{
  "kind": "Eziah-manifest-signature-verification/1",
  "candidate_id": "EZA-001-R001-rc.9",
  "manifest_sha256": "fc44b015cbf152aef4e4cc25bc0bdc6d58f6763a0af871b81795de04e32f8f3e",
  "public_key_id": "CFC656D308ECD752",
  "public_key_base64": "RWRS1+wI01bGz7h6vYSR4m9shqB2/q8FiIpbY8tSgDQnhNZ4qzp+0mSA",
  "public_key_file": {
    "file": "eziah-release-2026-01.pub",
    "bytes": 113,
    "sha256": "df3a3e0aa9f6368906f7004083e8abab76e8cb98b603ab0e9146e68abbdf0311"
  },
  "signature_file": {
    "file": "MANIFEST.json.minisig",
    "bytes": 324,
    "sha256": "bc6e7808a6e2cfc9fecfa790d6e69bed85ff5712015d892a0e667004a2d6144e"
  },
  "trusted_comment": "Eziah EZA-001 R001; candidate EZA-001-R001-rc.9; MANIFEST.json",
  "manifest_signature": "PASS",
  "comment_signature": "PASS",
  "full_candidate_inventory": {
    "status": "PASS",
    "regular_files": 125
  },
  "independent_verification_method": "Ed25519 verification of the Minisign ED signature over BLAKE2b-512(manifest), and of the comment signature over signature bytes plus trusted comment UTF-8 bytes.",
  "verification_environment": {
    "python": "3.12.14 (main, Aug 25 2026, 14:00:49) [Clang 22.1.3 ]",
    "platform": "Linux-6.18.44-x86_64-with-glibc2.39",
    "cryptography": "46.0.0",
    "minisign_cli_used_here": false
  },
  "negative_controls": {
    "changed_manifest_rejected": true,
    "changed_comment_rejected": true,
    "changed_signature_rejected": true
  },
  "owner_machine_result": "Owner supplied Minisign success output; uploaded signature independently verifies here.",
  "owner_key_custody": "Owner reported encrypted key on external drive and separately stored password; physical custody and backup recovery not independently verified.",
  "signature_scope": "Exact MANIFEST.json and trusted comment only; candidate files bound through manifest hashes. External publication metadata and review records are not covered by this signature.",
  "public_identity_trust": "Key supplied by the owner in this conversation. Public distribution still needs an independently authenticated owner channel.",
  "not_claimed": [
    "independent implementation",
    "authenticated execution provenance",
    "general production readiness",
    "website acceptance",
    "public deployment"
  ]
}