How verification works¶

A conformant verifier runs the same sequence everywhere, failing closed at the first failure. It is operator-independent by design — nothing in it is specific to who runs it.

Grant presented at the point of usechecked fresh every time — never cached (SPEC-CORE §5)

1 · Signaturesconsent + issuance both verify over the canonical grant

✗REFUSED_OUT_OF_SCOPEmalformed-signatures · consent-signature-invalid · issuance-signature-invalid

2 · Validity windownbf ≤ now ≤ exp

✗REFUSED_OUT_OF_SCOPEgrant-outside-validity-window

3 · Statusfetch the signed list, verify its signature, read the bit — fail closed

✗REFUSED_REVOKEDstatus-signature-invalid-fail-closed · status-list-stale-fail-closed · asset-revoked

4 · Scopepurpose in purposes, not in exclusions; territory permitted

✗REFUSED_OUT_OF_SCOPEpurpose-not-granted · excluded · territory-not-granted

5 · Leasewithin the lease window and under the spend cap

✗REFUSED_LEASE_EXHAUSTEDlease-outside-window · lease-cap-exceeded

all gates pass

✔ PERMITTED_CONFORMANTsigned decision record emitted

pass / permittedfail / refusedinfo / neutral

H2A verification runs the same five gates everywhere, in order, failing closed at the first failure. Green is the single pass path; any gate can branch to a red REFUSED_* decision, labelled with the reason code the reference verifier emits.

Signatures. Verify the two detached signatures — consent (subject / custodian) and issuance (issuer) — over the canonical Grant.
Validity window. The Grant must be within nbf…exp.
Status. Fetch the signed status list (or a mirror) and verify its signature against the issuer's public key. Unreachable, unsigned, wrongly-signed, or expired ⇒ fail closed. Bit set ⇒ REFUSED_REVOKED. The verifier is fetch-and-verify only: it is never the revocation authority and serves no status list of its own (ADR-009).
Scope. Requested purpose in purposes, not in exclusions; territory permitted.
Lease. Within the lease window and under the spend cap.

Success yields PERMITTED_CONFORMANT; anything else yields the matching REFUSED_*. The executable form of this is reference/h2a_ref/verify.py — the demo issues a signed grant and shows permit, out-of-scope refusal, and post-revocation refusal.