Auditable architecture · Unit 10 of 13
Signed provenance: who may write the law
Integrity isn't authenticity. Integrity proves the hashes are self-consistent — but an actor with write access recomputes the hashes and passes. Authenticity proves PROVENANCE: the law was written by someone with the authority to write it, and that is shown by the SIGNATURE of a deployed authority, not by recomputable content. You trust the authority's DURABLE identity (its primary/master key), not a rotating sign subkey.
By the end, you'll be able to
- Tell authenticity (who signed the law) apart from integrity (the hashes match)
- Spot the fail-open of a self-check that roots its trust in the working tree, and anchor it to the committed line
Understand
Integrity isn't authenticity. Integrity proves the hashes are self-consistent — but an actor with write access recomputes the hashes and passes. Authenticity proves PROVENANCE: the law was written by someone with the authority to write it, and that is shown by the SIGNATURE of a deployed authority, not by recomputable content. You trust the authority's DURABLE identity (its primary/master key), not a rotating sign subkey.
The self-check fail-open: a gate that reads its trust root — the authority list and the boundary it verifies from — from the WORKING TREE can be neutralized by the very commit under review, which rewrites the list to include itself or empties the range being verified. The fix is to anchor to the COMMITTED line (read the root from a trusted reference, not the mutable working tree) and to validate the boundary is a real ancestor: the commit being judged can't move the ground it's judged on.
A self-check has no out-of-band trust root: it reads everything from the repo it inspects. So the PRODUCER (the repo's own gate) is fail-closed ROOTED AT its trusted line — it catches working-tree and proposal-branch tampering, but an actor who ALREADY controls that line can rewrite the root. The ABSOLUTE wall is the CONSUMER, whose trust root lives OUTSIDE the workspace, unreachable by the commits it authorizes. Name the scope honestly: don't claim absolute where you only have rooted.
See
See the anchored truth
The atlas shows that the governing law is the contract that runs, not the one left written in the working tree: the same discipline that makes an authenticity gate read the committed line instead of the working tree.
Do
Run the practice in your checkout and keep the output as evidence.
Verify
Show that you can apply the unit. Progress only advances once you pass the assessment.
Criteria assessed
- Explain why recomputing the hashes proves integrity but not authenticity.
- Say what a self-check gains by reading its trust root from the committed line instead of the working tree — and what it still can't guarantee.
Primary sources
Content verified: 2026-07-18