implementation-guide.html

<!doctype html>
<html lang="en">
<head>
  <meta charset="utf-8">
  <meta name="viewport" content="width=device-width, initial-scale=1">
  <title>VHCEL — Short Implementation Guide</title>
  <style>
    :root { color-scheme: light dark; }
    body { max-width: 44rem; margin: 3rem auto; padding: 0 1.25rem; font: 17px/1.6 system-ui, sans-serif; }
    h1 { font-size: 2rem; line-height: 1.2; }
    li { margin-block: 1rem; padding-left: .25rem; }
    a { color: light-dark(#005a9c, #8dcaff); }
    code { font-size: .9em; }
    footer { margin-top: 2rem; border-top: 1px solid #888; padding-top: 1rem; }
  </style>
</head>
<body>
  <header>
    <p><a href="index.html">VHCEL specification</a></p>
    <h1>Short Implementation Guide</h1>
    <p>Prototype checklist for the current draft. The cryptographic binding is
    still open; this guide does not define an interoperable wire format.</p>
  </header>
  <main>
    <ol>
      <li><strong>Choose a binding and profile.</strong> Specify serialization,
      protected fields, canonicalization, digest encoding, SCID derivation,
      proof coverage, authorization, and state-transition rules. Define any
      pre-rotation and witness requirements.</li>
      <li><strong>Create genesis.</strong> Establish initial state and control
      policy. Derive and insert the mandatory <code>scid</code>, handling
      self-references according to the binding. Add required proofs. Genesis
      has no <code>previousEvent</code>.</li>
      <li><strong>Append an event.</strong> Set <code>previousEvent</code> to the
      calculated digest of the completed preceding event. Add the operation
      and proofs required by prior authorization and the profile. A stored
      <code>eventId</code> is unnecessary.</li>
      <li><strong>Verify before accepting state.</strong> Recompute the genesis
      SCID; compare it with the supplied value and any trusted expected SCID.
      Check every predecessor link, authorization proof, required external datum,
      rotation constraint, witness policy, and state transition. Reject updates
      after permanent deactivation. Commit state only after all checks pass.</li>
      <li><strong>Report and test.</strong> Return the SCID, verified state, final
      event digest, and verification scope. Test valid histories plus altered
      genesis, broken links, unauthorized updates, and missing required data.</li>
    </ol>
    <p><strong>Trust boundary:</strong> An independently trusted expected SCID
    detects history replacement. A SCID obtained with an untrusted history
    does not. Valid history alone proves neither freshness nor absence of forks.</p>
  </main>
  <footer>
    <a href="index.html#history-verification">Full verification algorithm</a>
    · <a href="index.html#genesis-substitution">SCID security</a>
  </footer>
</body>
</html>