[kinqsradio]

Summary

• orbyn_translog::verify: pure checks of a head (pinned log key, witness threshold, freshness), its progress (rollback, fork, consistency) and an account's chain.
• orbyn_client::verify_service_key: parses the public API's JSON, checks the chain's certifications, retirement, pinned identity signature and that the offered certification is the log's newest. Escrow only on Ok.
• Trust on first use: known_key is the only check that catches a second key certified for the account (it has its own valid chain). None accepts the first key the log agrees with; 8e must store the verified key and gossip it, and pass it every time. A different one is KeyChanged.
• Refuses any certification after a retirement, an equal identity version (rotation must rise), more than 2x pinned cosignatures and more than 10 entry pages. A witness time ahead of the device clock is its own verdict, ClockAhead.
• test-support in-memory log; end-to-end test against the real service's bytes.
• Deviation from the design: freshness uses the witness time of the threshold-th newest distinct pinned witness, not the newest, so one witness cannot make an old head look fresh. Docs updated.

Closes #

Testing

• CI covers the rest.
• End-to-end test (Postgres, fresh database): the verifier accepts the service's real bytes and refuses a wrong identity, log key, witness set and a stale head.
• 31 hand-made mutations of the verifier, the six new checks included: 28 killed; 1 survivor now killed by a new test pinning the 2 h and 5 min limits; 2 equivalent (log-index order is kept as a second line: witnesses replay in log order) (redundant pinned-witness filter, log-index order already implied by the hash chain).
• cargo check --target wasm32-unknown-unknown as CI runs it; full workspace with --include-ignored.
• Not tested: none

Co-authors

none

AI usage

• Written by hand, with no AI
• Harness and version: Claude Code 2.1.317
• Models: claude-sonnet-5-5 (implementation, tests, docs)
• Effort: medium
• Human role: set the design and the freshness deviation; reviewed the plan
• Sources: none

Checklist

• Works on Windows, macOS and Linux
• docs/architecture.md with any rule change; generated wire types with any contract change
• No copied source, secrets, credentials or personal data; no AI attribution in commits, title or branch