Specification 0.15: the release object, a release in hand and step 9.c

specVersion is 0.15 and testdata is synced with datekeys-go at 3c3e737
(branch v0.15): every file changes its spec field, mutations.json gains the
field source and four cases, and vectors/release.json and releases/ are new
(142 files).

release.dart, as provider of Go at 2eeca40, with its texts: encodeRelease
and decodeRelease of the release object (spec v0.15, 47.1) with the CBOR
profile of the library, its size first, then its type and version, then its
schema; parseRelease, which also reads drand's JSON with the rules of
encoding/json of Go for its three fields; verifyRelease checks the chain hash
a release names, ERR_PROFILE_MISMATCH, before its round and its signature;
ReleaseSupplier, EncodedRelease and supplyRelease, a release in the caller's
hand; and ReleaseArchive, the lookup of a local release archive (50), whose
failures are ERR_RELEASE_UNAVAILABLE at step 9.

open: OpenOptions.release takes a release in hand, exclusive with source. It
is not compared with the clock (step 9.c); Opened.clockBehind reports a clock
behind it, and the step 9 detail is Go's. Step 10 starts with the layers of
the object. A network source keeps its behaviour. Opened.release carries the
chain hash of the pinned profile.

Vectors: mutation_texts.json is regenerated with tool/mutation_go_texts.go,
which now replays each case with its source as testkit does: 149 cases
change only the detail of step 9 ("release supplied by the caller"), the
case "round not reached yet" now opens, and the four new cases are added.
release_vectors.json, the open vectors, and the formats, locator, security
and seal vectors come out the same at 3c3e737 but for their spec field.
tool/release_archive_go_texts.go writes the texts of provider.Archive on
edited archives; tool/release_copy.dart copies release.json, releases/ and
those texts to release.g.dart for the tests compiled to JavaScript.

errors_spec_test reads the spec at the commit of testdata/SOURCE.json rather
than at its tag.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

lib/datekeys.dart

@@ -84,12 +84,26 @@ export 'src/random.dart' show RandomSource, secureRandom;
 export 'src/recipient.dart' show X25519Recipient, checkX25519Recipient;
 export 'src/release.dart'
     show
+        EncodedRelease,
         PinnedProfile,
         Release,
+        ReleaseArchive,
         ReleaseSource,
+        ReleaseSupplier,
+        decodeRelease,
+        encodeRelease,
         fetchRelease,
+        maxReleaseJsonSize,
+        maxReleaseObjectSize,
+        maxReleaseSignatureLength,
+        parseRelease,
         quicknetScheme,
+        releaseArchiveSchemaVersion,
+        releaseArchiveTypeTag,
+        releaseSchemaVersion,
+        releaseTypeTag,
         suppliedRelease,
+        supplyRelease,
         verifyRelease;
 export 'src/security.dart';
 export 'src/securitycms.dart';

lib/src/open.dart

@@ -56,10 +56,12 @@ import 'verdicts.dart';
 /// The options of [openCapsule] and [openCapsuleSource], as OpenOptions of
 /// Go.
 final class OpenOptions {
-  /// The options of an opening with the release [source] and the clock
-  /// [now].
+  /// The options of an opening with the clock [now] and exactly one of the
+  /// release [source], a network source, and the [release] in the caller's
+  /// hand.
   const OpenOptions({
-    required this.source,
+    this.source,
+    this.release,
     required this.now,
     this.registry,
     this.extensions,
@@ -78,11 +80,23 @@ final class OpenOptions {
   /// the opening reports ERR_RELEASE_UNAVAILABLE at step 9 when none is
   /// valid (see [ReleaseSource]). Whatever it throws is reported at step 9
   /// with ERR_RELEASE_UNAVAILABLE as the only code, keeping only its text
-  /// ([fetchRelease]).
-  final ReleaseSource source;
-
-  /// The clock. No release is requested for a round whose time has not
-  /// come (spec §63 step 9.c).
+  /// ([fetchRelease]). Exactly one of [source] and [release] is set.
+  final ReleaseSource? source;
+
+  /// A release that the caller has in hand, the alternative to [source]
+  /// (spec v0.15, §49, §63 step 9.c): a release object or drand's JSON with
+  /// [EncodedRelease], or a local archive with [ReleaseArchive]. It makes no
+  /// network request, so the opening asks it for the release without
+  /// comparing [now] with the round time, and reports a clock behind it in
+  /// [Opened.clockBehind]. What it throws is reported at step 9 with
+  /// ERR_RELEASE_UNAVAILABLE as the only code ([supplyRelease]); the release
+  /// it supplies is read with [parseRelease] and verified at step 10, with
+  /// the codes of that step.
+  final ReleaseSupplier? release;
+
+  /// The clock. No release is requested from a [source] for a round whose
+  /// time has not come (spec §63 step 9.c); a [release] in hand is not
+  /// compared with it.
   final Instant Function() now;
 
   /// The pinned profiles; the default registry, Quicknet, when null.
@@ -153,6 +167,7 @@ final class Opened {
     required this.error,
     required this.refusal,
     required this.release,
+    required this.clockBehind,
     required this.payloadLength,
     required this.padding,
     required this.paddedLength,
@@ -177,9 +192,16 @@ final class Opened {
   /// caller refused to publish the files. Null otherwise.
   final Object? refusal;
 
-  /// The release, once verified at step 10.
+  /// The release, once verified at step 10, with the chain hash of the
+  /// pinned profile: [encodeRelease] gives its release object.
   final Release? release;
 
+  /// The release was in the caller's hand ([OpenOptions.release]) and the
+  /// clock was before the round time of the DateKey: the release proves the
+  /// round was published, so the clock is probably behind, which a reader
+  /// may say (spec v0.15, §63 step 9.c).
+  final bool clockBehind;
+
   /// L, once the capsule opened: the bytes of content written to the output
   /// in formats 1 and 2, or the length of BODY in format 3.
   final int? payloadLength;
@@ -421,6 +443,13 @@ final class _Failed implements Exception {
 }
 
 Future<Opened> _open(_Input input, OpenOptions o) async {
+  if ((o.source == null) == (o.release == null)) {
+    final e = ArgumentError(
+      'open: set exactly one of OpenOptions.source and OpenOptions.release',
+    );
+    await _abortQuietly(o.output, e);
+    throw e;
+  }
   if (o.accessKey != null && o.accessKeyFile != null) {
     final e = ArgumentError(
       'open: set OpenOptions.accessKey or accessKeyFile, not both',
@@ -475,6 +504,7 @@ final class _Run {
   late List<CheckResult> _checks;
   late Inspection _inspection;
   Release? _release;
+  bool _clockBehind = false;
   int? _payloadLength;
   PaddingRule? _padding;
   int? _paddedLength;
@@ -509,6 +539,7 @@ final class _Run {
       error: error,
       refusal: _refusal,
       release: _release,
+      clockBehind: _clockBehind,
       payloadLength: error == null && _refusal == null ? _payloadLength : null,
       padding: _padding,
       paddedLength: _paddedLength,
@@ -629,37 +660,67 @@ final class _Run {
       );
     }
 
-    // Step 9.c and the release, never before its round time. A network
-    // source has verified each response with the rules of step 10 and
-    // discarded the invalid ones; whatever the failure of the source, it is
+    // Step 9.c and the release. A network source is never asked before the
+    // round time; a release in hand is not compared with the clock, whose
+    // being behind it is only reported (spec v0.15). A network source has
+    // verified each response with the rules of step 10 and discarded the
+    // invalid ones; whatever the failure of the source, it is
     // ERR_RELEASE_UNAVAILABLE here.
     final unlock = _inspection.unlockAt!;
     final now = o.now();
-    if (compareInstants(now, unlock) < 0) {
-      throw _fail(
+    Release release;
+    final supplier = o.release;
+    if (supplier != null) {
+      final Uint8List encoded;
+      try {
+        encoded = await supplyRelease(supplier, p, round);
+      } on DateKeysException catch (e) {
+        throw _fail(9, 'release', e);
+      }
+      _clockBehind = compareInstants(now, unlock) < 0;
+      _pass(
         9,
         'release',
-        DateKeysException(
-          ErrorCode.releaseUnavailable,
-          'capsule: round $round is published at ${formatRfc3339(unlock)}, it '
-          'is ${formatRfc3339(now)}',
-        ),
+        _clockBehind
+            ? 'release supplied by the caller; round $round is published at '
+                  '${formatRfc3339(unlock)} and the clock says '
+                  '${formatRfc3339(now)}: it may be behind'
+            : 'release supplied by the caller',
       );
+      // Step 10 starts with the layers of the release object.
+      try {
+        release = parseRelease(encoded);
+      } on DateKeysException catch (e) {
+        throw _fail(10, 'release verification', e);
+      }
+    } else {
+      if (compareInstants(now, unlock) < 0) {
+        throw _fail(
+          9,
+          'release',
+          DateKeysException(
+            ErrorCode.releaseUnavailable,
+            'capsule: round $round is published at ${formatRfc3339(unlock)}, '
+            'it is ${formatRfc3339(now)}',
+          ),
+        );
+      }
+      try {
+        release = await fetchRelease(o.source!, p, round);
+      } on DateKeysException catch (e) {
+        throw _fail(9, 'release', e);
+      }
+      _pass(9, 'release', 'round ${release.round} obtained');
     }
-    final Release release;
-    try {
-      release = await fetchRelease(o.source, p, round);
-    } on DateKeysException catch (e) {
-      throw _fail(9, 'release', e);
-    }
-    _pass(9, 'release', 'round ${release.round} obtained');
 
-    // Step 10: verify the release locally.
+    // Step 10: verify the release locally: the chain it names, its round
+    // and its signature.
     try {
       verifyRelease(p, round, release);
     } on DateKeysException catch (e) {
       throw _fail(10, 'release verification', e);
     }
+    release = Release(release.round, release.signature, chainHash: p.chainHash);
     _release = release;
     _pass(
       10,

lib/src/release.dart

@@ -1,9 +1,14 @@
 /// Releases (spec §45 to §52): their local verification, provider.Verify of
-/// the Go reference (spec §17, §51, §63 step 10), and the sources that
-/// deliver them (provider.ReleaseSource), as release.ts of datekeys-ts.
+/// the Go reference (spec §17, §51, §63 step 10), the sources that deliver
+/// them (provider.ReleaseSource), as release.ts of datekeys-ts, and, since
+/// spec v0.15, the release object (§47.1), drand's JSON as an input of the
+/// caller, a release in the caller's hand (provider.Supplier) and the lookup
+/// of a local release archive (§50).
 ///
 /// [verifyRelease] checks, in the order of the reference and with its
 /// texts: the round against the range of the profile (ERR_DATEKEY_INVALID);
+/// the chain hash that the release names, if any, against the pinned profile
+/// (ERR_PROFILE_MISMATCH, spec v0.15);
 /// the round of the release against the expected one (ERR_ROUND_MISMATCH),
 /// before the signature; the length of the signature; the pinned public key
 /// (ERR_UNKNOWN_PROFILE if it is not the canonical encoding of a point); and
@@ -22,14 +27,19 @@
 /// public, the signature of a round once drand publishes it.
 library;
 
+import 'dart:convert';
 import 'dart:typed_data';
 
 import 'bls12381_curve.dart';
 import 'bls12381_hash.dart';
 import 'bls12381_pairing.dart';
 import 'bytes.dart';
+import 'cbor.dart';
 import 'errors.dart';
 import 'ibe.dart';
+import 'schema.dart';
+import 'sha256.dart';
+import 'source.dart';
 
 /// The drand scheme of Quicknet, the only one this library verifies.
 const quicknetScheme = 'bls-unchained-g1-rfc9380';
@@ -59,15 +69,22 @@ abstract interface class PinnedProfile {
 /// The material that satisfies a round: for drand, the BLS signature of the
 /// round.
 final class Release {
-  /// The release of [round] with [signature], which it copies.
-  Release(this.round, List<int> signature)
-    : signature = Uint8List.fromList(signature);
+  /// The release of [round] with [signature], which it copies, and the
+  /// chain it names, [chainHash], which it copies too.
+  Release(this.round, List<int> signature, {List<int>? chainHash})
+    : signature = Uint8List.fromList(signature),
+      chainHash = chainHash == null ? null : Uint8List.fromList(chainHash);
 
   /// The round.
   final int round;
 
   /// The compressed signature of the round.
   final Uint8List signature;
+
+  /// The chain the release names, key 2 of a release object (spec v0.15,
+  /// §47.1), or null when it names none, as the answer of a relay and
+  /// drand's JSON. [verifyRelease] compares it with the pinned profile.
+  final Uint8List? chainHash;
 }
 
 /// Verifies a release of [round] locally against the pinned profile [p], as
@@ -86,6 +103,14 @@ G1Point verifiedSignature(PinnedProfile p, int round, Release r) {
       'provider: round $round outside the range of ${p.id}',
     );
   }
+  final chain = r.chainHash;
+  if (chain != null && !equalBytes(chain, p.chainHash)) {
+    throw DateKeysException(
+      ErrorCode.profileMismatch,
+      'provider: release of chain ${toHex(chain)}, the pinned profile '
+      '${p.id} is chain ${toHex(p.chainHash)}',
+    );
+  }
   if (r.round != round) {
     throw DateKeysException(
       ErrorCode.roundMismatch,
@@ -194,10 +219,12 @@ abstract interface class ReleaseSource {
   Future<Release> fetch(PinnedProfile p, int round);
 }
 
-/// The source of a release that the caller supplies directly, as the
-/// official vectors do: it hands [release] over for any round, unverified,
-/// so that step 10 checks it; without a release, it has none to give
-/// (ERR_RELEASE_UNAVAILABLE).
+/// A source that hands [release] over for any round, unverified, so that
+/// step 10 checks it; without a release, it has none to give
+/// (ERR_RELEASE_UNAVAILABLE). It is a [ReleaseSource], so the opening does
+/// not ask it before the round time; a release in the caller's hand, which
+/// is not compared with the clock (spec v0.15, §63 step 9.c), is a
+/// [ReleaseSupplier] such as [EncodedRelease], given as OpenOptions.release.
 ReleaseSource suppliedRelease([Release? release]) => _Supplied(release);
 
