "https://crawlcheck.io/conformance/tampered-subject.json?sha=0188400542dbcc22",
      "sha256": "0188400542dbcc22f506f12b22f645cabdd916d5baa6e9e794dd153cdfefa3a6",
      "bytes": 31868,
      "expected": {
        "verified": false,
        "checks": {
          "manifest_hash": true,
          "key_id": true,
          "signature": true,
          "subject_hash": false,
          "subject_binds": false,
          "merkle_path": true,
          "ots_commits_root": true,
          "ots_attestations": true,
          "experience_root": true,
          "decision_root": true,
          "lineage_root": true
        }
      },
      "published_kid": null,
      "must_reject": null
    },
    {
      "name": "contradictory-report-id",
      "group": "tampered",
      "kind": "bundle",
      "what": "The bundle says it is a different report than the one the sealed subject names.",
      "file": "https://crawlcheck.io/conformance/contradictory-report-id.json?sha=c97214c79fdcf691",
      "sha256": "c97214c79fdcf691e81d81a3be7481a7e0a8426c74eba5485c3f4a4d8978f454",
      "bytes": 31867,
      "expected": {
        "verified": false,
        "checks": {
          "manifest_hash": true,
          "key_id": true,
          "signature": true,
          "subject_hash": true,
          "subject_binds": false,
          "merkle_path": true,
          "ots_commits_root": true,
          "ots_attestations": true,
          "experience_root": true,
          "decision_root": true,
          "lineage_root": true
        }
      },
      "published_kid": null,
      "must_reject": null
    },
    {
      "name": "tampered-merkle-path",
      "group": "tampered",
      "kind": "bundle",
      "what": "One sibling hash on the path to the day's root changed.",
      "file": "https://crawlcheck.io/conformance/tampered-merkle-path.json?sha=d839ba5c6998dd49",
      "sha256": "d839ba5c6998dd49e508df6b176375384593116f3f55938149de5c4d1e429a89",
      "bytes": 31867,
      "expected": {
        "verified": false,
        "checks": {
          "manifest_hash": true,
          "key_id": true,
          "signature": true,
          "subject_hash": true,
          "subject_binds": true,
          "merkle_path": false,
          "ots_commits_root": true,
          "ots_attestations": true,
          "experience_root": true,
          "decision_root": true,
          "lineage_root": true
        }
      },
      "published_kid": null,
      "must_reject": null
    },
    {
      "name": "timestamp-of-another-day",
      "group": "tampered",
      "kind": "bundle",
      "what": "The .ots proof of another day is attached: it timestamps a different root.",
      "file": "https://crawlcheck.io/conformance/timestamp-of-another-day.json?sha=654c2beed0edc4a9",
      "sha256": "654c2beed0edc4a901a7b5d5de1c19c240734e10b2acf39ed5aade5b01a841b8",
      "bytes": 31631,
      "expected": {
        "verified": false,
        "checks": {
          "manifest_hash": true,
          "key_id": true,
          "signature": true,
          "subject_hash": true,
          "subject_binds": true,
          "merkle_path": true,
          "ots_commits_root": false,
          "ots_attestations": true,
          "experience_root": true,
          "decision_root": true,
          "lineage_root": true
        }
      },
      "published_kid": null,
      "must_reject": null
    },
    {
      "name": "tampered-lineage-leaf",
      "group": "tampered",
      "kind": "bundle",
      "what": "One business fact's count changed.",
      "file": "https://crawlcheck.io/conformance/tampered-lineage-leaf.json?sha=3a65b17e9fdd5840",
      "sha256": "3a65b17e9fdd584081f65f719dbf8b5dfaacde7108b87e4c41c115d64edd0fc8",
      "bytes": 31864,
      "expected": {
        "verified": false,
        "checks": {
          "manifest_hash": true,
          "key_id": true,
          "signature": true,
          "subject_hash": true,
          "subject_binds": true,
          "merkle_path": true,
          "ots_commits_root": true,
          "ots_attestations": true,
          "experience_root": true,
          "decision_root": true,
          "lineage_root": false
        }
      },
      "published_kid": null,
      "must_reject": null
    },
    {
      "name": "duplicated-experience-leaf",
      "group": "tampered",
      "kind": "bundle",
      "what": "The fetch whose leaf sorts last is listed twice. The Merkle root is IDENTICAL (an odd node pairs with itself), so only the leaf count can catch it; the body also no longer matches its signed digest.",
      "file": "https://crawlcheck.io/conformance/duplicated-experience-leaf.json?sha=753127a72b109cd7",
      "sha256": "753127a72b109cd75fc9bfe69d0b248cc1a7ebd49dffcfdc785af7f61089820c",
