Artifact Description [13c21b5eb8]

Artifact 13c21b5eb80b89e81b167bc1e32c9105f8debcd2a538fc66995dae3b0d26fabf:

• File internal/sync/horizon_verify.go
  • 2026-10-24 13:16:26 — part of check-in [451d368554] on branch main — feat(horizon): bind each seed to its horizon and sign seeds apart

    Every seed an origin mints now carries T +horizon-seed <C> <rule> (draft-fossil-horizon-00 §5.2.1), inside the signed bytes. The card is not counted as a tag in force, Mint never derives a horizon-seed row into a seed, and Apply skips the card.

    Before a clone holds a seed, signed or not, it checks the seed against its store cone (§5.2.4). The seed must carry exactly one binding card naming the store's C and rule, and its D must be no earlier than the held seed's. A seed that fails is refused as a wrongly signed one and the clone falls back to the content horizon. A deepen discards the held seed first, so the floor restarts at the new C. A held seed that is no longer bound is discarded when it is next applied.

    Seeds are signed with their own horizon-seed-command and are no longer signed by clearsign and pgp-command. SSH seed signatures use the fossil-horizon-seed namespace. clearsign.Key.Verify now takes the namespace, and check-in verification keeps fossilscm.

    Adds 9 conformance cases and flips HZ-5.2-8, HZ-5.2-11, HZ-5.2-12 and HZ-5.2-13 to covered. The zit interop gate moves to zit 0.7.1, whose seeds are byte-identical with ours. (user: [email protected], size: 4482) [annotate] [blame] [check-ins using]

  • 2026-10-24 13:29:08 — part of check-in [b35d577a54] on branch main — Merge pull request #478 from danmestas/feat/horizon-seed-binding

    feat(horizon): bind each seed to its horizon and sign seeds apart (user: [email protected], size: 4482) [annotate] [blame] [check-ins using]