 final class _Supplied implements ReleaseSource {
@@ -228,9 +255,14 @@ Future<Release> fetchRelease(
   ReleaseSource source,
   PinnedProfile p,
   int round,
-) async {
+) => _step9(() => source.fetch(p, round));
+
+// Whatever [body] throws, as sourceFailure of capsule.Open: a
+// DateKeysException of ERR_RELEASE_UNAVAILABLE as it is, anything else as
+// text only.
+Future<T> _step9<T>(Future<T> Function() body) async {
   try {
-    return await source.fetch(p, round);
+    return await body();
   } on Object catch (e, stack) {
     if (e is DateKeysException && e.code == ErrorCode.releaseUnavailable) {
       rethrow;
@@ -244,3 +276,709 @@ Future<Release> fetchRelease(
     );
   }
 }
+
+// ---------------------------------------------------------------------------
+// The release object (spec v0.15, §47.1)
+
+/// The type tag of the release object.
+const releaseTypeTag = 'datekeys-release';
+
+/// The schema version of the release object.
+const releaseSchemaVersion = 1;
+
+/// The largest release object a reader decodes, in bytes (spec v0.15,
+/// §47.1): the object has no frame, so a larger input is rejected before it
+/// is decoded, with ERR_NON_CANONICAL_CBOR. No valid encoding comes close.
+const maxReleaseObjectSize = 1024;
+
+/// The longest signature of a release object: a compressed point of G2.
+/// Quicknet signs with 48 bytes, a point of G1.
+const maxReleaseSignatureLength = 96;
+
+/// The largest drand JSON that [parseRelease] reads, in bytes, the bound of
+/// a relay response in provider/drand of Go.
+const maxReleaseJsonSize = 8 << 10;
+
+// The keys of the release object, all required.
+const _releaseKeys = 5;
+
+void _encodeReleaseWire(CborEncoder e, Release r) {
+  e
+    ..map(_releaseKeys)
+    ..uint(0)
+    ..text(releaseTypeTag)
+    ..uint(1)
+    ..uint(releaseSchemaVersion)
+    ..uint(2)
+    ..bstr(r.chainHash!)
+    ..uint(3)
+    ..uint(r.round)
+    ..uint(4)
+    ..bstr(r.signature);
+}
+
+DateKeysException _nonCanonical(String context) =>
+    DateKeysException(ErrorCode.nonCanonicalCbor, context);
+
+// Reads the map with every CDDL rule of the release object, all of them
+// ERR_NON_CANONICAL_CBOR: what each field means against the pinned profile
+// and the DateKey is checked by verifyRelease, at step 10.
+Release _decodeReleaseWire(CborDecoder d) {
+  final pairs = d.map(_releaseKeys);
+  if (pairs != _releaseKeys) {
+    throw _nonCanonical('$pairs keys, want all $_releaseKeys');
+  }
+  late Uint8List chainHash;
+  late int round;
+  late Uint8List signature;
+  for (var want = 0; want < _releaseKeys; want++) {
+    final k = d.key();
+    if (k != want) throw _nonCanonical('key $k where key $want was expected');
+    inKey(k, () {
+      switch (want) {
+        case 0:
+          d.text(releaseTypeTag.length);
+        case 1:
+          d.uint(releaseSchemaVersion);
+        case 2:
+          chainHash = d.bstr(32, 32);
+        case 3:
+          round = d.uint();
+          if (round == 0) throw _nonCanonical('round 0');
+        default:
+          signature = d.bstr(1, maxReleaseSignatureLength);
+      }
+    });
+  }
+  d.endMap();
+  return Release(round, signature, chainHash: chainHash);
+}
+
+/// The release object of [r], its chain hash, its round and its signature
+/// (spec v0.15, §47.1), as EncodeRelease of Go. It does not verify the
+/// release: [verifyRelease] does, against the pinned profile. A chain hash
+/// other than 32 bytes, a round outside 1..2^53-1 or a signature outside
+/// 1..96 bytes is ERR_NON_CANONICAL_CBOR.
+Uint8List encodeRelease(Release r) {
+  final chain = r.chainHash;
+  if (chain == null || chain.length != 32) {
+    throw _nonCanonical(
+      'provider: release object: chain hash of ${chain?.length ?? 0} bytes, '
+      'want 32',
+    );
+  }
+  if (r.round < 1 || r.round > maxSafeUint) {
+    throw _nonCanonical(
+      'provider: release object: round ${r.round} outside 1..$maxSafeUint',
+    );
+  }
+  if (r.signature.isEmpty || r.signature.length > maxReleaseSignatureLength) {
+    throw _nonCanonical(
+      'provider: release object: signature of ${r.signature.length} bytes '
+      'outside 1..$maxReleaseSignatureLength',
+    );
+  }
+  final e = CborEncoder();
+  _encodeReleaseWire(e, r);
+  return e.out();
+}
+
+/// Decodes a release object (spec v0.15, §47.1) with the layers of spec
+/// §69.1 that it has, as DecodeRelease of Go: its size, 1 to
+/// [maxReleaseObjectSize] bytes; its type and schema version
+/// (ERR_NON_CANONICAL_CBOR, then ERR_UNSUPPORTED_VERSION); its encoding and
+/// schema (ERR_NON_CANONICAL_CBOR). The release names its chain, which
+/// [verifyRelease] checks against the pinned profile at step 10, before the
+/// round and the signature.
+Release decodeRelease(List<int> b) {
+  if (b.isEmpty || b.length > maxReleaseObjectSize) {
+    throw _nonCanonical(
+      'provider: release object of ${b.length} bytes, outside '
+      '1..$maxReleaseObjectSize',
+    );
+  }
+  return withContext('provider: release object', () {
+    checkSchema(b, releaseTypeTag, releaseSchemaVersion);
+    late Release r;
+    unmarshalCbor(
+      b,
+      (d) => r = _decodeReleaseWire(d),
+      (e) => _encodeReleaseWire(e, r),
+    );
+    return r;
+  });
+}
+
+/// Reads a release that the caller supplies, as ParseRelease of Go: drand's
+/// JSON when its first byte other than a JSON space is `{`, or else a
+/// release object, with [decodeRelease].
+///
+/// drand's JSON is the answer of a relay, `{"round": …, "signature": "…"}`,
+/// with an optional `randomness` that must be the SHA-256 of the signature,
+/// in hexadecimal; other fields are ignored. It does not name its chain, so
+/// the release has no chain hash. Any failure to read it, and an input of
+/// more than [maxReleaseJsonSize] bytes, is ERR_RELEASE_INVALID. It is an
+/// input, never written.
+Release parseRelease(List<int> b) {
+  for (final c in b) {
+    if (c == 0x20 || c == 0x09 || c == 0x0d || c == 0x0a) continue;
+    if (c == 0x7b) return _parseDrandJson(b);
+    break;
+  }
+  return decodeRelease(b);
+}
+
+DateKeysException _invalidJson(String context) =>
+    DateKeysException(ErrorCode.releaseInvalid, 'provider: drand JSON$context');
+
+// The name of a JSON key as encoding/json of Go matches it with the name of
+// a field: without case, with the two letters of Unicode that fold to an
+// ASCII letter of these names, the long s and the Kelvin sign.
+String _foldKey(String k) => k
+    .replaceAll(String.fromCharCode(0x017f), 's')
+    .replaceAll(String.fromCharCode(0x212a), 'k')
+    .toLowerCase();
+
+// Reads the JSON of a drand relay, as parseDrandJSON of Go, with the rules
+// of encoding/json for its three fields: keys without case, the last one
+// wins, null unsets round and signature and leaves randomness as it is, a
+// value of another type is an error, and round is an unsigned integer
+// written as such, without a sign, a fraction or an exponent. Its own reader
+// ([_GoJson]), because jsonDecode of Dart does not keep how a number is
+// written, and on the web reads 1000.0 as the int 1000.
+Release _parseDrandJson(List<int> b) {
+  if (b.length > maxReleaseJsonSize) {
+    throw _invalidJson(
+      ' of ${b.length} bytes, larger than $maxReleaseJsonSize',
+    );
+  }
+  final malformed = _invalidJson(': malformed, or without round or signature');
+  final List<(String, _JsonValue)> fields;
+  try {
+    fields = _GoJson(b).topObject();
+  } on FormatException {
+    throw malformed;
+  }
+  String? round;
+  String? signature;
+  var randomness = '';
+  var typeError = false;
+  for (final (key, value) in fields) {
+    switch (key) {
+      case 'round':
+        if (value.isNull) {
+          round = null;
+        } else if (value.number != null &&
+            RegExp(r'^(0|[1-9][0-9]*)$').hasMatch(value.number!)) {
+          round = value.number;
+        } else {
+          typeError = true;
+        }
+      case 'signature':
+        if (value.isNull) {
+          signature = null;
+        } else if (value.string != null) {
+          signature = value.string;
+        } else {
+          typeError = true;
+        }
+      case 'randomness':
+        if (value.string != null) {
+          randomness = value.string!;
+        } else if (!value.isNull) {
+          typeError = true;
+        }
+    }
+  }
+  if (typeError || round == null || signature == null) throw malformed;
+  // A round above 2^53-1 does not fit an int on every platform: it is an
+  // unsigned integer of Go up to 2^64-1, and no DateKey has it (spec §58).
+  final wide = BigInt.parse(round);
+  if (wide > maxUint64) throw malformed;
+  if (wide > BigInt.from(maxSafeUint)) {
+    throw _invalidJson(
+      ': round $round above $maxSafeUint, the largest round of a DateKey',
+    );
+  }
+  final Uint8List sig;
+  try {
+    sig = fromHex(signature);
+  } on FormatException {
+    throw _invalidJson(': signature is not hex');
+  }
+  if (randomness.isNotEmpty && randomness.toLowerCase() != toHex(sha256(sig))) {
+    throw _invalidJson(': randomness does not match the signature');
+  }
+  return Release(wide.toInt(), sig);
+}
+
+// A value of the drand JSON that [_parseDrandJson] reads: null, a string, the
+// literal of a number, or anything else (a boolean, an array or an object).
+final class _JsonValue {
+  const _JsonValue({this.isNull = false, this.string, this.number});
+
+  final bool isNull;
+  final String? string;
+  final String? number;
+}
+
+// A reader of JSON with the syntax that encoding/json of Go accepts (RFC
+// 8259, with invalid UTF-8 in strings read as U+FFFD): the members of the top
+// object whose names fold to round, signature or randomness, in order, each
+// one that appears, as Go sets them one after another. It
+// throws a FormatException for anything else than one object between JSON
+// spaces.
+final class _GoJson {
+  _GoJson(this._b);
+
+  final List<int> _b;
+  int _i = 0;
+
+  Never _bad() => throw const FormatException('malformed JSON');
+
+  void _space() {
+    while (_i < _b.length) {
+      final c = _b[_i];
+      if (c != 0x20 && c != 0x09 && c != 0x0a && c != 0x0d) return;
+      _i++;
+    }
+  }
+
+  int _peek() => _i < _b.length ? _b[_i] : -1;
+
+  void _expect(int c) {
+    if (_peek() != c) _bad();
+    _i++;
+  }
+
+  List<(String, _JsonValue)> topObject() {
+    _space();
+    final out = <(String, _JsonValue)>[];
+    _object(out);
+    _space();
+    if (_i != _b.length) _bad();
+    return out;
+  }
+
+  // Reads an object; with [out], keeps its members of the three names.
+  void _object([List<(String, _JsonValue)>? out]) {
+    _expect(0x7b);
+    _space();
+    if (_peek() == 0x7d) {
+      _i++;
+      return;
+    }
+    for (;;) {
+      _space();
+      final name = _string();
+      _space();
+      _expect(0x3a);
+      _space();
+      final v = _value();
+      if (out != null) {
+        final k = _foldKey(name);
+        if (k == 'round' || k == 'signature' || k == 'randomness') {
+          // In the order of the input: Go sets each in turn.
+          out.add((k, v));
+        }
+      }
+      _space();
+      if (_peek() == 0x2c) {
+        _i++;
+        continue;
+      }
+      _expect(0x7d);
+      return;
+    }
+  }
+
+  void _array() {
+    _expect(0x5b);
+    _space();
+    if (_peek() == 0x5d) {
+      _i++;
+      return;
+    }
+    for (;;) {
+      _space();
+      _value();
+      _space();
+      if (_peek() == 0x2c) {
+        _i++;
+        continue;
+      }
+      _expect(0x5d);
+      return;
+    }
+  }
+
+  _JsonValue _value() {
+    final c = _peek();
+    switch (c) {
+      case 0x7b:
+        _object();
+        return const _JsonValue();
+      case 0x5b:
+        _array();
+        return const _JsonValue();
+      case 0x22:
+        return _JsonValue(string: _string());
+      case 0x74:
+        _literal('true');
+        return const _JsonValue();
+      case 0x66:
+        _literal('false');
+        return const _JsonValue();
+      case 0x6e:
+        _literal('null');
+        return const _JsonValue(isNull: true);
+    }
+    if (c == 0x2d || (c >= 0x30 && c <= 0x39)) {
+      return _JsonValue(number: _number());
+    }
+    _bad();
+  }
+
+  void _literal(String word) {
+    for (final c in word.codeUnits) {
+      _expect(c);
+    }
+  }
+
+  bool _digit() {
+    final c = _peek();
+    return c >= 0x30 && c <= 0x39;
+  }
+
+  String _number() {
+    final start = _i;
+    if (_peek() == 0x2d) _i++;
+    if (_peek() == 0x30) {
+      _i++;
+    } else if (_digit()) {
+      while (_digit()) {
+        _i++;
+      }
+    } else {
+      _bad();
+    }
+    if (_peek() == 0x2e) {
+      _i++;
+      if (!_digit()) _bad();
+      while (_digit()) {
+        _i++;
+      }
+    }
+    if (_peek() == 0x65 || _peek() == 0x45) {
+      _i++;
+      if (_peek() == 0x2b || _peek() == 0x2d) _i++;
+      if (!_digit()) _bad();
+      while (_digit()) {
+        _i++;
+      }
+    }
+    return String.fromCharCodes(_b.sublist(start, _i));
+  }
+
+  int _hex4() {
+    if (_i + 4 > _b.length) _bad();
+    var v = 0;
+    for (var k = 0; k < 4; k++) {
+      final c = _b[_i++];
+      final d = c >= 0x30 && c <= 0x39
+          ? c - 0x30
+          : (c | 0x20) >= 0x61 && (c | 0x20) <= 0x66
+          ? (c | 0x20) - 0x61 + 10
+          : -1;
+      if (d < 0) _bad();
+      v = v << 4 | d;
+    }
+    return v;
+  }
+
+  String _string() {
+    _expect(0x22);
+    final out = StringBuffer();
+    final raw = <int>[];
+    void flush() {
+      if (raw.isEmpty) return;
+      out.write(utf8.decode(raw, allowMalformed: true));
+      raw.clear();
+    }
+
+    for (;;) {
+      if (_i >= _b.length) _bad();
+      final c = _b[_i++];
+      if (c == 0x22) break;
+      if (c < 0x20) _bad();
+      if (c != 0x5c) {
+        raw.add(c);
+        continue;
+      }
+      flush();
+      if (_i >= _b.length) _bad();
+      final e = _b[_i++];
+      switch (e) {
+        case 0x22 || 0x5c || 0x2f:
+          out.writeCharCode(e);
+        case 0x62:
+          out.writeCharCode(0x08);
+        case 0x66:
+          out.writeCharCode(0x0c);
+        case 0x6e:
+          out.writeCharCode(0x0a);
+        case 0x72:
+          out.writeCharCode(0x0d);
+        case 0x74:
+          out.writeCharCode(0x09);
+        case 0x75:
+          var u = _hex4();
+          if (u >= 0xd800 && u < 0xdc00) {
+            // A pair of surrogates is one character; a lone one is U+FFFD.
+            final save = _i;
+            if (_i + 6 <= _b.length && _b[_i] == 0x5c && _b[_i + 1] == 0x75) {
+              _i += 2;
+              final low = _hex4();
+              if (low >= 0xdc00 && low < 0xe000) {
+                u = 0x10000 + ((u - 0xd800) << 10) + (low - 0xdc00);
+              } else {
+                _i = save;
+                u = 0xfffd;
+              }
+            } else {
+              u = 0xfffd;
+            }
+          } else if (u >= 0xdc00 && u < 0xe000) {
+            u = 0xfffd;
+          }
+          out.writeCharCode(u);
+        default:
+          _bad();
+      }
+    }
+    flush();
+    return out.toString();
+  }
+}
+
+// ---------------------------------------------------------------------------
+// A release in the caller's hand (spec v0.15, §49, §63 step 9.c)
+
+/// Hands over a release that the caller has in hand, as provider.Supplier of
+/// Go: a release object, drand's JSON that the person saved, or an entry of
+/// a local release archive. It makes no network request, so the opening asks
+/// it for the release without comparing its clock with the round time: a
+/// valid signature proves that the round was published.
+///
+/// [supply] returns the encoding of the release of [round], as it is: a
+/// release object or drand's JSON, which the opening reads with
+/// [parseRelease] and verifies at step 10, with the codes of that step.
+/// Without a release for the round it throws ERR_RELEASE_UNAVAILABLE, the
+/// code of step 9; whatever else it throws is reported at step 9 with that
+/// code alone, keeping only its text ([supplyRelease]).
+abstract interface class ReleaseSupplier {
+  /// The encoding of the release of [round] of the profile [p].
+  Future<Uint8List> supply(PinnedProfile p, int round);
+}
+
+/// A release in hand, already read: the bytes of a release object or of
+/// drand's JSON, as provider.Encoded of Go. It supplies itself whatever the
+/// round; step 10 compares its round with the DateKey.
+final class EncodedRelease implements ReleaseSupplier {
+  /// The release encoded in [bytes], which it copies.
+  EncodedRelease(List<int> bytes) : _bytes = Uint8List.fromList(bytes);
+
+  final Uint8List _bytes;
+
+  @override
+  Future<Uint8List> supply(PinnedProfile p, int round) async =>
+      Uint8List.fromList(_bytes);
+}
+
+/// The encoding of the release of [round] from [supplier], as step 9 of the
+/// opening obtains it: whatever the supplier throws becomes
+/// ERR_RELEASE_UNAVAILABLE, as [fetchRelease] does for a source.
+Future<Uint8List> supplyRelease(
+  ReleaseSupplier supplier,
+  PinnedProfile p,
+  int round,
+) => _step9(() => supplier.supply(p, round));
+
+// ---------------------------------------------------------------------------
+// The local release archive (spec v0.15, §50, informative)
+
+/// The type tag of the header of a release archive.
+const releaseArchiveTypeTag = 'datekeys-release-archive';
+
+/// The schema version of the header of a release archive.
+const releaseArchiveSchemaVersion = 1;
+
+// The bound of the header of an archive: its five keys take at most
+// 1 + 26 + 2 + 35 + 9 + 9 bytes.
+const _maxArchiveHeader = 128;
+
+const _archiveKeys = 5;
+
+// The header of an archive, as archiveHeader of Go.
+final class _ArchiveHeader {
+  Uint8List chainHash = Uint8List(0);
+  int first = 0;
+  int count = 0;
+
+  void encode(CborEncoder e) {
+    e
+      ..map(_archiveKeys)
+      ..uint(0)
+      ..text(releaseArchiveTypeTag)
+      ..uint(1)
+      ..uint(releaseArchiveSchemaVersion)
+      ..uint(2)
+      ..bstr(chainHash)
+      ..uint(3)
+      ..uint(first)
+      ..uint(4)
+      ..uint(count);
+  }
+
+  // Throws a DateKeysException of the codec, whose text Go prints with its
+  // code, or an _ArchiveError, a text of Go without a code.
+  void decode(CborDecoder d) {
+    final pairs = d.map(_archiveKeys);
+    if (pairs != _archiveKeys) {
+      throw _ArchiveError('$pairs keys, want all $_archiveKeys');
+    }
+    for (var want = 0; want < _archiveKeys; want++) {
+      final k = d.key();
+      if (k != want) {
+        throw _ArchiveError('key $k where key $want was expected');
+      }
+      inKey(k, () {
+        switch (want) {
+          case 0:
+            d.text(releaseArchiveTypeTag.length);
+          case 1:
+            d.uint(releaseArchiveSchemaVersion);
+          case 2:
+            chainHash = d.bstr(32, 32);
+          case 3:
+            first = d.uint();
+          default:
+            count = d.uint();
+        }
+      });
+    }
+    d.endMap();
+  }
+}
+
+final class _ArchiveError implements Exception {
+  _ArchiveError(this.text);
+  final String text;
+}
+
+/// A local release archive, the informative format of spec v0.15, §50, as
+/// provider.Archive of Go: a header in deterministic CBOR,
+/// `{0: "datekeys-release-archive", 1: 1, 2: chain_hash, 3: first round,
+/// 4: number of rounds}`, followed by the signatures, so that the one of
+/// round r starts at the end of the header plus (r - first)·n, with n the
+/// length of a signature of the chain, 48 bytes in Quicknet. A round written
+/// as zeros is missing.
+///
+/// Read locally, it is a release in hand: its entry is the release object of
+/// the round, with the chain hash of the header, decoded and verified at
+/// step 10 like any other. A round it lacks, a header it cannot read, an
+/// archive of another chain or of another length, and a failure to read the
+/// [ByteSource], are failures to supply a release: ERR_RELEASE_UNAVAILABLE at
+/// step 9, with the texts of Go. The format has no codes of its own.
+final class ReleaseArchive implements ReleaseSupplier {
+  /// The archive that [source] reads by ranges. Nothing is read until
+  /// [supply].
+  ReleaseArchive(this.source);
+
+  /// The bytes of the archive.
+  final ByteSource source;
+
+  @override
+  Future<Uint8List> supply(PinnedProfile p, int round) async {
+    DateKeysException unavailable(String text) => DateKeysException(
+      ErrorCode.releaseUnavailable,
+      'provider: release archive: $text',
+    );
+    final size = source.length;
+    final Uint8List head;
+    try {
+      head = await readRange(
+        source,
+        0,
+        size < _maxArchiveHeader ? size : _maxArchiveHeader,
+      );
+    } on Object catch (e) {
+      throw unavailable('$e');
+    }
+    try {
+      checkSchema(head, releaseArchiveTypeTag, releaseArchiveSchemaVersion);
+    } on DateKeysException {
+      throw unavailable(
+        'not an archive of version $releaseArchiveSchemaVersion',
+      );
+    }
+    final h = _ArchiveHeader();
+    try {
+      h.decode(CborDecoder(head));
+    } on DateKeysException catch (e) {
+      throw unavailable('its header does not decode: ${e.message}');
+    } on _ArchiveError catch (e) {
+      throw unavailable('its header does not decode: ${e.text}');
+    }
+    // The header is the deterministic encoding of what it says: its length
+    // is that of the encoding, and the signatures follow it.
+    final e = CborEncoder();
+    h.encode(e);
+    final enc = e.out();
+    final shown = enc.length < head.length ? enc.length : head.length;
+    if (!equalBytes(enc, Uint8List.sublistView(head, 0, shown))) {
+      throw unavailable(
+        'its header is not the deterministic encoding of its value',
+      );
+    }
+    if (!equalBytes(h.chainHash, p.chainHash)) {
+      throw unavailable(
+        'archive of chain ${toHex(h.chainHash)}, the pinned profile ${p.id} '
+        'is chain ${toHex(p.chainHash)}',
+      );
+    }
+    if (h.first == 0 ||
+        h.count == 0 ||
+        round < h.first ||
+        round - h.first >= h.count) {
+      throw unavailable(
+        'round $round is not in the archive, which holds ${h.count} rounds '
+        'from ${h.first}',
+      );
+    }
+    if (p.scheme != quicknetScheme) {
+      throw unavailable(
+        'profile ${p.id} uses scheme ${p.scheme}; only $quicknetScheme '
+        'archives are read here',
+      );
+    }
+    const n = signatureLength;
+    // count is at most 2^53-1: the product is exact on the VM, and on the
+    // web it is inexact only above 2^53, which no source measures.
+    if (size != enc.length + h.count * n) {
+      throw unavailable(
+        '$size bytes, its header announces ${h.count} rounds of $n bytes',
+      );
+    }
+    final Uint8List sig;
+    try {
+      sig = await readRange(source, enc.length + (round - h.first) * n, n);
+    } on Object catch (e) {
+      throw unavailable('$e');
+    }
+    if (sig.every((b) => b == 0)) {
+      throw unavailable('round $round is missing: its entry is zeros');
+    }
+    return encodeRelease(Release(round, sig, chainHash: h.chainHash));
+  }
+}

lib/src/version.dart

@@ -5,4 +5,4 @@ const String version = '0.1.0-dev';
 /// The version of the DateKeys Protocol Specification that this library
 /// implements, and that the `spec` field of every file of its `testdata/`
 /// names.
-const String specVersion = '0.14';
+const String specVersion = '0.15';

test/errors_spec_test.dart

@@ -1,7 +1,8 @@
 // The catalogue matches spec §69 exactly, in order, as TestCatalogueMatchesSpec
 // of datekeys-go. The spec is read from the Go repository next to this one, at
-// the tag of the version of the spec that this package implements, so that
-// uncommitted changes there never count.
+// the commit that testdata/SOURCE.json pins, the one testdata/ was synced
+// from, so that uncommitted changes there never count and a version not yet
+// tagged can be read.
 @TestOn('vm')
 library;
 
