[
  {
    "name": "sig-001-issuer-attestation",
    "description": "What the issuer signs to issue env-001: the canonical encoding of {cargo, issuer, nonce, recipient} (envelope wire format §3). The key is RFC 8032's first test key, and Ed25519 is deterministic, so this is the one signature that key makes over this message — the 64 bytes after the algorithm identifier in env-001's provenance signature.",
    "message_hex": "a465636172676fa26474797065016562797465734da1666d6963726f731a05f5e100656e6f6e636550dcc74ebbcedebda361fb18a7abec95d96669737375657278354269343733616278673233626d666e32617564337136786f743761706d3364366f6361357a6a6161646c6c6969726863366976637169726563697069656e747835427a7870656366786d3370646c666536786d36707334356b7668647869656c6f35356b74736a356e646b6e7968676e7237326f7161",
    "signing_key_seed": "9d61b19deffd5a60ba844af492ec2cc44449c5697b326919703bac031cae7f60",
    "verifying_key": "d75a980182b10ab7d54bfed3c964073a0ee172f3daa62325af021a68f707511a",
    "signature": "88d2bbf7bf3ea95bb33866235bae150ac65c7371bc2776f17eb0944884cc8a4e7d402947d334d07e871acd0c305e6791d6e9b5747a683b6c58fc81f21dbcdd09",
    "expected_verify": true,
    "error": null
  },
  {
    "name": "sig-002-key-event",
    "description": "Alice's inception event (kel-002, event 0), signed by the key it reveals: RFC 8032's second test key. The message is the event's canonical encoding (identity spec §3.5).",
    "message_hex": "ab61618061647835457a7870656366786d3370646c666536786d36707334356b7668647869656c6f35356b74736a356e646b6e7968676e7237326f716161697835427a7870656366786d3370646c666536786d36707334356b7668647869656c6f35356b74736a356e646b6e7968676e7237326f7161616b815821013d4017c3e843895a92b70aa74d1b7ebc9c982ccf2ec4968cc0cd55f12af4660c616e81783545716d7361776967366f7a6e6834623563626f7671756b767a78613575356a62696b6c6b726c776874646f3672627273796a666e7161706061730061746369637061766b534259544531304a534f4e626b7401626e7401",
    "signing_key_seed": "4ccd089b28ff96da9db6c346ec114e0f5b8a319f35aba624da8cf6ed4fb8a6fb",
    "verifying_key": "3d4017c3e843895a92b70aa74d1b7ebc9c982ccf2ec4968cc0cd55f12af4660c",
    "signature": "c0999c04eee90f056e29a2753f1a90665636394e819578d4cc2a2a40afb841b9a89a759b881adc095be848ba4ce9be9f64da3f4efcb5f935c0c20723ab68da07",
    "expected_verify": true,
    "error": null
  },
  {
    "name": "sig-003-message-swapped",
    "description": "sig-002's signature presented with sig-001's message: an adversary swaps the message and forwards the original signature. The signature is well-formed but binds another message, so verification MUST fail.",
    "message_hex": "a465636172676fa26474797065016562797465734da1666d6963726f731a05f5e100656e6f6e636550dcc74ebbcedebda361fb18a7abec95d96669737375657278354269343733616278673233626d666e32617564337136786f743761706d3364366f6361357a6a6161646c6c6969726863366976637169726563697069656e747835427a7870656366786d3370646c666536786d36707334356b7668647869656c6f35356b74736a356e646b6e7968676e7237326f7161",
    "signing_key_seed": "4ccd089b28ff96da9db6c346ec114e0f5b8a319f35aba624da8cf6ed4fb8a6fb",
    "verifying_key": "3d4017c3e843895a92b70aa74d1b7ebc9c982ccf2ec4968cc0cd55f12af4660c",
    "signature": "c0999c04eee90f056e29a2753f1a90665636394e819578d4cc2a2a40afb841b9a89a759b881adc095be848ba4ce9be9f64da3f4efcb5f935c0c20723ab68da07",
    "expected_verify": false,
    "error": "signature_invalid"
  },
  {
    "name": "sig-004-wrong-key",
    "description": "sig-002's message and signature, presented with another key — the one the all-zero seed derives. The signature is valid for the key that made it, which is not this one, so verification MUST fail.",
    "message_hex": "ab61618061647835457a7870656366786d3370646c666536786d36707334356b7668647869656c6f35356b74736a356e646b6e7968676e7237326f716161697835427a7870656366786d3370646c666536786d36707334356b7668647869656c6f35356b74736a356e646b6e7968676e7237326f7161616b815821013d4017c3e843895a92b70aa74d1b7ebc9c982ccf2ec4968cc0cd55f12af4660c616e81783545716d7361776967366f7a6e6834623563626f7671756b767a78613575356a62696b6c6b726c776874646f3672627273796a666e7161706061730061746369637061766b534259544531304a534f4e626b7401626e7401",