      "bytes": 32431,
      "expected": {
        "verified": false,
        "checks": {
          "manifest_hash": false,
          "key_id": true,
          "signature": true,
          "subject_hash": true,
          "subject_binds": true,
          "merkle_path": true,
          "ots_commits_root": true,
          "ots_attestations": true,
          "experience_root": false,
          "decision_root": true,
          "lineage_root": true
        }
      },
      "published_kid": null,
      "must_reject": null
    },
    {
      "name": "extra-decision-leaf",
      "group": "tampered",
      "kind": "bundle",
      "what": "A decision the scan never made is added to the leaves.",
      "file": "https://crawlcheck.io/conformance/extra-decision-leaf.json?sha=2e615678fb2690c1",
      "sha256": "2e615678fb2690c18c4b892156b860a38ad9465cee27081a0045795f227743f4",
      "bytes": 32068,
      "expected": {
        "verified": false,
        "checks": {
          "manifest_hash": true,
          "key_id": true,
          "signature": true,
          "subject_hash": true,
          "subject_binds": true,
          "merkle_path": true,
          "ots_commits_root": true,
          "ots_attestations": true,
          "experience_root": true,
          "decision_root": false,
          "lineage_root": true
        }
      },
      "published_kid": null,
      "must_reject": null
    },
    {
      "name": "missing-experience",
      "group": "tampered",
      "kind": "bundle",
      "what": "One fetch removed from the manifest body (the body then no longer matches its signed digest either).",
      "file": "https://crawlcheck.io/conformance/missing-experience.json?sha=9819f56bbe533a35",
      "sha256": "9819f56bbe533a35aa162e0131b57d1f2836d0c13a189d0733b9fbe74a84df91",
      "bytes": 31327,
      "expected": {
        "verified": false,
        "checks": {
          "manifest_hash": false,
          "key_id": true,
          "signature": true,
          "subject_hash": true,
          "subject_binds": true,
          "merkle_path": true,
          "ots_commits_root": true,
          "ots_attestations": true,
          "experience_root": false,
          "decision_root": true,
          "lineage_root": true
        }
      },
      "published_kid": null,
      "must_reject": null
    },
    {
      "name": "receipt-valid",
      "group": "receipt",
      "kind": "receipt",
      "what": "A remediation receipt signed with the observer's published key.",
      "file": "https://crawlcheck.io/conformance/receipt-valid.json?sha=73c79929fa371b60",
      "sha256": "73c79929fa371b60b7d46004707c9fc2a5a0fcb74ecab386735d18566677ac49",
      "bytes": 4841,
      "expected": {
        "verified": true,
        "checks": {
          "receipt_hash": true,
          "key_id": true,
          "signature": true,
          "key_published": null,
          "order": true
        }
      },
      "published_kid": "hcIAczGf-8EFBnkunmZlvFWnD2nHHeHeC9cM4BTiBVo",
      "must_reject": null
    },
    {
      "name": "receipt-tampered",
      "group": "receipt",
      "kind": "receipt",
      "what": "The verdict of a signed receipt changed.",
      "file": "https://crawlcheck.io/conformance/receipt-tampered.json?sha=b7f0d03466304b47",
      "sha256": "b7f0d03466304b4767194b9275737b0d12480c351862a19495b27bbab53a7a6e",
      "bytes": 4840,
      "expected": {
        "verified": false,
        "checks": {
          "receipt_hash": false,
          "key_id": true,
          "signature": false,
          "key_published": null,
          "order": true
        }
      },
      "published_kid": null,
      "must_reject": null
    },
    {
      "name": "receipt-foreign-key",
      "group": "receipt",
      "kind": "receipt",
      "what": "A doctored receipt re-signed with someone else's key. Every check a verifier can run offline passes; its key id is not the published one. A conforming CONSUMER must reject it by comparing key ids with the directory.",
      "file": "https://crawlcheck.io/conformance/receipt-foreign-key.json?sha=5bf2d5d403efda7e",
      "sha256": "5bf2d5d403efda7ecbe7c636eb351d5eb7bb1472321c5901679db404d855d7bc",
      "bytes": 4701,
      "expected": {
        "verified": true,
        "checks": {
          "receipt_hash": true,
          "key_id": true,
          "signature": true,
          "key_published": null,
          "order": true
        }
      },
      "published_kid": "hcIAczGf-8EFBnkunmZlvFWnD2nHHeHeC9cM4BTiBVo",
      "must_reject": "the receipt's key id RBj_N824fPZv7FrIuMSNHFizOevhnUneNWoQNqz2pDs is not in https://crawlcheck.io/.well-known/http-message-signatures-directory"
    }
  ]
}