@@ -11,13 +12,16 @@ import 'dart:io';
 import 'package:datekeys/datekeys.dart';
 import 'package:test/test.dart';
 
+import '../tool/sync_testdata.dart' as testdata;
+
 void main() {
   final repo = Directory('../datekeys-go');
   test(
     'the catalogue is the list of ERR_ lines of spec §69, in order',
     () {
+      final commit = testdata.check(Directory.current).commit;
       final path =
-          'spec-v$specVersion:spec/DateKeys_Protocol_Specification_v$specVersion.md';
+          '$commit:spec/DateKeys_Protocol_Specification_v$specVersion.md';
       final r = Process.runSync(
         'git',
         ['-C', repo.path, 'show', path],

test/open_corpus_test.dart

@@ -3,9 +3,12 @@
 // and the step of the corpus, and the text and the checks that capsule.Open
 // of Go gives on each case (test/vectors/mutation_texts.json, which
 // tool/mutation_go_texts.go writes), in memory and from a source read in
-// pieces; the verdicts and their lines of each case that opens; no release
-// request for a case that fails without the network; and every case whose
-// step is 1 to 8 through the inspection too.
+// pieces, with the source of each case (spec v0.15, §63 step 9): a release
+// in hand, given as a release object (OpenOptions.release), or a network
+// source that discards a release breaking a rule of step 10; the verdicts
+// and their lines of each case that opens, and the clock behind a release in
+// hand; no release request for a case that fails without the network; and
+// every case whose step is 1 to 8 through the inspection too.
 @TestOn('vm')
 library;
 
@@ -37,15 +40,30 @@ void main() {
     expect(corpus['spec'], specVersion);
     expect(texts['spec'], specVersion);
     expect(texts['generator'], 'tool/mutation_go_texts.go');
-    expect(cases, hasLength(218));
+    expect(cases, hasLength(222));
     expect(
       [for (final c in goCases) c['name']],
       [for (final c in cases) c['name']],
     );
-    // Go at c531e93 and the corpus of the draft v0.12 agree on every case.
+    // Go at 3c3e737 and the corpus of v0.15 agree on every case.
     expect(goCases.where((c) => c.containsKey('go_error')), isEmpty);
     expect(cases.where((c) => c['spec'] == true), hasLength(178));
-    expect(cases.where((c) => c['error'] == 'ok'), hasLength(11));
+    expect(cases.where((c) => c['error'] == 'ok'), hasLength(12));
+    // Spec v0.15: every case says its source, all of them a release in hand
+    // but three, and two releases name another chain.
+    expect(
+      cases.where((c) => c['source'] != 'supplied').map((c) => c['name']),
+      [
+        'round not reached yet, from a network source',
+        'release of another round, from a network source',
+      ],
+    );
+    expect(
+      cases.where(
+        (c) => (c['release'] as Json?)?.containsKey('chain_hash') ?? false,
+      ),
+      hasLength(2),
+    );
     expect(
       cases.where((c) => c['error'] != 'ok' && (c['step']! as int) <= 8),
       hasLength(57),
@@ -64,7 +82,22 @@ void main() {
         expect(o.text, go['text'], reason: where);
         expect(canonical(o.checks), canonical(go['checks']), reason: where);
         final last = o.opened.checks.last;
-        if (c['error'] == 'ok') {
+        // Spec v0.15, §63 step 9.c: a release in hand opens with a clock
+        // behind the round time, which the opening reports.
+        expect(
+          o.opened.clockBehind,
+          o.opened.checks.any(
+            (k) => k.step == 9 && k.detail.endsWith('it may be behind'),
+          ),
+          reason: where,
+        );
+        if (c['error'] == 'ok' && c['verdicts'] == null) {
+          // A capsule of format 1 that opens: a release in hand and a clock
+          // behind its round time.
+          expect([last.step, last.ok], [18, true], reason: where);
+          expect(o.opened.clockBehind, isTrue, reason: where);
+          expect(o.output.closed, isTrue, reason: where);
+        } else if (c['error'] == 'ok') {
           // The cases of security that open, with the verdicts of the
           // corpus and their lines; none needs the reader of CMS.
           expect([last.step, last.ok], [18, true], reason: where);

test/open_support.dart

@@ -21,16 +21,24 @@ export 'security_support.dart';
 export 'source_support.dart';
 
 /// A source that answers every request with the release of a case, or
-/// fails as its source_error says, and counts the requests.
-final class CaseSource implements ReleaseSource {
-  CaseSource(this.release, this.error);
+/// fails as its source_error says, and counts the requests, as the sources
+/// of tool/open_go_vectors.go and testkit's singleSource of Go.
+///
+/// As a [ReleaseSource], it hands its release over unverified, as the cases
+/// of open_cases.json expect, or, when [network], verifies it and discards
+/// it when it breaks a rule of step 10, as a network source of the mutation
+/// corpus (spec v0.15, §63 step 9). As a [ReleaseSupplier], a release in the
+/// caller's hand, it hands over the release object of its release, with the
+/// chain of the pinned profile unless the release names another.
+final class CaseSource implements ReleaseSource, ReleaseSupplier {
+  CaseSource(this.release, this.error, {this.network = false});
 
   final Release? release;
   final Object? error;
+  final bool network;
   int calls = 0;
 
-  @override
-  Future<Release> fetch(PinnedProfile p, int round) async {
+  Release _release() {
     calls++;
     final e = error;
     if (e != null) throw e;
@@ -43,6 +51,30 @@ final class CaseSource implements ReleaseSource {
     }
     return r;
   }
+
+  @override
+  Future<Release> fetch(PinnedProfile p, int round) async {
+    final r = _release();
+    if (network) {
+      try {
+        verifyRelease(p, round, r);
+      } on DateKeysException catch (e) {
+        throw DateKeysException(
+          ErrorCode.releaseUnavailable,
+          'testkit: the release is discarded: ${e.message}',
+        );
+      }
+    }
+    return r;
+  }
+
+  @override
+  Future<Uint8List> supply(PinnedProfile p, int round) async {
+    final r = _release();
+    return encodeRelease(
+      Release(r.round, r.signature, chainHash: r.chainHash ?? p.chainHash),
+    );
+  }
 }
 
 /// The failure of a source of a case: a DateKeysException of its code, or
@@ -205,11 +237,24 @@ Future<Outcome> openCase(
   SecurityEvaluator? evaluator,
 }) async {
   final rel = c['release'] as Json?;
+  final chain = rel?['chain_hash'] as String?;
+  // The source of a case of the mutation corpus (spec v0.15): "supplied",
+  // a release in hand, or "network"; the cases of open_cases.json have
+  // none and are opened with a source that hands its release over.
+  final kind = c['source'] as String?;
+  if (kind != null && kind != 'supplied' && kind != 'network') {
+    throw ArgumentError('unknown source $kind');
+  }
   final source = CaseSource(
     rel == null
         ? null
-        : Release(rel['round']! as int, fromHex(str(rel, 'signature'))),
+        : Release(
+            rel['round']! as int,
+            fromHex(str(rel, 'signature')),
+            chainHash: chain == null ? null : fromHex(chain),
+          ),
     sourceError(c),
+    network: kind == 'network',
   );
   AccessKey? key;
   final dkk = c['dkk'] as String?;
@@ -234,7 +279,8 @@ Future<Outcome> openCase(
   final securities = <Uint8List>[];
   final evaluate = evaluator ?? evaluateSecurityInput;
   final options = OpenOptions(
-    source: source,
+    source: kind == 'supplied' ? null : source,
+    release: kind == 'supplied' ? source : null,
     now: () => parseRfc3339(str(c, 'now')),
     registry: c['registry'] == 'empty' ? newRegistry([]) : null,
     extensions: caseExtensions(c),

test/open_test.dart

@@ -499,6 +499,169 @@ void main() {
     });
   });
 
+  group('a release in hand (spec v0.15, §63 step 9.c)', () {
+    final c = caseNamed('time_and_key_portable: the .dkk, still encoded');
+    final rel = c['release']! as Json;
+    final round = rel['round']! as int;
+    final signature = fromHex(str(rel, 'signature'));
+    final chain = quicknet().chainHash;
+    final object = encodeRelease(Release(round, signature, chainHash: chain));
+    final unlock = parseRfc3339(str(c, 'now'));
+
+    Future<Opened> open(
+      ReleaseSupplier supplier,
+      Instant now, {
+      bool withKey = true,
+    }) => openCapsule(
+      capsuleOf(c, fixture),
+      OpenOptions(
+        release: supplier,
+        now: () => now,
+        accessKeyFile: withKey ? fromHex(str(c, 'dkk_file')) : null,
+        output: RecordingOutput(),
+      ),
+    );
+
+    test('is not compared with the clock, which the opening says is '
+        'behind', () async {
+      for (final (name, now, behind) in [
+        ('after the round time', unlock, false),
+        (
+          'a clock one nanosecond behind',
+          Instant(unlock.seconds - 1, 999999999),
+          true,
+        ),
+        ('a clock years behind', Instant(0), true),
+      ]) {
+        final o = await open(EncodedRelease(object), now);
+        expect(o.error, isNull, reason: name);
+        expect(o.clockBehind, behind, reason: name);
+        // The release that opened it, with the chain of the pinned
+        // profile, encodes to the same object.
+        expect(encodeRelease(o.release!), object, reason: name);
+        final step9 = o.checks.firstWhere(
+          (k) => k.step == 9 && k.name == 'release',
+        );
+        expect(
+          step9.detail,
+          behind
+              ? 'release supplied by the caller; round $round is published at '
+                    '${formatRfc3339(unlock)} and the clock says '
+                    '${formatRfc3339(now)}: it may be behind'
+              : 'release supplied by the caller',
+          reason: name,
+        );
+      }
+      // drand's JSON, which names no chain, opens it too.
+      final json = '{"round":$round,"signature":"${toHex(signature)}"}';
+      final o = await open(EncodedRelease(utf8.encode(json)), Instant(0));
+      expect([o.error, o.clockBehind], [null, true]);
+      expect(o.release!.chainHash, chain);
+    });
+
+    test('keeps the order of steps 9 and 10, with their codes', () async {
+      final other = Uint8List.fromList(chain)..[5] ^= 1;
+      for (final (name, supply, withKey, code, step, calls) in [
+        (
+          'no credential, before any supply',
+          () async => object,
+          false,
+          'ERR_ACCESS_REQUIRED',
+          9,
+          0,
+        ),
+        (
+          'nothing supplied',
+          () async =>
+              throw DateKeysException(ErrorCode.releaseUnavailable, 'none'),
+          true,
+          'ERR_RELEASE_UNAVAILABLE',
+          9,
+          1,
+        ),
+        (
+          'a supplier failing with another code',
+          () async => throw DateKeysException(ErrorCode.integrity, 'odd'),
+          true,
+          'ERR_RELEASE_UNAVAILABLE',
+          9,
+          1,
+        ),
+        (
+          'an empty object',
+          () async => Uint8List(0),
+          true,
+          'ERR_NON_CANONICAL_CBOR',
+          10,
+          1,
+        ),
+        (
+          'another chain and another round',
+          () async =>
+              encodeRelease(Release(round + 1, signature, chainHash: other)),
+          true,
+          'ERR_PROFILE_MISMATCH',
+          10,
+          1,
+        ),
+        (
+          'another round',
+          () async =>
+              encodeRelease(Release(round + 1, signature, chainHash: chain)),
+          true,
+          'ERR_ROUND_MISMATCH',
+          10,
+          1,
+        ),
+        (
+          "drand's JSON of another round",
+          () async => utf8.encode('{"round":${round + 1},"signature":"00"}'),
+          true,
+          'ERR_ROUND_MISMATCH',
+          10,
+          1,
+        ),
+      ]) {
+        final s = _CountingSupplier(supply);
+        final o = await open(s, Instant(0), withKey: withKey);
+        expect(
+          [o.error?.code.code, o.checks.last.step, s.calls],
+          [code, step, calls],
+          reason: name,
+        );
+        // As Go, the clock behind is reported once the release is in
+        // hand, even when step 10 then fails.
+        expect(o.clockBehind, step == 10, reason: name);
+        expect(o.release, isNull, reason: name);
+      }
+    });
+
+    test('is exclusive with a source, and one of them is required', () async {
+      for (final o in [
+        OpenOptions(
+          source: suppliedRelease(),
+          release: EncodedRelease(object),
+          now: () => unlock,
+          output: RecordingOutput(),
+        ),
+        OpenOptions(now: () => unlock, output: RecordingOutput()),
+      ]) {
+        await expectLater(
+          openCapsule(capsuleOf(c, fixture), o),
+          throwsA(
+            isArgumentError.having(
+              (e) => '${e.message}',
+              'message',
+              'open: set exactly one of OpenOptions.source and '
+                  'OpenOptions.release',
+            ),
+          ),
+        );
+        expect((o.output! as RecordingOutput).aborted, isArgumentError);
+      }
+    });
+  });
+
   group('the sources', () {
     test('BytesSource reads views of its bytes, and readRange keeps '
         'reading', () async {
@@ -561,3 +724,17 @@ RecordingSink _asRecording(MemoryFileSink m) {
   r.files = [for (final f in m.files!) BytesBuilder()..add(f)];
   return r;
 }
+
+// A supplier that counts the requests and answers with [supply].
+final class _CountingSupplier implements ReleaseSupplier {
+  _CountingSupplier(this.supply_);
+
+  final Future<List<int>> Function() supply_;
+  int calls = 0;
+
+  @override
+  Future<Uint8List> supply(PinnedProfile p, int round) async {
+    calls++;
+    return Uint8List.fromList(await supply_());
+  }
+}