    "signing_key_seed": "0000000000000000000000000000000000000000000000000000000000000000",
    "verifying_key": "3b6a27bcceb6a42d62a3a8d02a6f0d73653215771de243a63ac048a18b59da29",
    "signature": "c0999c04eee90f056e29a2753f1a90665636394e819578d4cc2a2a40afb841b9a89a759b881adc095be848ba4ce9be9f64da3f4efcb5f935c0c20723ab68da07",
    "expected_verify": false,
    "error": "signature_invalid"
  },
  {
    "name": "sig-005-malformed-signature",
    "description": "sig-002's signature cut to 63 bytes. It is refused as malformed before any cryptography runs, and an implementation MUST NOT panic on it.",
    "message_hex": "ab61618061647835457a7870656366786d3370646c666536786d36707334356b7668647869656c6f35356b74736a356e646b6e7968676e7237326f716161697835427a7870656366786d3370646c666536786d36707334356b7668647869656c6f35356b74736a356e646b6e7968676e7237326f7161616b815821013d4017c3e843895a92b70aa74d1b7ebc9c982ccf2ec4968cc0cd55f12af4660c616e81783545716d7361776967366f7a6e6834623563626f7671756b767a78613575356a62696b6c6b726c776874646f3672627273796a666e7161706061730061746369637061766b534259544531304a534f4e626b7401626e7401",
    "signing_key_seed": "4ccd089b28ff96da9db6c346ec114e0f5b8a319f35aba624da8cf6ed4fb8a6fb",
    "verifying_key": "3d4017c3e843895a92b70aa74d1b7ebc9c982ccf2ec4968cc0cd55f12af4660c",
    "signature": "c0999c04eee90f056e29a2753f1a90665636394e819578d4cc2a2a40afb841b9a89a759b881adc095be848ba4ce9be9f64da3f4efcb5f935c0c20723ab68da",
    "expected_verify": false,
    "error": "malformed_signature"
  },
  {
    "name": "sig-006-non-canonical-s-rejected",
    "description": "sig-002's signature with its scalar S replaced by S + L: the same scalar, written outside [0, L). RFC 8032 §5.1.7 requires refusing it; accepting it would make signatures malleable, giving a second valid-looking signature for one message and key.",
    "message_hex": "ab61618061647835457a7870656366786d3370646c666536786d36707334356b7668647869656c6f35356b74736a356e646b6e7968676e7237326f716161697835427a7870656366786d3370646c666536786d36707334356b7668647869656c6f35356b74736a356e646b6e7968676e7237326f7161616b815821013d4017c3e843895a92b70aa74d1b7ebc9c982ccf2ec4968cc0cd55f12af4660c616e81783545716d7361776967366f7a6e6834623563626f7671756b767a78613575356a62696b6c6b726c776874646f3672627273796a666e7161706061730061746369637061766b534259544531304a534f4e626b7401626e7401",
    "signing_key_seed": "4ccd089b28ff96da9db6c346ec114e0f5b8a319f35aba624da8cf6ed4fb8a6fb",
    "verifying_key": "3d4017c3e843895a92b70aa74d1b7ebc9c982ccf2ec4968cc0cd55f12af4660c",
    "signature": "c0999c04eee90f056e29a2753f1a90665636394e819578d4cc2a2a40afb841b9956e6bf8a27dee613185405d2be39db464da3f4efcb5f935c0c20723ab68da17",
    "expected_verify": false,
    "error": "signature_invalid"
  },
  {
    "name": "sig-007-non-canonical-key-rejected",
    "description": "A verifying key spelled with y = p + 3: an out-of-range encoding of the valid, large-order point with y = 3. RFC 8032 §5.1.3 requires decoding to fail when y is not below p, so the key is refused as malformed before any verification runs — one key has one spelling. There is no seed: no key pair has this spelling.",
    "message_hex": "ab61618061647835457a7870656366786d3370646c666536786d36707334356b7668647869656c6f35356b74736a356e646b6e7968676e7237326f716161697835427a7870656366786d3370646c666536786d36707334356b7668647869656c6f35356b74736a356e646b6e7968676e7237326f7161616b815821013d4017c3e843895a92b70aa74d1b7ebc9c982ccf2ec4968cc0cd55f12af4660c616e81783545716d7361776967366f7a6e6834623563626f7671756b767a78613575356a62696b6c6b726c776874646f3672627273796a666e7161706061730061746369637061766b534259544531304a534f4e626b7401626e7401",
    "signing_key_seed": null,
    "verifying_key": "f0ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff7f",
    "signature": "c0999c04eee90f056e29a2753f1a90665636394e819578d4cc2a2a40afb841b9a89a759b881adc095be848ba4ce9be9f64da3f4efcb5f935c0c20723ab68da07",
    "expected_verify": false,
    "error": "malformed_verifying_key"
  }
]