What does a note's signature commit to, and when does it seal? #229

Activity

1. brianorwhatever

   added

   wayfinder:grilling

   on Sep 2, 2026
2. brianorwhatever

   added a parent issue on Sep 2, 2026

   • Wayfinder: notes on boop — signed, publishable, verifiable #227
3. brianorwhatever

   marked this as blocked by 2 issues on Sep 2, 2026

   • Where does a note's prose live in the lists model? #228
   • How does CEL handle a large, frequently-mutated text field? #233
4. brianorwhatever

   marked this as blocking on Sep 2, 2026

   • What does a stranger see when verifying a published note? #232
5. brianorwhatever

   self-assigned this

   on Sep 30, 2026
6. brianorwhatever commented on Sep 30, 2026

   

   brianorwhatever

   on Sep 30, 2026

   ContributorAuthor

   More actions

   Resolution

   • A note is sealed on publish only. Each publish or re-publish appends one version of the body resource (Where does a note's prose live in the lists model? #228). Drafts are never sealed.
   • What's kept: the latest sealed version's text stays inline in the envelope, so verifying the current note needs nothing else. Older versions are stripped to their hash, and their text is stored in the bucket keyed by sha256 (the pattern attachments already use), so the full history can still be checked. The research (How does CEL handle a large, frequently-mutated text field? #233) confirmed that the SDK verifies hash-only resources and that keeping every version inline breaks the 1 MiB limit.
   • What a verified note tells a reader: this exact text was sealed by the author's key at publish time N, and the earlier published versions existed with these hashes (and this text, fetched from the bucket).
   • The device-bound key is a separate problem. Signing keys live only in the creating device's localStorage, so a note can only be sealed from that device. That's split into its own in-scope ticket. It decides who can seal, not what a seal commits to.
   • Follows from this: because the log can't be compacted and each append re-verifies the whole log, append cost grows with the number of publishes, not the number of edits. That's acceptable.
7. brianorwhatever

   closed this as completedon Sep 30, 2026