test/release_object_support.dart

@@ -0,0 +1,398 @@
+// The release object, drand's JSON and the local release archive of spec
+// v0.15 (§47.1, §50, §63 step 10) against testdata/vectors/release.json,
+// strictly: every case with its result and the text of the reference, the
+// release each encoding says, and the object written again byte for byte;
+// the files of testdata/releases/; and the texts of provider.Archive of Go
+// on edited archives (test/vectors/release_archive_texts.json, written by
+// tool/release_archive_go_texts.go). release_object_vm_test.dart reads the
+// files; release_object_test.dart reads their copy, release.g.dart, compiled
+// to JavaScript.
+
+import 'dart:async';
+import 'dart:convert';
+import 'dart:typed_data';
+
+import 'package:datekeys/datekeys.dart';
+import 'package:test/test.dart';
+
+typedef Json = Map<String, Object?>;
+
+String _s(Json v, String key) => v[key]! as String;
+
+List<Json> _list(Json v, String key) => (v[key]! as List).cast<Json>();
+
+/// The result and the text of [body]: `ok` and null, or the code and the
+/// message of the DateKeysException it throws.
+Future<(String, String?)> _outcome(FutureOr<void> Function() body) async {
+  try {
+    await body();
+    return ('ok', null);
+  } on DateKeysException catch (e) {
+    return (e.code.code, e.message);
+  }
+}
+
+void _expectRelease(Release r, Json want, String name) {
+  expect(r.round, want['round'], reason: name);
+  expect(toHex(r.signature), want['signature'], reason: name);
+  final chain = want['chain_hash'] as String?;
+  expect(r.chainHash == null ? null : toHex(r.chainHash!), chain, reason: name);
+}
+
+/// The tests of release.json, the files of testdata/releases/ and the texts
+/// of the archive.
+void releaseObjectTests(
+  Json file,
+  Map<String, Uint8List> files,
+  Json archiveTexts,
+) {
+  final p = quicknet();
+
+  test('release.json has its lists and the keys of each case', () {
+    expect(file['spec'], specVersion);
+    expect(file['profile'], p.id);
+    expect(file.keys.toSet(), {
+      'spec',
+      'description',
+      'profile',
+      'objects',
+      'json',
+      'archive',
+    });
+    final objects = _list(file, 'objects');
+    final json = _list(file, 'json');
+    expect(objects, hasLength(36));
+    expect(json, hasLength(12));
+    for (final c in [...objects, ...json]) {
+      final ok = c['result'] == 'ok';
+      expect(c.containsKey('text'), !ok, reason: _s(c, 'name'));
+      expect(c['round'], isA<int>(), reason: _s(c, 'name'));
+      expect(
+        c.keys.toSet().difference({
+          'name',
+          'encoding',
+          'input',
+          'round',
+          'release',
+          'result',
+          'text',
+        }),
+        isEmpty,
+        reason: _s(c, 'name'),
+      );
+    }
+    expect(objects.where((c) => c['result'] == 'ok'), hasLength(4));
+    expect(json.where((c) => c['result'] == 'ok'), hasLength(3));
+  });
+
+  test('objects: the layers of the object, then step 10, with the texts of '
+      'Go', () async {
+    for (final c in _list(file, 'objects')) {
+      final name = _s(c, 'name');
+      final enc = fromHex(c['encoding'] as String? ?? '');
+      final want = c['release'] as Json?;
+      Release? decoded;
+      final got = await _outcome(() {
+        // parseRelease reads an object as decodeRelease does.
+        final r = parseRelease(enc);
+        decoded = r;
+        expect(decodeRelease(enc).round, r.round);
+        verifyRelease(p, c['round']! as int, r);
+      });
+      expect(got, (c['result'], c['text']), reason: name);
+      if (want == null) {
+        expect(decoded, isNull, reason: '$name: it does not decode');
+        continue;
+      }
+      _expectRelease(decoded!, want, name);
+      // The object is written again byte for byte.
+      expect(toHex(encodeRelease(decoded!)), toHex(enc), reason: name);
+    }
+  });
+
+  test(
+    'json: drand JSON as the input of the caller, with the texts of Go',
+    () async {
+      for (final c in _list(file, 'json')) {
+        final name = _s(c, 'name');
+        final want = c['release'] as Json?;
+        Release? decoded;
+        final got = await _outcome(() {
+          final r = parseRelease(utf8.encode(_s(c, 'input')));
+          decoded = r;
+          verifyRelease(p, c['round']! as int, r);
+        });
+        expect(got, (c['result'], c['text']), reason: name);
+        if (want == null) {
+          expect(decoded, isNull, reason: name);
+        } else {
+          expect(want.containsKey('chain_hash'), isFalse, reason: name);
+          _expectRelease(decoded!, want, name);
+        }
+      }
+    },
+  );
+
+  test('json: the matching of encoding/json of Go', () async {
+    const sig =
+        'b44679b9a59af2ec876b1a6b1ad52ea9b1615fc3982b19576350f93447cb1125e342b'
+        '73a8dd2bacbe47e4b6b63ed5e39';
+    Future<(String, String?)> read(String json) =>
+        _outcome(() => verifyRelease(p, 1000, parseRelease(utf8.encode(json))));
+    const malformed =
+        'provider: drand JSON: malformed, or without round or signature: '
+        'ERR_RELEASE_INVALID';
+    for (final ok in [
+      '{"Round":1000,"SIGNATURE":"$sig"}',
+      '{"round":1,"round":1000,"signature":"$sig","extra":[1,{"a":null}]}',
+      '{"round":1000,"signature":"$sig","randomness":null}',
+      '{"round":1000,"signature":"$sig","randomness":""}',
+      '\t\r\n {"round":1000,"${String.fromCharCode(0x017f)}ignature":"$sig"}',
+      // Escapes are read in names and values; other names are ignored,
+      // whatever they hold.
+      r'{"\u0072ound":1000,"signature":"\u0062'
+          '${sig.substring(1)}"}',
+      '{"round":1000,"signature":"$sig",'
+          r'"r\u00e9":1,"x":"\ud800"}'
+          '\n\n',
+    ]) {
+      expect(await read(ok), ('ok', null), reason: ok);
+    }
+    // Invalid UTF-8 in a string, as Go.
+    expect(
+      await _outcome(
+        () => verifyRelease(
+          p,
+          1000,
+          parseRelease([
+            ...utf8.encode('{"round":1000,"signature":"$sig","x":"'),
+            0xff,
+            ...utf8.encode('"}'),
+          ]),
+        ),
+      ),
+      ('ok', null),
+    );
+    for (final bad in [
+      '{"round":1000.0,"signature":"$sig"}',
+      '{"round":1e3,"signature":"$sig"}',
+      '{"round":-1000,"signature":"$sig"}',
+      '{"round":null,"signature":"$sig"}',
+      '{"round":1000,"signature":null}',
+      '{"round":1000,"signature":"$sig","randomness":1}',
+      '{"round":1000,"signature":["$sig"]}',
+      '{"round":1000,"signature":"$sig"} {}',
+      '{"round":1000,"signature":"$sig",}',
+      // The last key wins, and null unsets the round.
+      '{"round":1000,"signature":"$sig","round":null}',
+      '{"round":01000,"signature":"$sig"}',
+      '{"round":-0,"signature":"$sig"}',
+      '{"round":18446744073709551616,"signature":"$sig"}',
+      '{"round":1000,"signature":"$sig","x":"\\q"}',
+      '{"round":1000,"signature":"$sig","x":tru}',
+    ]) {
+      expect(await read(bad), ('ERR_RELEASE_INVALID', malformed), reason: bad);
+    }
+    expect(await read('{"round":1000,"signature":"${sig.substring(1)}"}'), (
+      'ERR_RELEASE_INVALID',
+      'provider: drand JSON: signature is not hex: ERR_RELEASE_INVALID',
+    ));
+    // null leaves randomness as it was.
+    expect(
+      await read(
+        '{"round":1000,"signature":"$sig","randomness":"x",'
+        '"randomness":null}',
+      ),
+      (
+        'ERR_RELEASE_INVALID',
+        'provider: drand JSON: randomness does not match the signature: '
+            'ERR_RELEASE_INVALID',
+      ),
+    );
+    // Go reads a round up to 2^64-1 and fails it at step 10 with
+    // ERR_ROUND_MISMATCH; this library does not hold a round above 2^53-1,
+    // which no DateKey has, and refuses it as it reads it.
+    expect(await read('{"round":9007199254740992,"signature":"$sig"}'), (
+      'ERR_RELEASE_INVALID',
+      'provider: drand JSON: round 9007199254740992 above 9007199254740991, '
+          'the largest round of a DateKey: ERR_RELEASE_INVALID',
+    ));
+    // A signature of no byte reads, and fails at the signature.
+    expect(await read('{"round":1000,"signature":""}'), (
+      'ERR_RELEASE_INVALID',
+      'provider: signature is 0 bytes, bls-unchained-g1-rfc9380 uses 48: '
+          'ERR_RELEASE_INVALID',
+    ));
+    // Not JSON: the first byte other than a JSON space is not {.
+    expect(await read('${String.fromCharCode(0xa0)}{}'), (
+      'ERR_NON_CANONICAL_CBOR',
+      'provider: release object: codec: offset 0: a tag (initial byte 0xc2) '
+          'is outside the CBOR profile: ERR_NON_CANONICAL_CBOR',
+    ));
+    expect(await read('[]'), (
+      'ERR_NON_CANONICAL_CBOR',
+      'provider: release object: codec: offset 0: truncated input: '
+          'ERR_NON_CANONICAL_CBOR',
+    ));
+  });
+
+  test('encodeRelease refuses what the object cannot hold, as Go', () {
+    final chain = p.chainHash;
+    String fails(Release r) {
+      try {
+        encodeRelease(r);
+      } on DateKeysException catch (e) {
+        return e.message;
+      }
+      fail('no error');
+    }
+
+    expect(
+      fails(Release(1000, Uint8List(48))),
+      'provider: release object: chain hash of 0 bytes, want 32: '
+      'ERR_NON_CANONICAL_CBOR',
+    );
+    expect(
+      fails(Release(1000, Uint8List(48), chainHash: Uint8List(31))),
+      'provider: release object: chain hash of 31 bytes, want 32: '
+      'ERR_NON_CANONICAL_CBOR',
+    );
+    expect(
+      fails(Release(0, Uint8List(48), chainHash: chain)),
+      'provider: release object: round 0 outside 1..9007199254740991: '
+      'ERR_NON_CANONICAL_CBOR',
+    );
+    expect(
+      fails(Release(1000, Uint8List(0), chainHash: chain)),
+      'provider: release object: signature of 0 bytes outside 1..96: '
+      'ERR_NON_CANONICAL_CBOR',
+    );
+    expect(
+      fails(Release(1000, Uint8List(97), chainHash: chain)),
+      'provider: release object: signature of 97 bytes outside 1..96: '
+      'ERR_NON_CANONICAL_CBOR',
+    );
+  });
+
+  test('the files of testdata/releases/: the object of each round, which '
+      'opens step 10', () {
+    final objects = {
+      for (final c in _list(file, 'objects'))
+        if (c['result'] == 'ok') c['round']! as int: _s(c, 'encoding'),
+    };
+    final rounds = <int>[];
+    for (final MapEntry(:key, :value) in files.entries) {
+      final m = RegExp(r'^(\d+)\.[a-z]+$').firstMatch(key);
+      if (m == null) continue;
+      final round = int.parse(m[1]!);
+      rounds.add(round);
+      final r = decodeRelease(value);
+      expect(r.round, round, reason: key);
+      expect(r.chainHash, p.chainHash, reason: key);
+      verifyRelease(p, round, r);
+      expect(toHex(encodeRelease(r)), toHex(value), reason: key);
+      expect(toHex(value), objects[round], reason: key);
+      expect(value, hasLength(111), reason: key);
+    }
+    expect(rounds..sort(), [1000, 1001, 1004, 2000]);
+  });
+
+  test('archive: the lookups of release.json', () async {
+    final a = file['archive']! as Json;
+    final name = _s(a, 'file').split('/').last;
+    final bin = files[name]!;
+    expect(toHex(bin).startsWith(_s(a, 'header')), isTrue);
+    final archive = ReleaseArchive(BytesSource(bin));
+    final lookups = _list(a, 'lookups');
+    expect(lookups, hasLength(7));
+    for (final l in lookups) {
+      final round = l['round']! as int;
+      Uint8List? got;
+      final r = await _outcome(() async {
+        got = await archive.supply(p, round);
+      });
+      expect(r.$1, l['result'], reason: 'round $round');
+      if (l['result'] == 'ok') {
+        expect(toHex(got!), l['encoding'], reason: 'round $round');
+        verifyRelease(p, round, decodeRelease(got!));
+      }
+    }
+  });
+
+  test('archive: the texts of provider.Archive of Go', () async {
+    expect(archiveTexts['generator'], 'tool/release_archive_go_texts.go');
+    final cases = _list(archiveTexts, 'cases');
+    expect(cases, hasLength(14));
+    for (final c in cases) {
+      final round = c['round']! as int;
+      final r = await _outcome(
+        () =>
+            ReleaseArchive(BytesSource(fromHex(_s(c, 'bytes'))))
+                .supply(p, round),
+      );
+      expect(r.$2 ?? 'ok', c['text'], reason: _s(c, 'name'));
+      if (r.$2 != null) {
+        expect(r.$1, 'ERR_RELEASE_UNAVAILABLE', reason: _s(c, 'name'));
+      }
+    }
+  });
+
+  test('archive: a source that fails is a release unavailable', () async {
+    final r = await _outcome(
+      () => ReleaseArchive(_FailingSource()).supply(p, 1000),
+    );
+    expect(r, (
+      'ERR_RELEASE_UNAVAILABLE',
+      'provider: release archive: disk gone: ERR_RELEASE_UNAVAILABLE',
+    ));
+  });
+
+  test('a release in hand: supplyRelease keeps only the code of step 9', () async {
+    final object = files.entries
+        .firstWhere((e) => e.key.startsWith('1000.'))
+        .value;
+    expect(await EncodedRelease(object).supply(p, 7), object);
+    expect(
+      await _outcome(() => supplyRelease(_ThrowingSupplier('odd'), p, 1000)),
+      (
+        'ERR_RELEASE_UNAVAILABLE',
+        'capsule: release source: odd: ERR_RELEASE_UNAVAILABLE',
+      ),
+    );
+    expect(
+      await _outcome(
+        () => supplyRelease(
+          _ThrowingSupplier(DateKeysException(ErrorCode.integrity, 'odd')),
+          p,
+          1000,
+        ),
+      ),
+      (
+        'ERR_RELEASE_UNAVAILABLE',
+        'capsule: release source: odd: ERR_INTEGRITY: ERR_RELEASE_UNAVAILABLE',
+      ),
+    );
+    final none = DateKeysException(ErrorCode.releaseUnavailable, 'none');
+    expect(
+      await _outcome(() => supplyRelease(_ThrowingSupplier(none), p, 1000)),
+      ('ERR_RELEASE_UNAVAILABLE', 'none: ERR_RELEASE_UNAVAILABLE'),
+    );
+  });
+}
+
+final class _FailingSource implements ByteSource {
+  @override
+  int get length => 311;
+
+  @override
+  Future<Uint8List> read(int offset, int n) async => throw 'disk gone';
+}
+
+final class _ThrowingSupplier implements ReleaseSupplier {
+  _ThrowingSupplier(this.error);
+
+  final Object error;
+
+  @override
+  Future<Uint8List> supply(PinnedProfile p, int round) async => throw error;
+}

test/release_object_test.dart

@@ -0,0 +1,21 @@
+// The release object, drand's JSON and the local release archive of spec
+// v0.15 against the copy of testdata/vectors/release.json, testdata/releases/
+// and test/vectors/release_archive_texts.json, compiled to JavaScript, where
+// no file can be read; release_object_vm_test.dart walks the files on the
+// VM.
+@TestOn('!vm')
+library;
+
+import 'dart:convert';
+
+import 'package:datekeys/datekeys.dart' show fromHex;
+import 'package:test/test.dart';
+
+import 'release_object_support.dart';
+import 'vectors/release.g.dart';
+
+void main() {
+  releaseObjectTests(jsonDecode(releaseJson) as Json, {
+    for (final e in releaseFiles.entries) e.key: fromHex(e.value),
+  }, jsonDecode(releaseArchiveTextsJson) as Json);
+}

test/release_object_vm_test.dart

@@ -0,0 +1,44 @@
+// The release object, drand's JSON and the local release archive of spec
+// v0.15 against testdata/vectors/release.json, testdata/releases/ and
+// test/vectors/release_archive_texts.json, read from the files, and the copy
+// of them that release_object_test.dart walks compiled to JavaScript
+// (test/vectors/release.g.dart, written by tool/release_copy.dart).
+@TestOn('vm')
+library;
+
+import 'dart:convert';
+import 'dart:io';
+import 'dart:typed_data';
+
+import 'package:datekeys/datekeys.dart' show toHex;
+import 'package:test/test.dart';
+
+import 'release_object_support.dart';
+import 'vectors/release.g.dart';
+
+void main() {
+  final text = File('testdata/vectors/release.json').readAsStringSync();
+  final archiveTexts = File('test/vectors/release_archive_texts.json')
+      .readAsStringSync();
+  final files = <String, Uint8List>{
+    for (final f in Directory('testdata/releases').listSync().whereType<File>())
+      f.uri.pathSegments.last: f.readAsBytesSync(),
+  };
+
+  test('release.g.dart holds the files', () {
+    const reason = 'run dart run tool/release_copy.dart';
+    expect(releaseJson, text, reason: reason);
+    expect(releaseArchiveTextsJson, archiveTexts, reason: reason);
+    expect(
+      {for (final e in files.entries) e.key: toHex(e.value)},
+      releaseFiles,
+      reason: reason,
+    );
+  });
+
+  releaseObjectTests(
+    jsonDecode(text) as Json,
+    files,
+    jsonDecode(archiveTexts) as Json,
+  );
+}

test/release_vectors_test.dart

@@ -170,6 +170,10 @@ void main() {
         ...names,
         for (final n in names) 'format 2: $n',
         for (final n in names) 'format 3: $n',
+        // Spec v0.15: two release objects of another chain.
+        'release object of another chain',
+        'release object of another chain and another round, with a clock '
+            'behind',
       ]..sort(),
     );
     for (final c in corpus) {
@@ -187,7 +191,13 @@ void main() {
         () => verifyRelease(
           quicknet(),
           dateKeyRound(bytes),
-          Release(rel['round']! as int, fromHex(s(rel, 'signature'))),
+          Release(
+            rel['round']! as int,
+            fromHex(s(rel, 'signature')),
+            chainHash: rel['chain_hash'] == null
+                ? null
+                : fromHex(s(rel, 'chain_hash')),
+          ),
         ),
         name,
       );

test/vectors/formats_body.json

@@ -1,5 +1,5 @@
 {
- "spec": "0.14",
+ "spec": "0.15",
  "generator": "tool/formats_go_vectors.go",
  "description": "The frame of BODY (capsule.ParseBodyFrame) against L, and the zeros of the security area (capsule.CheckArea).",
  "frame": [

test/vectors/formats_control.json

@@ -1,5 +1,5 @@
 {
- "spec": "0.14",
+ "spec": "0.15",
  "generator": "tool/formats_go_vectors.go",
  "description": "CONTROL_CBOR of the three formats (capsule.DecodeControl) of the fixtures, in their format and in another, edited, and built field by field.",
  "control": [

test/vectors/formats_datekey.json

@@ -1,5 +1,5 @@
 {
- "spec": "0.14",
+ "spec": "0.15",
  "generator": "tool/formats_go_vectors.go",
  "description": "dk1_ strings (datekey.Parse).",
  "parse": [

test/vectors/formats_encode.json

@@ -1,5 +1,5 @@
 {
- "spec": "0.14",
+ "spec": "0.15",
  "generator": "tool/formats_go_vectors.go",
  "description": "The encoders on values: capsule.EncodeHeader and EncodeControl, accesskey.Encode, profile.NewRegistry, and the canonical JSON and dk1_ string of DateKeys (CanonicalJSON and Compact, empty when not valid); an encoding is in hex, or as its length and SHA-256 when it is large. big is the size of the data of the noncritical extension a of version 1, bytes 0x01, that takes the object to its limit. limits: the decoders on objects at the limits of spec §57 and one byte past them: zeros bytes of zeros, or an extension array 81 a3 00 61 61 01 01 02 5a <len, 4 bytes> and len bytes 0x07 (extension_data), or Canonical of the extension a of version 1 whose data is len zeros (extension_canonical).",
  "header": [

test/vectors/formats_extension.json

@@ -1,5 +1,5 @@
 {
- "spec": "0.14",
+ "spec": "0.15",
  "generator": "tool/formats_go_vectors.go",
  "description": "Extension arrays through codec.Unmarshal with extension.DecodeArray and EncodeArray, Canonical, CheckDisjoint, CheckCriticalIn and CheckNoncriticalIn with the registry placed of the generator (or CheckCritical and CheckNoncritical when object is empty, and no registry when registry is none), and CheckWrite with extension.Standard.",
  "array": [

test/vectors/formats_framing.json

@@ -1,5 +1,5 @@
 {
- "spec": "0.14",
+ "spec": "0.15",
  "generator": "tool/formats_go_vectors.go",
  "description": "The PRELUDE of a .dkc (capsule.ParsePrelude), the steps 1 to 3 of capsule.Inspect on truncated and edited fixtures (with the step that fails, 0 when steps 1 to 8 pass), and whole .dkk files (accesskey.Decode), with the result, the code and the text of the Go reference.",
  "prelude": [

test/vectors/formats_header.json

@@ -1,5 +1,5 @@
 {
- "spec": "0.14",
+ "spec": "0.15",
  "generator": "tool/formats_go_vectors.go",
  "description": "PUBLIC_HEADER (capsule.DecodeHeader) of the fixtures, edited, and built field by field.",
  "header": [

test/vectors/formats_padding.json

@@ -1,5 +1,5 @@
 {
- "spec": "0.14",
+ "spec": "0.15",
  "generator": "tool/formats_go_vectors.go",
  "description": "capsule.PaddedLength with both codes and capsule.PayloadAgeLength, at the boundaries of spec §29.1 up to L_MAX and past it; a code with null was rejected with text. check: the plaintext of PAYLOAD_AGE checked by capsule.Open against L and P (step 17): the content of the fixture (its .plaintext) followed by zeros, cut or extended to length bytes, with the byte at at set to value when given; step 0 when the capsule opens.",
  "padded": [

test/vectors/formats_profile.json

@@ -1,5 +1,5 @@
 {
- "spec": "0.14",
+ "spec": "0.15",
  "generator": "tool/formats_go_vectors.go",
  "description": "Provider Profiles: profile.Decode of the Quicknet profile, edited and with fields replaced, and Profile.Validate of values.",
  "decode": [

test/vectors/formats_time.json

@@ -1,5 +1,5 @@
 {
- "spec": "0.14",
+ "spec": "0.15",
  "generator": "tool/formats_go_vectors.go",
  "description": "RFC 3339: time.Parse with time.RFC3339Nano, ok or error, and Format with RFC3339 and RFC3339Nano in UTC; datekey.Resolve, RoundTime and DateKey.Validate, and Profile.MaxRound, on the Quicknet profile with other genesis times and periods.",
  "parse": [

test/vectors/formats_vectors.g.dart

@@ -5,7 +5,7 @@
 /// Part of test/vectors/formats_framing.json.
 const formatsFramingJson = r'''
 {
- "spec": "0.14",
+ "spec": "0.15",
  "generator": "tool/formats_go_vectors.go",
  "description": "The PRELUDE of a .dkc (capsule.ParsePrelude), the steps 1 to 3 of capsule.Inspect on truncated and edited fixtures (with the step that fails, 0 when steps 1 to 8 pass), and whole .dkk files (accesskey.Decode), with the result, the code and the text of the Go reference.",
  "prelude": [
@@ -181,7 +181,7 @@ const formatsFramingJson = r'''
 /// Part of test/vectors/formats_header.json.
 const formatsHeaderJson = r'''
 {
- "spec": "0.14",
+ "spec": "0.15",
  "generator": "tool/formats_go_vectors.go",
  "description": "PUBLIC_HEADER (capsule.DecodeHeader) of the fixtures, edited, and built field by field.",
  "header": [
@@ -301,7 +301,7 @@ const formatsHeaderJson = r'''
 /// Part of test/vectors/formats_control.json.
 const formatsControlJson = r'''
 {
- "spec": "0.14",
+ "spec": "0.15",
  "generator": "tool/formats_go_vectors.go",
  "description": "CONTROL_CBOR of the three formats (capsule.DecodeControl) of the fixtures, in their format and in another, edited, and built field by field.",
  "control": [
@@ -440,7 +440,7 @@ const formatsControlJson = r'''
 /// Part of test/vectors/formats_profile.json.
 const formatsProfileJson = r'''
 {
- "spec": "0.14",
+ "spec": "0.15",
  "generator": "tool/formats_go_vectors.go",
  "description": "Provider Profiles: profile.Decode of the Quicknet profile, edited and with fields replaced, and Profile.Validate of values.",
  "decode": [
@@ -504,7 +504,7 @@ const formatsProfileJson = r'''
 /// Part of test/vectors/formats_extension.json.
 const formatsExtensionJson = r'''
 {
- "spec": "0.14",
+ "spec": "0.15",
  "generator": "tool/formats_go_vectors.go",
  "description": "Extension arrays through codec.Unmarshal with extension.DecodeArray and EncodeArray, Canonical, CheckDisjoint, CheckCriticalIn and CheckNoncriticalIn with the registry placed of the generator (or CheckCritical and CheckNoncritical when object is empty, and no registry when registry is none), and CheckWrite with extension.Standard.",
  "array": [
@@ -596,7 +596,7 @@ const formatsExtensionJson = r'''
 /// Part of test/vectors/formats_datekey.json.
 const formatsDatekeyJson = r'''
 {
- "spec": "0.14",
+ "spec": "0.15",
  "generator": "tool/formats_go_vectors.go",
  "description": "dk1_ strings (datekey.Parse).",
  "parse": [
@@ -666,7 +666,7 @@ const formatsDatekeyJson = r'''
 /// Part of test/vectors/formats_time.json.
 const formatsTimeJson = r'''
 {
- "spec": "0.14",
+ "spec": "0.15",
  "generator": "tool/formats_go_vectors.go",
  "description": "RFC 3339: time.Parse with time.RFC3339Nano, ok or error, and Format with RFC3339 and RFC3339Nano in UTC; datekey.Resolve, RoundTime and DateKey.Validate, and Profile.MaxRound, on the Quicknet profile with other genesis times and periods.",
  "parse": [
@@ -817,7 +817,7 @@ const formatsTimeJson = r'''
 /// Part of test/vectors/formats_padding.json.
 const formatsPaddingJson = r'''
 {
- "spec": "0.14",
+ "spec": "0.15",
  "generator": "tool/formats_go_vectors.go",
  "description": "capsule.PaddedLength with both codes and capsule.PayloadAgeLength, at the boundaries of spec §29.1 up to L_MAX and past it; a code with null was rejected with text. check: the plaintext of PAYLOAD_AGE checked by capsule.Open against L and P (step 17): the content of the fixture (its .plaintext) followed by zeros, cut or extended to length bytes, with the byte at at set to value when given; step 0 when the capsule opens.",
  "padded": [
@@ -897,7 +897,7 @@ const formatsPaddingJson = r'''
 /// Part of test/vectors/formats_encode.json.
 const formatsEncodeJson = r'''
 {
- "spec": "0.14",
+ "spec": "0.15",
  "generator": "tool/formats_go_vectors.go",
  "description": "The encoders on values: capsule.EncodeHeader and EncodeControl, accesskey.Encode, profile.NewRegistry, and the canonical JSON and dk1_ string of DateKeys (CanonicalJSON and Compact, empty when not valid); an encoding is in hex, or as its length and SHA-256 when it is large. big is the size of the data of the noncritical extension a of version 1, bytes 0x01, that takes the object to its limit. limits: the decoders on objects at the limits of spec §57 and one byte past them: zeros bytes of zeros, or an extension array 81 a3 00 61 61 01 01 02 5a <len, 4 bytes> and len bytes 0x07 (extension_data), or Canonical of the extension a of version 1 whose data is len zeros (extension_canonical).",
  "header": [
@@ -932,7 +932,7 @@ const formatsEncodeJson = r'''
 /// Part of test/vectors/formats_body.json.
 const formatsBodyJson = r'''
 {
- "spec": "0.14",
+ "spec": "0.15",
  "generator": "tool/formats_go_vectors.go",
  "description": "The frame of BODY (capsule.ParseBodyFrame) against L, and the zeros of the security area (capsule.CheckArea).",
  "frame": [

test/vectors/mutation_texts.json

@@ -1,41 +1,41 @@
 {
- "spec": "0.14",
+ "spec": "0.15",
  "generator": "tool/mutation_go_texts.go",
  "description": "The text of the error of capsule.Open for every case of testdata/vectors/mutations.json, or ok for a capsule that opens, and its checks as [step, name, ok, detail, code]; go_error and go_step where Go and the corpus disagree. See the header of tool/mutation_go_texts.go.",
  "cases": [
-  {"name":"PUBLIC_HEADER_A + SEALED_CONTROL_B","text":"capsule: header_binding does not match PRELUDE || PUBLIC_HEADER: ERR_HEADER_BINDING","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v1, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=446",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ad4d676812b134ff8a3de263f77018b4 datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"round 1000 obtained",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",true,"canonical CONTROL_CBOR",""],[15,"header binding",false,"capsule: header_binding does not match PRELUDE || PUBLIC_HEADER: ERR_HEADER_BINDING","ERR_HEADER_BINDING"]]},
-  {"name":"SEALED_CONTROL_A + PAYLOAD_AGE_B","text":"capsule: PAYLOAD_AGE: agewrap: PAYLOAD_AGE is not encrypted to this control's R_PAYLOAD: ERR_INTEGRITY","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v1, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=446",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ad4d676812b134ff8a3de263f77018b4 datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"round 1000 obtained",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",true,"canonical CONTROL_CBOR",""],[15,"header binding",true,"matches",""],[16,"payload identity",true,"I_PAYLOAD recovered",""],[17,"open payload",false,"capsule: PAYLOAD_AGE: agewrap: PAYLOAD_AGE is not encrypted to this control's R_PAYLOAD: ERR_INTEGRITY","ERR_INTEGRITY"]]},
-  {"name":"DateKey A + release of round B","text":"provider: release for round 1001, expected 1000: ERR_ROUND_MISMATCH","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v1, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=446",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ad4d676812b134ff8a3de263f77018b4 datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"round 1001 obtained",""],[10,"release verification",false,"provider: release for round 1001, expected 1000: ERR_ROUND_MISMATCH","ERR_ROUND_MISMATCH"]]},
+  {"name":"PUBLIC_HEADER_A + SEALED_CONTROL_B","text":"capsule: header_binding does not match PRELUDE || PUBLIC_HEADER: ERR_HEADER_BINDING","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v1, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=446",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ad4d676812b134ff8a3de263f77018b4 datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"release supplied by the caller",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",true,"canonical CONTROL_CBOR",""],[15,"header binding",false,"capsule: header_binding does not match PRELUDE || PUBLIC_HEADER: ERR_HEADER_BINDING","ERR_HEADER_BINDING"]]},
+  {"name":"SEALED_CONTROL_A + PAYLOAD_AGE_B","text":"capsule: PAYLOAD_AGE: agewrap: PAYLOAD_AGE is not encrypted to this control's R_PAYLOAD: ERR_INTEGRITY","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v1, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=446",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ad4d676812b134ff8a3de263f77018b4 datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"release supplied by the caller",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",true,"canonical CONTROL_CBOR",""],[15,"header binding",true,"matches",""],[16,"payload identity",true,"I_PAYLOAD recovered",""],[17,"open payload",false,"capsule: PAYLOAD_AGE: agewrap: PAYLOAD_AGE is not encrypted to this control's R_PAYLOAD: ERR_INTEGRITY","ERR_INTEGRITY"]]},
+  {"name":"DateKey A + release of round B","text":"provider: release for round 1001, expected 1000: ERR_ROUND_MISMATCH","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v1, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=446",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ad4d676812b134ff8a3de263f77018b4 datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"release supplied by the caller",""],[10,"release verification",false,"provider: release for round 1001, expected 1000: ERR_ROUND_MISMATCH","ERR_ROUND_MISMATCH"]]},
   {"name":"chain hash changed","text":"agewrap: tlock stanza chain hash \"abababababababababababababababababababababababababababababababab\", pinned profile datekeys:quicknet:v1 uses 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971: ERR_PROFILE_MISMATCH","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v1, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=446",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ad4d676812b134ff8a3de263f77018b4 datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",false,"agewrap: tlock stanza chain hash \"abababababababababababababababababababababababababababababababab\", pinned profile datekeys:quicknet:v1 uses 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971: ERR_PROFILE_MISMATCH","ERR_PROFILE_MISMATCH"]]},
   {"name":"version changed","text":"capsule: framing version 4: ERR_UNSUPPORTED_VERSION","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",false,"capsule: framing version 4: ERR_UNSUPPORTED_VERSION","ERR_UNSUPPORTED_VERSION"]]},
   {"name":"flags != 0","text":"capsule: flags 0x80, reserved 0x0000: ERR_INVALID_FLAGS","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",false,"capsule: flags 0x80, reserved 0x0000: ERR_INVALID_FLAGS","ERR_INVALID_FLAGS"]]},
   {"name":"reserved != 0","text":"capsule: flags 0x0, reserved 0x0001: ERR_INVALID_FLAGS","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",false,"capsule: flags 0x0, reserved 0x0001: ERR_INVALID_FLAGS","ERR_INVALID_FLAGS"]]},
-  {"name":"payload truncated","text":"capsule: PAYLOAD_AGE: the age payload is truncated, has trailing data or fails STREAM authentication: ERR_INTEGRITY","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v1, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=446",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ad4d676812b134ff8a3de263f77018b4 datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"round 1000 obtained",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",true,"canonical CONTROL_CBOR",""],[15,"header binding",true,"matches",""],[16,"payload identity",true,"I_PAYLOAD recovered",""],[17,"open payload",false,"capsule: PAYLOAD_AGE: the age payload is truncated, has trailing data or fails STREAM authentication: ERR_INTEGRITY","ERR_INTEGRITY"]]},
-  {"name":"payload age modified","text":"capsule: PAYLOAD_AGE: the age payload is truncated, has trailing data or fails STREAM authentication: ERR_INTEGRITY","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v1, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=446",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ad4d676812b134ff8a3de263f77018b4 datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"round 1000 obtained",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",true,"canonical CONTROL_CBOR",""],[15,"header binding",true,"matches",""],[16,"payload identity",true,"I_PAYLOAD recovered",""],[17,"open payload",false,"capsule: PAYLOAD_AGE: the age payload is truncated, has trailing data or fails STREAM authentication: ERR_INTEGRITY","ERR_INTEGRITY"]]},
-  {"name":"control modified","text":"capsule: age: the age payload is truncated, has trailing data or fails STREAM authentication: ERR_INTEGRITY","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v1, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=446",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ad4d676812b134ff8a3de263f77018b4 datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"round 1000 obtained",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",false,"capsule: age: the age payload is truncated, has trailing data or fails STREAM authentication: ERR_INTEGRITY","ERR_INTEGRITY"]]},
+  {"name":"payload truncated","text":"capsule: PAYLOAD_AGE: the age payload is truncated, has trailing data or fails STREAM authentication: ERR_INTEGRITY","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v1, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=446",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ad4d676812b134ff8a3de263f77018b4 datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"release supplied by the caller",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",true,"canonical CONTROL_CBOR",""],[15,"header binding",true,"matches",""],[16,"payload identity",true,"I_PAYLOAD recovered",""],[17,"open payload",false,"capsule: PAYLOAD_AGE: the age payload is truncated, has trailing data or fails STREAM authentication: ERR_INTEGRITY","ERR_INTEGRITY"]]},
+  {"name":"payload age modified","text":"capsule: PAYLOAD_AGE: the age payload is truncated, has trailing data or fails STREAM authentication: ERR_INTEGRITY","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v1, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=446",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ad4d676812b134ff8a3de263f77018b4 datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"release supplied by the caller",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",true,"canonical CONTROL_CBOR",""],[15,"header binding",true,"matches",""],[16,"payload identity",true,"I_PAYLOAD recovered",""],[17,"open payload",false,"capsule: PAYLOAD_AGE: the age payload is truncated, has trailing data or fails STREAM authentication: ERR_INTEGRITY","ERR_INTEGRITY"]]},
+  {"name":"control modified","text":"capsule: age: the age payload is truncated, has trailing data or fails STREAM authentication: ERR_INTEGRITY","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v1, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=446",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ad4d676812b134ff8a3de263f77018b4 datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"release supplied by the caller",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",false,"capsule: age: the age payload is truncated, has trailing data or fails STREAM authentication: ERR_INTEGRITY","ERR_INTEGRITY"]]},
   {"name":"non-canonical dk1_ JSON","text":"capsule: PUBLIC_HEADER: datekey: not the canonical encoding dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0: ERR_DATEKEY_NON_CANONICAL","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v1, PUBLIC_HEADER_LEN=124, SEALED_CONTROL_LEN=446",""],[3,"public header",true,"124 bytes",""],[4,"header validation",false,"capsule: PUBLIC_HEADER: datekey: not the canonical encoding dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0: ERR_DATEKEY_NON_CANONICAL","ERR_DATEKEY_NON_CANONICAL"]]},
   {"name":"unknown profile","text":"capsule: profile \"datekeys:evmnet:v1\" is not pinned: ERR_UNKNOWN_PROFILE","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v1, PUBLIC_HEADER_LEN=118, SEALED_CONTROL_LEN=446",""],[3,"public header",true,"118 bytes",""],[4,"header validation",false,"capsule: profile \"datekeys:evmnet:v1\" is not pinned: ERR_UNKNOWN_PROFILE","ERR_UNKNOWN_PROFILE"]]},
-  {"name":"release of another round","text":"provider: the signature is not a canonical point encoding, or does not verify as the BLS signature of round 1000 under datekeys:quicknet:v1: ERR_RELEASE_INVALID","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v1, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=446",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ad4d676812b134ff8a3de263f77018b4 datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"round 1000 obtained",""],[10,"release verification",false,"provider: the signature is not a canonical point encoding, or does not verify as the BLS signature of round 1000 under datekeys:quicknet:v1: ERR_RELEASE_INVALID","ERR_RELEASE_INVALID"]]},
-  {"name":"access_policy=time_only with time_and_key structure","text":"capsule: time_only capsule seals an age file: ERR_POLICY_STRUCTURE_MISMATCH","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v1, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=646",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=448e134a13457c319cab7fceaf7ffa1f datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"round 1000 obtained",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",false,"capsule: time_only capsule seals an age file: ERR_POLICY_STRUCTURE_MISMATCH","ERR_POLICY_STRUCTURE_MISMATCH"]]},
-  {"name":"access_policy=time_and_key with time_only structure","text":"capsule: time_and_key capsule does not seal an age file: ERR_POLICY_STRUCTURE_MISMATCH","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v1, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=446",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ad4d676812b134ff8a3de263f77018b4 datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_and_key profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"access credential",true,"1 identities to try",""],[9,"release",true,"round 1000 obtained",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",false,"capsule: time_and_key capsule does not seal an age file: ERR_POLICY_STRUCTURE_MISMATCH","ERR_POLICY_STRUCTURE_MISMATCH"]]},
+  {"name":"release of another round","text":"provider: the signature is not a canonical point encoding, or does not verify as the BLS signature of round 1000 under datekeys:quicknet:v1: ERR_RELEASE_INVALID","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v1, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=446",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ad4d676812b134ff8a3de263f77018b4 datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"release supplied by the caller",""],[10,"release verification",false,"provider: the signature is not a canonical point encoding, or does not verify as the BLS signature of round 1000 under datekeys:quicknet:v1: ERR_RELEASE_INVALID","ERR_RELEASE_INVALID"]]},
+  {"name":"access_policy=time_only with time_and_key structure","text":"capsule: time_only capsule seals an age file: ERR_POLICY_STRUCTURE_MISMATCH","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v1, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=646",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=448e134a13457c319cab7fceaf7ffa1f datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"release supplied by the caller",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",false,"capsule: time_only capsule seals an age file: ERR_POLICY_STRUCTURE_MISMATCH","ERR_POLICY_STRUCTURE_MISMATCH"]]},
+  {"name":"access_policy=time_and_key with time_only structure","text":"capsule: time_and_key capsule does not seal an age file: ERR_POLICY_STRUCTURE_MISMATCH","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v1, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=446",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ad4d676812b134ff8a3de263f77018b4 datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_and_key profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"access credential",true,"1 identities to try",""],[9,"release",true,"release supplied by the caller",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",false,"capsule: time_and_key capsule does not seal an age file: ERR_POLICY_STRUCTURE_MISMATCH","ERR_POLICY_STRUCTURE_MISMATCH"]]},
   {"name":"extra stanza in OUTER_TIME_AGE","text":"capsule: OUTER_TIME_AGE must hold exactly one tlock stanza, found 2: ERR_POLICY_STRUCTURE_MISMATCH","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v1, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=544",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ac64a02dff47ec22aaf1a44b1a89605d datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",false,"capsule: OUTER_TIME_AGE must hold exactly one tlock stanza, found 2: ERR_POLICY_STRUCTURE_MISMATCH","ERR_POLICY_STRUCTURE_MISMATCH"]]},
   {"name":"extra stanza in PAYLOAD_AGE","text":"agewrap: PAYLOAD_AGE has 2 stanzas, want exactly one X25519 stanza: ERR_POLICY_STRUCTURE_MISMATCH","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v1, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=446",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=3f985af7af37ad62b40ec5ccc3c6b8d1 datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",false,"agewrap: PAYLOAD_AGE has 2 stanzas, want exactly one X25519 stanza: ERR_POLICY_STRUCTURE_MISMATCH","ERR_POLICY_STRUCTURE_MISMATCH"]]},
-  {"name":"non-X25519 stanza in INNER_ACCESS_AGE","text":"agewrap: INNER_ACCESS_AGE stanza 1 has type \"scrypt\", want \"X25519\": ERR_POLICY_STRUCTURE_MISMATCH","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v1, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=726",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=c800935c81d094a93d56b9fad957b18b datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_and_key profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"access credential",true,"1 identities to try",""],[9,"release",true,"round 1000 obtained",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",false,"agewrap: INNER_ACCESS_AGE stanza 1 has type \"scrypt\", want \"X25519\": ERR_POLICY_STRUCTURE_MISMATCH","ERR_POLICY_STRUCTURE_MISMATCH"]]},
+  {"name":"non-X25519 stanza in INNER_ACCESS_AGE","text":"agewrap: INNER_ACCESS_AGE stanza 1 has type \"scrypt\", want \"X25519\": ERR_POLICY_STRUCTURE_MISMATCH","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v1, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=726",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=c800935c81d094a93d56b9fad957b18b datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_and_key profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"access credential",true,"1 identities to try",""],[9,"release",true,"release supplied by the caller",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",false,"agewrap: INNER_ACCESS_AGE stanza 1 has type \"scrypt\", want \"X25519\": ERR_POLICY_STRUCTURE_MISMATCH","ERR_POLICY_STRUCTURE_MISMATCH"]]},
   {"name":"tlock stanza round differs from DateKey.round","text":"agewrap: tlock stanza round \"1001\", DateKey round 1000: ERR_ROUND_MISMATCH","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v1, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=446",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=08f94a0475441b20180762647ee71902 datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",false,"agewrap: tlock stanza round \"1001\", DateKey round 1000: ERR_ROUND_MISMATCH","ERR_ROUND_MISMATCH"]]},
   {"name":"tlock stanza chain hash differs from the pinned profile","text":"agewrap: tlock stanza chain hash \"dbd506d6ef76e5f386f41c651dcb808c5bcbd75471cc4eafa3f4df7ad4e4c493\", pinned profile datekeys:quicknet:v1 uses 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971: ERR_PROFILE_MISMATCH","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v1, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=446",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=5d6090f141146d36ba274b96b44eb941 datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",false,"agewrap: tlock stanza chain hash \"dbd506d6ef76e5f386f41c651dcb808c5bcbd75471cc4eafa3f4df7ad4e4c493\", pinned profile datekeys:quicknet:v1 uses 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971: ERR_PROFILE_MISMATCH","ERR_PROFILE_MISMATCH"]]},
   {"name":"extension data of a type other than bstr","text":"capsule: PUBLIC_HEADER: key 6: extension \"org.example.label\": key 2: codec: offset 146: a text string where a byte string was expected: ERR_NON_CANONICAL_CBOR","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v1, PUBLIC_HEADER_LEN=159, SEALED_CONTROL_LEN=446",""],[3,"public header",true,"159 bytes",""],[4,"header validation",false,"capsule: PUBLIC_HEADER: key 6: extension \"org.example.label\": key 2: codec: offset 146: a text string where a byte string was expected: ERR_NON_CANONICAL_CBOR","ERR_NON_CANONICAL_CBOR"]]},
   {"name":"empty extension data (h'')","text":"capsule: PUBLIC_HEADER: key 6: extension \"org.example.label\": data is present but empty; an extension without data omits key 2: ERR_NON_CANONICAL_CBOR","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v1, PUBLIC_HEADER_LEN=147, SEALED_CONTROL_LEN=446",""],[3,"public header",true,"147 bytes",""],[4,"header validation",false,"capsule: PUBLIC_HEADER: key 6: extension \"org.example.label\": data is present but empty; an extension without data omits key 2: ERR_NON_CANONICAL_CBOR","ERR_NON_CANONICAL_CBOR"]]},
   {"name":"65 extensions in one array","text":"capsule: PUBLIC_HEADER: key 6: extension: codec: offset 124: array of 65 items, at most 64: ERR_NON_CANONICAL_CBOR","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v1, PUBLIC_HEADER_LEN=1424, SEALED_CONTROL_LEN=446",""],[3,"public header",true,"1424 bytes",""],[4,"header validation",false,"capsule: PUBLIC_HEADER: key 6: extension: codec: offset 124: array of 65 items, at most 64: ERR_NON_CANONICAL_CBOR","ERR_NON_CANONICAL_CBOR"]]},
-  {"name":"tlock stanza U re-encoded with c0 + p","text":"capsule: age: agewrap: U of the tlock stanza is not the canonical encoding of a point of the key group: ERR_INTEGRITY","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v1, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=446",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ad4d676812b134ff8a3de263f77018b4 datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"round 1000 obtained",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",false,"capsule: age: agewrap: U of the tlock stanza is not the canonical encoding of a point of the key group: ERR_INTEGRITY","ERR_INTEGRITY"]]},
-  {"name":"tlock stanza U is the point at infinity","text":"capsule: age: agewrap: U of the tlock stanza is the point at infinity: ERR_INTEGRITY","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v1, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=446",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ad4d676812b134ff8a3de263f77018b4 datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"round 1000 obtained",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",false,"capsule: age: agewrap: U of the tlock stanza is the point at infinity: ERR_INTEGRITY","ERR_INTEGRITY"]]},
-  {"name":"tlock stanza U with the infinity flag and a payload","text":"capsule: age: agewrap: U of the tlock stanza is not the canonical encoding of a point of the key group: ERR_INTEGRITY","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v1, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=446",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ad4d676812b134ff8a3de263f77018b4 datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"round 1000 obtained",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",false,"capsule: age: agewrap: U of the tlock stanza is not the canonical encoding of a point of the key group: ERR_INTEGRITY","ERR_INTEGRITY"]]},
-  {"name":"tlock stanza body of 127 bytes","text":"capsule: age: agewrap: tlock stanza body of 127 bytes, want 128: ERR_INTEGRITY","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v1, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=445",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ad4d676812b134ff8a3de263f77018b4 datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"round 1000 obtained",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",false,"capsule: age: agewrap: tlock stanza body of 127 bytes, want 128: ERR_INTEGRITY","ERR_INTEGRITY"]]},
-  {"name":"tlock stanza body of 129 bytes","text":"capsule: age: agewrap: tlock stanza body of 129 bytes, want 128: ERR_INTEGRITY","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v1, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=447",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ad4d676812b134ff8a3de263f77018b4 datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"round 1000 obtained",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",false,"capsule: age: agewrap: tlock stanza body of 129 bytes, want 128: ERR_INTEGRITY","ERR_INTEGRITY"]]},
-  {"name":"release signature re-encoded with x + p","text":"provider: the signature is not a canonical point encoding, or does not verify as the BLS signature of round 1004 under datekeys:quicknet:v1: ERR_RELEASE_INVALID","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v1, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=446",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=250416bc1e6d8da84f5a69e47a9f66f2 datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwNH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1004, unlock at 2023-08-23T15:59:36Z",""],[8,"tlock stanza",true,"round 1004, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"round 1004 obtained",""],[10,"release verification",false,"provider: the signature is not a canonical point encoding, or does not verify as the BLS signature of round 1004 under datekeys:quicknet:v1: ERR_RELEASE_INVALID","ERR_RELEASE_INVALID"]]},
-  {"name":"release signature is the point at infinity","text":"provider: the signature is not a canonical point encoding, or does not verify as the BLS signature of round 1000 under datekeys:quicknet:v1: ERR_RELEASE_INVALID","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v1, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=446",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ad4d676812b134ff8a3de263f77018b4 datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"round 1000 obtained",""],[10,"release verification",false,"provider: the signature is not a canonical point encoding, or does not verify as the BLS signature of round 1000 under datekeys:quicknet:v1: ERR_RELEASE_INVALID","ERR_RELEASE_INVALID"]]},
-  {"name":"release signature with the infinity flag and a payload","text":"provider: the signature is not a canonical point encoding, or does not verify as the BLS signature of round 1000 under datekeys:quicknet:v1: ERR_RELEASE_INVALID","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v1, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=446",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ad4d676812b134ff8a3de263f77018b4 datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"round 1000 obtained",""],[10,"release verification",false,"provider: the signature is not a canonical point encoding, or does not verify as the BLS signature of round 1000 under datekeys:quicknet:v1: ERR_RELEASE_INVALID","ERR_RELEASE_INVALID"]]},
-  {"name":"release signature negated","text":"provider: the signature is not a canonical point encoding, or does not verify as the BLS signature of round 1000 under datekeys:quicknet:v1: ERR_RELEASE_INVALID","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v1, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=446",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ad4d676812b134ff8a3de263f77018b4 datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"round 1000 obtained",""],[10,"release verification",false,"provider: the signature is not a canonical point encoding, or does not verify as the BLS signature of round 1000 under datekeys:quicknet:v1: ERR_RELEASE_INVALID","ERR_RELEASE_INVALID"]]},
-  {"name":"negated release signature and U re-encoded with c0 + p","text":"provider: the signature is not a canonical point encoding, or does not verify as the BLS signature of round 1000 under datekeys:quicknet:v1: ERR_RELEASE_INVALID","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v1, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=446",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ad4d676812b134ff8a3de263f77018b4 datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"round 1000 obtained",""],[10,"release verification",false,"provider: the signature is not a canonical point encoding, or does not verify as the BLS signature of round 1000 under datekeys:quicknet:v1: ERR_RELEASE_INVALID","ERR_RELEASE_INVALID"]]},
+  {"name":"tlock stanza U re-encoded with c0 + p","text":"capsule: age: agewrap: U of the tlock stanza is not the canonical encoding of a point of the key group: ERR_INTEGRITY","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v1, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=446",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ad4d676812b134ff8a3de263f77018b4 datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"release supplied by the caller",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",false,"capsule: age: agewrap: U of the tlock stanza is not the canonical encoding of a point of the key group: ERR_INTEGRITY","ERR_INTEGRITY"]]},
+  {"name":"tlock stanza U is the point at infinity","text":"capsule: age: agewrap: U of the tlock stanza is the point at infinity: ERR_INTEGRITY","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v1, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=446",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ad4d676812b134ff8a3de263f77018b4 datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"release supplied by the caller",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",false,"capsule: age: agewrap: U of the tlock stanza is the point at infinity: ERR_INTEGRITY","ERR_INTEGRITY"]]},
+  {"name":"tlock stanza U with the infinity flag and a payload","text":"capsule: age: agewrap: U of the tlock stanza is not the canonical encoding of a point of the key group: ERR_INTEGRITY","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v1, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=446",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ad4d676812b134ff8a3de263f77018b4 datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"release supplied by the caller",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",false,"capsule: age: agewrap: U of the tlock stanza is not the canonical encoding of a point of the key group: ERR_INTEGRITY","ERR_INTEGRITY"]]},
+  {"name":"tlock stanza body of 127 bytes","text":"capsule: age: agewrap: tlock stanza body of 127 bytes, want 128: ERR_INTEGRITY","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v1, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=445",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ad4d676812b134ff8a3de263f77018b4 datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"release supplied by the caller",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",false,"capsule: age: agewrap: tlock stanza body of 127 bytes, want 128: ERR_INTEGRITY","ERR_INTEGRITY"]]},
+  {"name":"tlock stanza body of 129 bytes","text":"capsule: age: agewrap: tlock stanza body of 129 bytes, want 128: ERR_INTEGRITY","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v1, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=447",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ad4d676812b134ff8a3de263f77018b4 datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"release supplied by the caller",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",false,"capsule: age: agewrap: tlock stanza body of 129 bytes, want 128: ERR_INTEGRITY","ERR_INTEGRITY"]]},
+  {"name":"release signature re-encoded with x + p","text":"provider: the signature is not a canonical point encoding, or does not verify as the BLS signature of round 1004 under datekeys:quicknet:v1: ERR_RELEASE_INVALID","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v1, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=446",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=250416bc1e6d8da84f5a69e47a9f66f2 datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwNH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1004, unlock at 2023-08-23T15:59:36Z",""],[8,"tlock stanza",true,"round 1004, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"release supplied by the caller",""],[10,"release verification",false,"provider: the signature is not a canonical point encoding, or does not verify as the BLS signature of round 1004 under datekeys:quicknet:v1: ERR_RELEASE_INVALID","ERR_RELEASE_INVALID"]]},
+  {"name":"release signature is the point at infinity","text":"provider: the signature is not a canonical point encoding, or does not verify as the BLS signature of round 1000 under datekeys:quicknet:v1: ERR_RELEASE_INVALID","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v1, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=446",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ad4d676812b134ff8a3de263f77018b4 datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"release supplied by the caller",""],[10,"release verification",false,"provider: the signature is not a canonical point encoding, or does not verify as the BLS signature of round 1000 under datekeys:quicknet:v1: ERR_RELEASE_INVALID","ERR_RELEASE_INVALID"]]},
+  {"name":"release signature with the infinity flag and a payload","text":"provider: the signature is not a canonical point encoding, or does not verify as the BLS signature of round 1000 under datekeys:quicknet:v1: ERR_RELEASE_INVALID","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v1, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=446",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ad4d676812b134ff8a3de263f77018b4 datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"release supplied by the caller",""],[10,"release verification",false,"provider: the signature is not a canonical point encoding, or does not verify as the BLS signature of round 1000 under datekeys:quicknet:v1: ERR_RELEASE_INVALID","ERR_RELEASE_INVALID"]]},
+  {"name":"release signature negated","text":"provider: the signature is not a canonical point encoding, or does not verify as the BLS signature of round 1000 under datekeys:quicknet:v1: ERR_RELEASE_INVALID","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v1, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=446",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ad4d676812b134ff8a3de263f77018b4 datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"release supplied by the caller",""],[10,"release verification",false,"provider: the signature is not a canonical point encoding, or does not verify as the BLS signature of round 1000 under datekeys:quicknet:v1: ERR_RELEASE_INVALID","ERR_RELEASE_INVALID"]]},
+  {"name":"negated release signature and U re-encoded with c0 + p","text":"provider: the signature is not a canonical point encoding, or does not verify as the BLS signature of round 1000 under datekeys:quicknet:v1: ERR_RELEASE_INVALID","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v1, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=446",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ad4d676812b134ff8a3de263f77018b4 datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"release supplied by the caller",""],[10,"release verification",false,"provider: the signature is not a canonical point encoding, or does not verify as the BLS signature of round 1000 under datekeys:quicknet:v1: ERR_RELEASE_INVALID","ERR_RELEASE_INVALID"]]},
   {"name":"magic","text":"capsule: ERR_INVALID_MAGIC","checks":[[1,"parse DKC1",false,"capsule: ERR_INVALID_MAGIC","ERR_INVALID_MAGIC"]]},
   {"name":"a .dkk offered as a .dkc","text":"capsule: ERR_INVALID_MAGIC","checks":[[1,"parse DKC1",false,"capsule: ERR_INVALID_MAGIC","ERR_INVALID_MAGIC"]]},
   {"name":"empty file","text":"capsule: ERR_INVALID_MAGIC","checks":[[1,"parse DKC1",false,"capsule: ERR_INVALID_MAGIC","ERR_INVALID_MAGIC"]]},
@@ -49,177 +49,181 @@
   {"name":"access_policy 256 with a consistent header_binding","text":"capsule: PUBLIC_HEADER: key 4: access_policy 256 is not defined in V1: ERR_NON_CANONICAL_CBOR","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v1, PUBLIC_HEADER_LEN=123, SEALED_CONTROL_LEN=446",""],[3,"public header",true,"123 bytes",""],[4,"header validation",false,"capsule: PUBLIC_HEADER: key 4: access_policy 256 is not defined in V1: ERR_NON_CANONICAL_CBOR","ERR_NON_CANONICAL_CBOR"]]},
   {"name":"access_policy 257 with a consistent header_binding","text":"capsule: PUBLIC_HEADER: key 4: access_policy 257 is not defined in V1: ERR_NON_CANONICAL_CBOR","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v1, PUBLIC_HEADER_LEN=123, SEALED_CONTROL_LEN=446",""],[3,"public header",true,"123 bytes",""],[4,"header validation",false,"capsule: PUBLIC_HEADER: key 4: access_policy 257 is not defined in V1: ERR_NON_CANONICAL_CBOR","ERR_NON_CANONICAL_CBOR"]]},
   {"name":"unknown critical PUBLIC_HEADER extension","text":"capsule: PUBLIC_HEADER: extension org.example.must-understand v1: ERR_EXTENSION_CRITICAL_UNKNOWN","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v1, PUBLIC_HEADER_LEN=156, SEALED_CONTROL_LEN=446",""],[3,"public header",true,"156 bytes",""],[4,"header validation",false,"capsule: PUBLIC_HEADER: extension org.example.must-understand v1: ERR_EXTENSION_CRITICAL_UNKNOWN","ERR_EXTENSION_CRITICAL_UNKNOWN"]]},
-  {"name":"unknown critical CONTROL_CBOR extension","text":"capsule: CONTROL_CBOR: extension org.example.must-understand v1: ERR_EXTENSION_CRITICAL_UNKNOWN","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v1, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=481",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=6946e5bb3f531636f39c35aaa686a627 datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"round 1000 obtained",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",false,"capsule: CONTROL_CBOR: extension org.example.must-understand v1: ERR_EXTENSION_CRITICAL_UNKNOWN","ERR_EXTENSION_CRITICAL_UNKNOWN"]]},
+  {"name":"unknown critical CONTROL_CBOR extension","text":"capsule: CONTROL_CBOR: extension org.example.must-understand v1: ERR_EXTENSION_CRITICAL_UNKNOWN","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v1, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=481",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=6946e5bb3f531636f39c35aaa686a627 datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"release supplied by the caller",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",false,"capsule: CONTROL_CBOR: extension org.example.must-understand v1: ERR_EXTENSION_CRITICAL_UNKNOWN","ERR_EXTENSION_CRITICAL_UNKNOWN"]]},
   {"name":"known critical PUBLIC_HEADER extension with invalid data","text":"capsule: PUBLIC_HEADER: extension org.example.must-understand v1: data: data 6b6f is not 6f6b: ERR_EXTENSION_DATA_INVALID","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v1, PUBLIC_HEADER_LEN=160, SEALED_CONTROL_LEN=446",""],[3,"public header",true,"160 bytes",""],[4,"header validation",false,"capsule: PUBLIC_HEADER: extension org.example.must-understand v1: data: data 6b6f is not 6f6b: ERR_EXTENSION_DATA_INVALID","ERR_EXTENSION_DATA_INVALID"]]},
-  {"name":"known critical CONTROL_CBOR extension with invalid data","text":"capsule: CONTROL_CBOR: extension org.example.must-understand v1: data: data 6b6f is not 6f6b: ERR_EXTENSION_DATA_INVALID","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v1, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=485",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=150c4bed590fa8b69b37b24fe7449e74 datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"round 1000 obtained",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",false,"capsule: CONTROL_CBOR: extension org.example.must-understand v1: data: data 6b6f is not 6f6b: ERR_EXTENSION_DATA_INVALID","ERR_EXTENSION_DATA_INVALID"]]},
+  {"name":"known critical CONTROL_CBOR extension with invalid data","text":"capsule: CONTROL_CBOR: extension org.example.must-understand v1: data: data 6b6f is not 6f6b: ERR_EXTENSION_DATA_INVALID","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v1, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=485",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=150c4bed590fa8b69b37b24fe7449e74 datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"release supplied by the caller",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",false,"capsule: CONTROL_CBOR: extension org.example.must-understand v1: data: data 6b6f is not 6f6b: ERR_EXTENSION_DATA_INVALID","ERR_EXTENSION_DATA_INVALID"]]},
   {"name":"known critical .dkk extension with invalid data","text":"capsule: .dkk: extension org.example.must-understand v1: data: data 6b6f is not 6f6b: ERR_EXTENSION_DATA_INVALID","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v1, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=646",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=448e134a13457c319cab7fceaf7ffa1f datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_and_key profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"access credential",false,"capsule: .dkk: extension org.example.must-understand v1: data: data 6b6f is not 6f6b: ERR_EXTENSION_DATA_INVALID","ERR_EXTENSION_DATA_INVALID"]]},
   {"name":"extension_version above 2^32-1","text":"capsule: PUBLIC_HEADER: key 6: extension \"org.example.label\": key 1: codec: offset 153: unsigned integer 4294967296 above 4294967295: ERR_NON_CANONICAL_CBOR","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v1, PUBLIC_HEADER_LEN=153, SEALED_CONTROL_LEN=446",""],[3,"public header",true,"153 bytes",""],[4,"header validation",false,"capsule: PUBLIC_HEADER: key 6: extension \"org.example.label\": key 1: codec: offset 153: unsigned integer 4294967296 above 4294967295: ERR_NON_CANONICAL_CBOR","ERR_NON_CANONICAL_CBOR"]]},
   {"name":"null extension data","text":"capsule: PUBLIC_HEADER: key 6: extension \"org.example.label\": key 2: codec: offset 146: a float or simple value (initial byte 0xf6) is outside the CBOR profile: ERR_NON_CANONICAL_CBOR","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v1, PUBLIC_HEADER_LEN=147, SEALED_CONTROL_LEN=446",""],[3,"public header",true,"147 bytes",""],[4,"header validation",false,"capsule: PUBLIC_HEADER: key 6: extension \"org.example.label\": key 2: codec: offset 146: a float or simple value (initial byte 0xf6) is outside the CBOR profile: ERR_NON_CANONICAL_CBOR","ERR_NON_CANONICAL_CBOR"]]},
   {"name":"time_and_key without credentials","text":"capsule: time_and_key capsule and no identity or .dkk supplied: ERR_ACCESS_REQUIRED","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v1, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=646",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=448e134a13457c319cab7fceaf7ffa1f datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_and_key profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"access credential",false,"capsule: time_and_key capsule and no identity or .dkk supplied: ERR_ACCESS_REQUIRED","ERR_ACCESS_REQUIRED"]]},
   {"name":".dkk of another capsule","text":"capsule: the .dkk is for capsule c75dfc8e9c576d1369910664df93693a, this is 448e134a13457c319cab7fceaf7ffa1f: ERR_ACCESS_INVALID","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v1, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=646",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=448e134a13457c319cab7fceaf7ffa1f datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_and_key profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"access credential",false,"capsule: the .dkk is for capsule c75dfc8e9c576d1369910664df93693a, this is 448e134a13457c319cab7fceaf7ffa1f: ERR_ACCESS_INVALID","ERR_ACCESS_INVALID"]]},
   {"name":"capsule_digest of the .dkk does not match","text":"capsule: the .dkk capsule_digest does not match this .dkc: ERR_ACCESS_INVALID","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v1, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=646",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=448e134a13457c319cab7fceaf7ffa1f datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_and_key profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"access credential",false,"capsule: the .dkk capsule_digest does not match this .dkc: ERR_ACCESS_INVALID","ERR_ACCESS_INVALID"]]},
-  {"name":"identity that is not a recipient","text":"capsule: age: agewrap: no supplied identity is a recipient of INNER_ACCESS_AGE: ERR_ACCESS_INVALID","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v1, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=646",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=448e134a13457c319cab7fceaf7ffa1f datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_and_key profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"access credential",true,"1 identities to try",""],[9,"release",true,"round 1000 obtained",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_and_key: INNER_ACCESS_AGE with 1 X25519 stanzas",""],[13,"open access layer",false,"capsule: age: agewrap: no supplied identity is a recipient of INNER_ACCESS_AGE: ERR_ACCESS_INVALID","ERR_ACCESS_INVALID"]]},
-  {"name":"round not reached yet","text":"capsule: round 1000 is published at 2023-08-23T15:59:24Z, it is 2023-08-23T15:59:23Z: ERR_RELEASE_UNAVAILABLE","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v1, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=446",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ad4d676812b134ff8a3de263f77018b4 datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",false,"capsule: round 1000 is published at 2023-08-23T15:59:24Z, it is 2023-08-23T15:59:23Z: ERR_RELEASE_UNAVAILABLE","ERR_RELEASE_UNAVAILABLE"]]},
+  {"name":"identity that is not a recipient","text":"capsule: age: agewrap: no supplied identity is a recipient of INNER_ACCESS_AGE: ERR_ACCESS_INVALID","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v1, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=646",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=448e134a13457c319cab7fceaf7ffa1f datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_and_key profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"access credential",true,"1 identities to try",""],[9,"release",true,"release supplied by the caller",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_and_key: INNER_ACCESS_AGE with 1 X25519 stanzas",""],[13,"open access layer",false,"capsule: age: agewrap: no supplied identity is a recipient of INNER_ACCESS_AGE: ERR_ACCESS_INVALID","ERR_ACCESS_INVALID"]]},
+  {"name":"round not reached yet","text":"ok","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v1, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=446",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ad4d676812b134ff8a3de263f77018b4 datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"release supplied by the caller; round 1000 is published at 2023-08-23T15:59:24Z and the clock says 2023-08-23T15:59:23Z: it may be behind",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",true,"canonical CONTROL_CBOR",""],[15,"header binding",true,"matches",""],[16,"payload identity",true,"I_PAYLOAD recovered",""],[17,"open payload",true,"payload authenticated",""],[18,"commit",true,"78000 bytes of content",""]]},
   {"name":"release source unavailable","text":"testkit: no release: ERR_RELEASE_UNAVAILABLE","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v1, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=446",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ad4d676812b134ff8a3de263f77018b4 datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",false,"testkit: no release: ERR_RELEASE_UNAVAILABLE","ERR_RELEASE_UNAVAILABLE"]]},
-  {"name":"trailing data after PAYLOAD_AGE","text":"capsule: PAYLOAD_AGE: the age payload is truncated, has trailing data or fails STREAM authentication: ERR_INTEGRITY","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v1, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=446",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ad4d676812b134ff8a3de263f77018b4 datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"round 1000 obtained",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",true,"canonical CONTROL_CBOR",""],[15,"header binding",true,"matches",""],[16,"payload identity",true,"I_PAYLOAD recovered",""],[17,"open payload",false,"capsule: PAYLOAD_AGE: the age payload is truncated, has trailing data or fails STREAM authentication: ERR_INTEGRITY","ERR_INTEGRITY"]]},
-  {"name":"payload stanza body modified","text":"capsule: PAYLOAD_AGE: agewrap: PAYLOAD_AGE is not encrypted to this control's R_PAYLOAD: ERR_INTEGRITY","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v1, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=446",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ad4d676812b134ff8a3de263f77018b4 datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"round 1000 obtained",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",true,"canonical CONTROL_CBOR",""],[15,"header binding",true,"matches",""],[16,"payload identity",true,"I_PAYLOAD recovered",""],[17,"open payload",false,"capsule: PAYLOAD_AGE: agewrap: PAYLOAD_AGE is not encrypted to this control's R_PAYLOAD: ERR_INTEGRITY","ERR_INTEGRITY"]]},
+  {"name":"trailing data after PAYLOAD_AGE","text":"capsule: PAYLOAD_AGE: the age payload is truncated, has trailing data or fails STREAM authentication: ERR_INTEGRITY","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v1, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=446",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ad4d676812b134ff8a3de263f77018b4 datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"release supplied by the caller",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",true,"canonical CONTROL_CBOR",""],[15,"header binding",true,"matches",""],[16,"payload identity",true,"I_PAYLOAD recovered",""],[17,"open payload",false,"capsule: PAYLOAD_AGE: the age payload is truncated, has trailing data or fails STREAM authentication: ERR_INTEGRITY","ERR_INTEGRITY"]]},
+  {"name":"payload stanza body modified","text":"capsule: PAYLOAD_AGE: agewrap: PAYLOAD_AGE is not encrypted to this control's R_PAYLOAD: ERR_INTEGRITY","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v1, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=446",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ad4d676812b134ff8a3de263f77018b4 datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"release supplied by the caller",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",true,"canonical CONTROL_CBOR",""],[15,"header binding",true,"matches",""],[16,"payload identity",true,"I_PAYLOAD recovered",""],[17,"open payload",false,"capsule: PAYLOAD_AGE: agewrap: PAYLOAD_AGE is not encrypted to this control's R_PAYLOAD: ERR_INTEGRITY","ERR_INTEGRITY"]]},
   {"name":"tlock round edited by a third party","text":"agewrap: tlock stanza round \"1001\", DateKey round 1000: ERR_ROUND_MISMATCH","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v1, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=446",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ad4d676812b134ff8a3de263f77018b4 datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",false,"agewrap: tlock stanza round \"1001\", DateKey round 1000: ERR_ROUND_MISMATCH","ERR_ROUND_MISMATCH"]]},
   {"name":"empty registry","text":"capsule: profile \"datekeys:quicknet:v1\" is not pinned: ERR_UNKNOWN_PROFILE","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v1, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=446",""],[3,"public header",true,"121 bytes",""],[4,"header validation",false,"capsule: profile \"datekeys:quicknet:v1\" is not pinned: ERR_UNKNOWN_PROFILE","ERR_UNKNOWN_PROFILE"]]},
-  {"name":"time_only declared, time_and_key built by the creator","text":"capsule: time_only capsule seals an age file: ERR_POLICY_STRUCTURE_MISMATCH","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v1, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=646",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=238e2912d6448dce358dec034cc73984 datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"round 1000 obtained",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",false,"capsule: time_only capsule seals an age file: ERR_POLICY_STRUCTURE_MISMATCH","ERR_POLICY_STRUCTURE_MISMATCH"]]},
-  {"name":"time_and_key declared, time_only built by the creator","text":"capsule: time_and_key capsule does not seal an age file: ERR_POLICY_STRUCTURE_MISMATCH","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v1, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=446",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=a44c9b18fda29aea727f5398ecf967ce datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_and_key profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"access credential",true,"1 identities to try",""],[9,"release",true,"round 1000 obtained",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",false,"capsule: time_and_key capsule does not seal an age file: ERR_POLICY_STRUCTURE_MISMATCH","ERR_POLICY_STRUCTURE_MISMATCH"]]},
-  {"name":"two INNER_ACCESS_AGE stanzas for one recipient","text":"capsule: age: agewrap: one identity opens 2 INNER_ACCESS_AGE stanzas, want one per recipient: ERR_POLICY_STRUCTURE_MISMATCH","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v1, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=744",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=1d983beefec16c1a312696440735330c datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_and_key profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"access credential",true,"1 identities to try",""],[9,"release",true,"round 1000 obtained",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_and_key: INNER_ACCESS_AGE with 2 X25519 stanzas",""],[13,"open access layer",false,"capsule: age: agewrap: one identity opens 2 INNER_ACCESS_AGE stanzas, want one per recipient: ERR_POLICY_STRUCTURE_MISMATCH","ERR_POLICY_STRUCTURE_MISMATCH"]]},
-  {"name":"format 2: PUBLIC_HEADER_A + SEALED_CONTROL_B","text":"capsule: header_binding does not match PRELUDE || PUBLIC_HEADER: ERR_HEADER_BINDING","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v2, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=c8cfc53d45c879da916edddf71f3bddd datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"round 1000 obtained",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",true,"canonical CONTROL_CBOR",""],[15,"header binding",false,"capsule: header_binding does not match PRELUDE || PUBLIC_HEADER: ERR_HEADER_BINDING","ERR_HEADER_BINDING"]]},
-  {"name":"format 2: SEALED_CONTROL_A + PAYLOAD_AGE_B","text":"capsule: PAYLOAD_AGE: agewrap: PAYLOAD_AGE is not encrypted to this control's R_PAYLOAD: ERR_INTEGRITY","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v2, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=c8cfc53d45c879da916edddf71f3bddd datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"round 1000 obtained",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",true,"canonical CONTROL_CBOR",""],[15,"header binding",true,"matches",""],[16,"payload identity",true,"I_PAYLOAD recovered; L = 78000, padding reforzado, P = 79872",""],[17,"open payload",false,"capsule: PAYLOAD_AGE: agewrap: PAYLOAD_AGE is not encrypted to this control's R_PAYLOAD: ERR_INTEGRITY","ERR_INTEGRITY"]]},
-  {"name":"format 2: DateKey A + release of round B","text":"provider: release for round 1001, expected 1000: ERR_ROUND_MISMATCH","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v2, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=c8cfc53d45c879da916edddf71f3bddd datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"round 1001 obtained",""],[10,"release verification",false,"provider: release for round 1001, expected 1000: ERR_ROUND_MISMATCH","ERR_ROUND_MISMATCH"]]},
+  {"name":"time_only declared, time_and_key built by the creator","text":"capsule: time_only capsule seals an age file: ERR_POLICY_STRUCTURE_MISMATCH","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v1, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=646",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=238e2912d6448dce358dec034cc73984 datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"release supplied by the caller",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",false,"capsule: time_only capsule seals an age file: ERR_POLICY_STRUCTURE_MISMATCH","ERR_POLICY_STRUCTURE_MISMATCH"]]},
+  {"name":"time_and_key declared, time_only built by the creator","text":"capsule: time_and_key capsule does not seal an age file: ERR_POLICY_STRUCTURE_MISMATCH","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v1, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=446",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=a44c9b18fda29aea727f5398ecf967ce datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_and_key profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"access credential",true,"1 identities to try",""],[9,"release",true,"release supplied by the caller",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",false,"capsule: time_and_key capsule does not seal an age file: ERR_POLICY_STRUCTURE_MISMATCH","ERR_POLICY_STRUCTURE_MISMATCH"]]},
+  {"name":"two INNER_ACCESS_AGE stanzas for one recipient","text":"capsule: age: agewrap: one identity opens 2 INNER_ACCESS_AGE stanzas, want one per recipient: ERR_POLICY_STRUCTURE_MISMATCH","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v1, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=744",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=1d983beefec16c1a312696440735330c datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_and_key profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"access credential",true,"1 identities to try",""],[9,"release",true,"release supplied by the caller",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_and_key: INNER_ACCESS_AGE with 2 X25519 stanzas",""],[13,"open access layer",false,"capsule: age: agewrap: one identity opens 2 INNER_ACCESS_AGE stanzas, want one per recipient: ERR_POLICY_STRUCTURE_MISMATCH","ERR_POLICY_STRUCTURE_MISMATCH"]]},
+  {"name":"format 2: PUBLIC_HEADER_A + SEALED_CONTROL_B","text":"capsule: header_binding does not match PRELUDE || PUBLIC_HEADER: ERR_HEADER_BINDING","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v2, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=c8cfc53d45c879da916edddf71f3bddd datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"release supplied by the caller",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",true,"canonical CONTROL_CBOR",""],[15,"header binding",false,"capsule: header_binding does not match PRELUDE || PUBLIC_HEADER: ERR_HEADER_BINDING","ERR_HEADER_BINDING"]]},
+  {"name":"format 2: SEALED_CONTROL_A + PAYLOAD_AGE_B","text":"capsule: PAYLOAD_AGE: agewrap: PAYLOAD_AGE is not encrypted to this control's R_PAYLOAD: ERR_INTEGRITY","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v2, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=c8cfc53d45c879da916edddf71f3bddd datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"release supplied by the caller",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",true,"canonical CONTROL_CBOR",""],[15,"header binding",true,"matches",""],[16,"payload identity",true,"I_PAYLOAD recovered; L = 78000, padding reforzado, P = 79872",""],[17,"open payload",false,"capsule: PAYLOAD_AGE: agewrap: PAYLOAD_AGE is not encrypted to this control's R_PAYLOAD: ERR_INTEGRITY","ERR_INTEGRITY"]]},
+  {"name":"format 2: DateKey A + release of round B","text":"provider: release for round 1001, expected 1000: ERR_ROUND_MISMATCH","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v2, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=c8cfc53d45c879da916edddf71f3bddd datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"release supplied by the caller",""],[10,"release verification",false,"provider: release for round 1001, expected 1000: ERR_ROUND_MISMATCH","ERR_ROUND_MISMATCH"]]},
   {"name":"format 2: chain hash changed","text":"agewrap: tlock stanza chain hash \"abababababababababababababababababababababababababababababababab\", pinned profile datekeys:quicknet:v1 uses 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971: ERR_PROFILE_MISMATCH","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v2, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=c8cfc53d45c879da916edddf71f3bddd datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",false,"agewrap: tlock stanza chain hash \"abababababababababababababababababababababababababababababababab\", pinned profile datekeys:quicknet:v1 uses 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971: ERR_PROFILE_MISMATCH","ERR_PROFILE_MISMATCH"]]},
   {"name":"format 2: version changed","text":"capsule: framing version 4: ERR_UNSUPPORTED_VERSION","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",false,"capsule: framing version 4: ERR_UNSUPPORTED_VERSION","ERR_UNSUPPORTED_VERSION"]]},
   {"name":"format 2: flags != 0","text":"capsule: flags 0x80, reserved 0x0000: ERR_INVALID_FLAGS","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",false,"capsule: flags 0x80, reserved 0x0000: ERR_INVALID_FLAGS","ERR_INVALID_FLAGS"]]},
   {"name":"format 2: reserved != 0","text":"capsule: flags 0x0, reserved 0x0001: ERR_INVALID_FLAGS","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",false,"capsule: flags 0x0, reserved 0x0001: ERR_INVALID_FLAGS","ERR_INVALID_FLAGS"]]},
-  {"name":"format 2: payload truncated","text":"capsule: PAYLOAD_AGE: the age payload is truncated, has trailing data or fails STREAM authentication: ERR_INTEGRITY","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v2, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=c8cfc53d45c879da916edddf71f3bddd datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"round 1000 obtained",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",true,"canonical CONTROL_CBOR",""],[15,"header binding",true,"matches",""],[16,"payload identity",true,"I_PAYLOAD recovered; L = 78000, padding reforzado, P = 79872",""],[17,"open payload",false,"capsule: PAYLOAD_AGE: the age payload is truncated, has trailing data or fails STREAM authentication: ERR_INTEGRITY","ERR_INTEGRITY"]]},
-  {"name":"format 2: payload age modified","text":"capsule: PAYLOAD_AGE: the age payload is truncated, has trailing data or fails STREAM authentication: ERR_INTEGRITY","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v2, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=c8cfc53d45c879da916edddf71f3bddd datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"round 1000 obtained",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",true,"canonical CONTROL_CBOR",""],[15,"header binding",true,"matches",""],[16,"payload identity",true,"I_PAYLOAD recovered; L = 78000, padding reforzado, P = 79872",""],[17,"open payload",false,"capsule: PAYLOAD_AGE: the age payload is truncated, has trailing data or fails STREAM authentication: ERR_INTEGRITY","ERR_INTEGRITY"]]},
-  {"name":"format 2: control modified","text":"capsule: age: the age payload is truncated, has trailing data or fails STREAM authentication: ERR_INTEGRITY","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v2, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=c8cfc53d45c879da916edddf71f3bddd datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"round 1000 obtained",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",false,"capsule: age: the age payload is truncated, has trailing data or fails STREAM authentication: ERR_INTEGRITY","ERR_INTEGRITY"]]},
+  {"name":"format 2: payload truncated","text":"capsule: PAYLOAD_AGE: the age payload is truncated, has trailing data or fails STREAM authentication: ERR_INTEGRITY","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v2, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=c8cfc53d45c879da916edddf71f3bddd datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"release supplied by the caller",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",true,"canonical CONTROL_CBOR",""],[15,"header binding",true,"matches",""],[16,"payload identity",true,"I_PAYLOAD recovered; L = 78000, padding reforzado, P = 79872",""],[17,"open payload",false,"capsule: PAYLOAD_AGE: the age payload is truncated, has trailing data or fails STREAM authentication: ERR_INTEGRITY","ERR_INTEGRITY"]]},
+  {"name":"format 2: payload age modified","text":"capsule: PAYLOAD_AGE: the age payload is truncated, has trailing data or fails STREAM authentication: ERR_INTEGRITY","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v2, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=c8cfc53d45c879da916edddf71f3bddd datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"release supplied by the caller",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",true,"canonical CONTROL_CBOR",""],[15,"header binding",true,"matches",""],[16,"payload identity",true,"I_PAYLOAD recovered; L = 78000, padding reforzado, P = 79872",""],[17,"open payload",false,"capsule: PAYLOAD_AGE: the age payload is truncated, has trailing data or fails STREAM authentication: ERR_INTEGRITY","ERR_INTEGRITY"]]},
+  {"name":"format 2: control modified","text":"capsule: age: the age payload is truncated, has trailing data or fails STREAM authentication: ERR_INTEGRITY","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v2, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=c8cfc53d45c879da916edddf71f3bddd datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"release supplied by the caller",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",false,"capsule: age: the age payload is truncated, has trailing data or fails STREAM authentication: ERR_INTEGRITY","ERR_INTEGRITY"]]},
   {"name":"format 2: non-canonical dk1_ JSON","text":"capsule: PUBLIC_HEADER: datekey: not the canonical encoding dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0: ERR_DATEKEY_NON_CANONICAL","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v2, PUBLIC_HEADER_LEN=124, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"124 bytes",""],[4,"header validation",false,"capsule: PUBLIC_HEADER: datekey: not the canonical encoding dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0: ERR_DATEKEY_NON_CANONICAL","ERR_DATEKEY_NON_CANONICAL"]]},
   {"name":"format 2: unknown profile","text":"capsule: profile \"datekeys:evmnet:v1\" is not pinned: ERR_UNKNOWN_PROFILE","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v2, PUBLIC_HEADER_LEN=118, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"118 bytes",""],[4,"header validation",false,"capsule: profile \"datekeys:evmnet:v1\" is not pinned: ERR_UNKNOWN_PROFILE","ERR_UNKNOWN_PROFILE"]]},
-  {"name":"format 2: release of another round","text":"provider: the signature is not a canonical point encoding, or does not verify as the BLS signature of round 1000 under datekeys:quicknet:v1: ERR_RELEASE_INVALID","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v2, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=c8cfc53d45c879da916edddf71f3bddd datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"round 1000 obtained",""],[10,"release verification",false,"provider: the signature is not a canonical point encoding, or does not verify as the BLS signature of round 1000 under datekeys:quicknet:v1: ERR_RELEASE_INVALID","ERR_RELEASE_INVALID"]]},
-  {"name":"format 2: access_policy=time_only with time_and_key structure","text":"capsule: time_only capsule seals an age file: ERR_POLICY_STRUCTURE_MISMATCH","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v2, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=2128",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=fe68d3b3bb59db0c14b7ef57d8d6cb5e datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"round 1000 obtained",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",false,"capsule: time_only capsule seals an age file: ERR_POLICY_STRUCTURE_MISMATCH","ERR_POLICY_STRUCTURE_MISMATCH"]]},
-  {"name":"format 2: access_policy=time_and_key with time_only structure","text":"capsule: time_and_key capsule does not seal an age file: ERR_POLICY_STRUCTURE_MISMATCH","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v2, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=c8cfc53d45c879da916edddf71f3bddd datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_and_key profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"access credential",true,"1 identities to try",""],[9,"release",true,"round 1000 obtained",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",false,"capsule: time_and_key capsule does not seal an age file: ERR_POLICY_STRUCTURE_MISMATCH","ERR_POLICY_STRUCTURE_MISMATCH"]]},
+  {"name":"format 2: release of another round","text":"provider: the signature is not a canonical point encoding, or does not verify as the BLS signature of round 1000 under datekeys:quicknet:v1: ERR_RELEASE_INVALID","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v2, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=c8cfc53d45c879da916edddf71f3bddd datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"release supplied by the caller",""],[10,"release verification",false,"provider: the signature is not a canonical point encoding, or does not verify as the BLS signature of round 1000 under datekeys:quicknet:v1: ERR_RELEASE_INVALID","ERR_RELEASE_INVALID"]]},
+  {"name":"format 2: access_policy=time_only with time_and_key structure","text":"capsule: time_only capsule seals an age file: ERR_POLICY_STRUCTURE_MISMATCH","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v2, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=2128",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=fe68d3b3bb59db0c14b7ef57d8d6cb5e datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"release supplied by the caller",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",false,"capsule: time_only capsule seals an age file: ERR_POLICY_STRUCTURE_MISMATCH","ERR_POLICY_STRUCTURE_MISMATCH"]]},
+  {"name":"format 2: access_policy=time_and_key with time_only structure","text":"capsule: time_and_key capsule does not seal an age file: ERR_POLICY_STRUCTURE_MISMATCH","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v2, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=c8cfc53d45c879da916edddf71f3bddd datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_and_key profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"access credential",true,"1 identities to try",""],[9,"release",true,"release supplied by the caller",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",false,"capsule: time_and_key capsule does not seal an age file: ERR_POLICY_STRUCTURE_MISMATCH","ERR_POLICY_STRUCTURE_MISMATCH"]]},
   {"name":"format 2: extra stanza in OUTER_TIME_AGE","text":"capsule: OUTER_TIME_AGE must hold exactly one tlock stanza, found 2: ERR_POLICY_STRUCTURE_MISMATCH","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v2, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=556",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=9667d509fc51ccede898d232ce74d47f datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",false,"capsule: OUTER_TIME_AGE must hold exactly one tlock stanza, found 2: ERR_POLICY_STRUCTURE_MISMATCH","ERR_POLICY_STRUCTURE_MISMATCH"]]},
   {"name":"format 2: extra stanza in PAYLOAD_AGE","text":"agewrap: PAYLOAD_AGE has 2 stanzas, want exactly one X25519 stanza: ERR_POLICY_STRUCTURE_MISMATCH","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v2, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=4938a3c96f0d6e9a5e0d81dc533705c2 datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",false,"agewrap: PAYLOAD_AGE has 2 stanzas, want exactly one X25519 stanza: ERR_POLICY_STRUCTURE_MISMATCH","ERR_POLICY_STRUCTURE_MISMATCH"]]},
-  {"name":"format 2: non-X25519 stanza in INNER_ACCESS_AGE","text":"agewrap: INNER_ACCESS_AGE stanza 15 has type \"scrypt\", want \"X25519\": ERR_POLICY_STRUCTURE_MISMATCH","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v2, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=2110",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=4100a310fc7101779e8af7d1c91669c6 datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_and_key profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"access credential",true,"1 identities to try",""],[9,"release",true,"round 1000 obtained",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",false,"agewrap: INNER_ACCESS_AGE stanza 15 has type \"scrypt\", want \"X25519\": ERR_POLICY_STRUCTURE_MISMATCH","ERR_POLICY_STRUCTURE_MISMATCH"]]},
+  {"name":"format 2: non-X25519 stanza in INNER_ACCESS_AGE","text":"agewrap: INNER_ACCESS_AGE stanza 15 has type \"scrypt\", want \"X25519\": ERR_POLICY_STRUCTURE_MISMATCH","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v2, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=2110",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=4100a310fc7101779e8af7d1c91669c6 datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_and_key profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"access credential",true,"1 identities to try",""],[9,"release",true,"release supplied by the caller",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",false,"agewrap: INNER_ACCESS_AGE stanza 15 has type \"scrypt\", want \"X25519\": ERR_POLICY_STRUCTURE_MISMATCH","ERR_POLICY_STRUCTURE_MISMATCH"]]},
   {"name":"format 2: tlock stanza round differs from DateKey.round","text":"agewrap: tlock stanza round \"1001\", DateKey round 1000: ERR_ROUND_MISMATCH","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v2, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=218abdaca3c0fec6e495e75ebd783d80 datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",false,"agewrap: tlock stanza round \"1001\", DateKey round 1000: ERR_ROUND_MISMATCH","ERR_ROUND_MISMATCH"]]},
   {"name":"format 2: tlock stanza chain hash differs from the pinned profile","text":"agewrap: tlock stanza chain hash \"dbd506d6ef76e5f386f41c651dcb808c5bcbd75471cc4eafa3f4df7ad4e4c493\", pinned profile datekeys:quicknet:v1 uses 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971: ERR_PROFILE_MISMATCH","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v2, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=1a9e26924b25a9b70ecd24fa769672d8 datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",false,"agewrap: tlock stanza chain hash \"dbd506d6ef76e5f386f41c651dcb808c5bcbd75471cc4eafa3f4df7ad4e4c493\", pinned profile datekeys:quicknet:v1 uses 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971: ERR_PROFILE_MISMATCH","ERR_PROFILE_MISMATCH"]]},
   {"name":"format 2: extension data of a type other than bstr","text":"capsule: PUBLIC_HEADER: key 6: extension \"org.example.label\": key 2: codec: offset 146: a text string where a byte string was expected: ERR_NON_CANONICAL_CBOR","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v2, PUBLIC_HEADER_LEN=159, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"159 bytes",""],[4,"header validation",false,"capsule: PUBLIC_HEADER: key 6: extension \"org.example.label\": key 2: codec: offset 146: a text string where a byte string was expected: ERR_NON_CANONICAL_CBOR","ERR_NON_CANONICAL_CBOR"]]},
   {"name":"format 2: empty extension data (h'')","text":"capsule: PUBLIC_HEADER: key 6: extension \"org.example.label\": data is present but empty; an extension without data omits key 2: ERR_NON_CANONICAL_CBOR","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v2, PUBLIC_HEADER_LEN=147, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"147 bytes",""],[4,"header validation",false,"capsule: PUBLIC_HEADER: key 6: extension \"org.example.label\": data is present but empty; an extension without data omits key 2: ERR_NON_CANONICAL_CBOR","ERR_NON_CANONICAL_CBOR"]]},
   {"name":"format 2: 65 extensions in one array","text":"capsule: PUBLIC_HEADER: key 6: extension: codec: offset 124: array of 65 items, at most 64: ERR_NON_CANONICAL_CBOR","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v2, PUBLIC_HEADER_LEN=1424, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"1424 bytes",""],[4,"header validation",false,"capsule: PUBLIC_HEADER: key 6: extension: codec: offset 124: array of 65 items, at most 64: ERR_NON_CANONICAL_CBOR","ERR_NON_CANONICAL_CBOR"]]},
-  {"name":"format 2: tlock stanza U re-encoded with c0 + p","text":"capsule: age: agewrap: U of the tlock stanza is not the canonical encoding of a point of the key group: ERR_INTEGRITY","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v2, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=c8cfc53d45c879da916edddf71f3bddd datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"round 1000 obtained",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",false,"capsule: age: agewrap: U of the tlock stanza is not the canonical encoding of a point of the key group: ERR_INTEGRITY","ERR_INTEGRITY"]]},
-  {"name":"format 2: tlock stanza U is the point at infinity","text":"capsule: age: agewrap: U of the tlock stanza is the point at infinity: ERR_INTEGRITY","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v2, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=c8cfc53d45c879da916edddf71f3bddd datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"round 1000 obtained",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",false,"capsule: age: agewrap: U of the tlock stanza is the point at infinity: ERR_INTEGRITY","ERR_INTEGRITY"]]},
-  {"name":"format 2: tlock stanza U with the infinity flag and a payload","text":"capsule: age: agewrap: U of the tlock stanza is not the canonical encoding of a point of the key group: ERR_INTEGRITY","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v2, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=c8cfc53d45c879da916edddf71f3bddd datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"round 1000 obtained",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",false,"capsule: age: agewrap: U of the tlock stanza is not the canonical encoding of a point of the key group: ERR_INTEGRITY","ERR_INTEGRITY"]]},
-  {"name":"format 2: tlock stanza body of 127 bytes","text":"capsule: age: agewrap: tlock stanza body of 127 bytes, want 128: ERR_INTEGRITY","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v2, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=457",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=c8cfc53d45c879da916edddf71f3bddd datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"round 1000 obtained",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",false,"capsule: age: agewrap: tlock stanza body of 127 bytes, want 128: ERR_INTEGRITY","ERR_INTEGRITY"]]},
-  {"name":"format 2: tlock stanza body of 129 bytes","text":"capsule: age: agewrap: tlock stanza body of 129 bytes, want 128: ERR_INTEGRITY","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v2, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=459",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=c8cfc53d45c879da916edddf71f3bddd datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"round 1000 obtained",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",false,"capsule: age: agewrap: tlock stanza body of 129 bytes, want 128: ERR_INTEGRITY","ERR_INTEGRITY"]]},
-  {"name":"format 2: release signature re-encoded with x + p","text":"provider: the signature is not a canonical point encoding, or does not verify as the BLS signature of round 1004 under datekeys:quicknet:v1: ERR_RELEASE_INVALID","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v2, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=dbb9bc102bb15061d58e9c17d302e06f datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwNH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1004, unlock at 2023-08-23T15:59:36Z",""],[8,"tlock stanza",true,"round 1004, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"round 1004 obtained",""],[10,"release verification",false,"provider: the signature is not a canonical point encoding, or does not verify as the BLS signature of round 1004 under datekeys:quicknet:v1: ERR_RELEASE_INVALID","ERR_RELEASE_INVALID"]]},
-  {"name":"format 2: release signature is the point at infinity","text":"provider: the signature is not a canonical point encoding, or does not verify as the BLS signature of round 1000 under datekeys:quicknet:v1: ERR_RELEASE_INVALID","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v2, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=c8cfc53d45c879da916edddf71f3bddd datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"round 1000 obtained",""],[10,"release verification",false,"provider: the signature is not a canonical point encoding, or does not verify as the BLS signature of round 1000 under datekeys:quicknet:v1: ERR_RELEASE_INVALID","ERR_RELEASE_INVALID"]]},
-  {"name":"format 2: release signature with the infinity flag and a payload","text":"provider: the signature is not a canonical point encoding, or does not verify as the BLS signature of round 1000 under datekeys:quicknet:v1: ERR_RELEASE_INVALID","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v2, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=c8cfc53d45c879da916edddf71f3bddd datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"round 1000 obtained",""],[10,"release verification",false,"provider: the signature is not a canonical point encoding, or does not verify as the BLS signature of round 1000 under datekeys:quicknet:v1: ERR_RELEASE_INVALID","ERR_RELEASE_INVALID"]]},
-  {"name":"format 2: release signature negated","text":"provider: the signature is not a canonical point encoding, or does not verify as the BLS signature of round 1000 under datekeys:quicknet:v1: ERR_RELEASE_INVALID","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v2, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=c8cfc53d45c879da916edddf71f3bddd datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"round 1000 obtained",""],[10,"release verification",false,"provider: the signature is not a canonical point encoding, or does not verify as the BLS signature of round 1000 under datekeys:quicknet:v1: ERR_RELEASE_INVALID","ERR_RELEASE_INVALID"]]},
-  {"name":"format 2: negated release signature and U re-encoded with c0 + p","text":"provider: the signature is not a canonical point encoding, or does not verify as the BLS signature of round 1000 under datekeys:quicknet:v1: ERR_RELEASE_INVALID","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v2, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=c8cfc53d45c879da916edddf71f3bddd datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"round 1000 obtained",""],[10,"release verification",false,"provider: the signature is not a canonical point encoding, or does not verify as the BLS signature of round 1000 under datekeys:quicknet:v1: ERR_RELEASE_INVALID","ERR_RELEASE_INVALID"]]},
-  {"name":"format 2 time_only relabeled format 3","text":"capsule: CONTROL_CBOR: codec: datekeys-control schema version 2, want 3: ERR_UNSUPPORTED_VERSION","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v3, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=c8cfc53d45c879da916edddf71f3bddd datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"round 1000 obtained",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",false,"capsule: CONTROL_CBOR: codec: datekeys-control schema version 2, want 3: ERR_UNSUPPORTED_VERSION","ERR_UNSUPPORTED_VERSION"]]},
-  {"name":"format 1 time_only relabeled format 2","text":"capsule: CONTROL_CBOR: codec: datekeys-control schema version 1, want 2: ERR_UNSUPPORTED_VERSION","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v2, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=446",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ad4d676812b134ff8a3de263f77018b4 datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"round 1000 obtained",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",false,"capsule: CONTROL_CBOR: codec: datekeys-control schema version 1, want 2: ERR_UNSUPPORTED_VERSION","ERR_UNSUPPORTED_VERSION"]]},
-  {"name":"format 1 time_and_key with one stanza relabeled format 2, with the identity","text":"agewrap: INNER_ACCESS_AGE has 1 stanzas, want exactly 16: ERR_POLICY_STRUCTURE_MISMATCH","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v2, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=646",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=448e134a13457c319cab7fceaf7ffa1f datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_and_key profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"access credential",true,"1 identities to try",""],[9,"release",true,"round 1000 obtained",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",false,"agewrap: INNER_ACCESS_AGE has 1 stanzas, want exactly 16: ERR_POLICY_STRUCTURE_MISMATCH","ERR_POLICY_STRUCTURE_MISMATCH"]]},
-  {"name":"format 2 time_only relabeled format 1","text":"capsule: CONTROL_CBOR: codec: datekeys-control schema version 2, want 1: ERR_UNSUPPORTED_VERSION","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v1, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=c8cfc53d45c879da916edddf71f3bddd datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"round 1000 obtained",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",false,"capsule: CONTROL_CBOR: codec: datekeys-control schema version 2, want 1: ERR_UNSUPPORTED_VERSION","ERR_UNSUPPORTED_VERSION"]]},
-  {"name":"format 2 time_and_key relabeled format 1, with the identity","text":"capsule: CONTROL_CBOR: codec: datekeys-control schema version 2, want 1: ERR_UNSUPPORTED_VERSION","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v1, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=2128",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=fe68d3b3bb59db0c14b7ef57d8d6cb5e datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_and_key profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"access credential",true,"1 identities to try",""],[9,"release",true,"round 1000 obtained",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_and_key: INNER_ACCESS_AGE with 16 X25519 stanzas",""],[13,"open access layer",true,"identity matched exactly one stanza",""],[14,"control",false,"capsule: CONTROL_CBOR: codec: datekeys-control schema version 2, want 1: ERR_UNSUPPORTED_VERSION","ERR_UNSUPPORTED_VERSION"]]},
-  {"name":"INNER_ACCESS_AGE with 15 stanzas","text":"agewrap: INNER_ACCESS_AGE has 15 stanzas, want exactly 16: ERR_POLICY_STRUCTURE_MISMATCH","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v2, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=2030",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=fe68d3b3bb59db0c14b7ef57d8d6cb5e datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_and_key profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"access credential",true,"1 identities to try",""],[9,"release",true,"round 1000 obtained",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",false,"agewrap: INNER_ACCESS_AGE has 15 stanzas, want exactly 16: ERR_POLICY_STRUCTURE_MISMATCH","ERR_POLICY_STRUCTURE_MISMATCH"]]},
-  {"name":"INNER_ACCESS_AGE with 17 stanzas","text":"agewrap: INNER_ACCESS_AGE has 17 stanzas, want exactly 16: ERR_POLICY_STRUCTURE_MISMATCH","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v2, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=2226",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=fe68d3b3bb59db0c14b7ef57d8d6cb5e datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_and_key profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"access credential",true,"1 identities to try",""],[9,"release",true,"round 1000 obtained",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",false,"agewrap: INNER_ACCESS_AGE has 17 stanzas, want exactly 16: ERR_POLICY_STRUCTURE_MISMATCH","ERR_POLICY_STRUCTURE_MISMATCH"]]},
-  {"name":"16 stanzas, two for one recipient, and the identity of that recipient","text":"capsule: age: agewrap: one identity opens 2 INNER_ACCESS_AGE stanzas, want one per recipient: ERR_POLICY_STRUCTURE_MISMATCH","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v2, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=2128",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=fe68d3b3bb59db0c14b7ef57d8d6cb5e datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_and_key profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"access credential",true,"1 identities to try",""],[9,"release",true,"round 1000 obtained",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_and_key: INNER_ACCESS_AGE with 16 X25519 stanzas",""],[13,"open access layer",false,"capsule: age: agewrap: one identity opens 2 INNER_ACCESS_AGE stanzas, want one per recipient: ERR_POLICY_STRUCTURE_MISMATCH","ERR_POLICY_STRUCTURE_MISMATCH"]]},
-  {"name":"identity that is not a recipient of any of the 16","text":"capsule: age: agewrap: no supplied identity is a recipient of INNER_ACCESS_AGE: ERR_ACCESS_INVALID","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v2, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=2128",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=fe68d3b3bb59db0c14b7ef57d8d6cb5e datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_and_key profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"access credential",true,"1 identities to try",""],[9,"release",true,"round 1000 obtained",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_and_key: INNER_ACCESS_AGE with 16 X25519 stanzas",""],[13,"open access layer",false,"capsule: age: agewrap: no supplied identity is a recipient of INNER_ACCESS_AGE: ERR_ACCESS_INVALID","ERR_ACCESS_INVALID"]]},
-  {"name":"control of schema version 2 without key 6","text":"capsule: CONTROL_CBOR: key 6 is missing: ERR_NON_CANONICAL_CBOR","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v2, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=448",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=c8cfc53d45c879da916edddf71f3bddd datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"round 1000 obtained",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",false,"capsule: CONTROL_CBOR: key 6 is missing: ERR_NON_CANONICAL_CBOR","ERR_NON_CANONICAL_CBOR"]]},
-  {"name":"control of schema version 2 without key 7","text":"capsule: CONTROL_CBOR: key 7 is missing: ERR_NON_CANONICAL_CBOR","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v2, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=456",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=c8cfc53d45c879da916edddf71f3bddd datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"round 1000 obtained",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",false,"capsule: CONTROL_CBOR: key 7 is missing: ERR_NON_CANONICAL_CBOR","ERR_NON_CANONICAL_CBOR"]]},
-  {"name":"padding code 0","text":"capsule: CONTROL_CBOR: key 7: padding code 0 is not defined: ERR_NON_CANONICAL_CBOR","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v2, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=c8cfc53d45c879da916edddf71f3bddd datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"round 1000 obtained",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",false,"capsule: CONTROL_CBOR: key 7: padding code 0 is not defined: ERR_NON_CANONICAL_CBOR","ERR_NON_CANONICAL_CBOR"]]},
-  {"name":"padding code 3","text":"capsule: CONTROL_CBOR: key 7: padding code 3 is not defined: ERR_NON_CANONICAL_CBOR","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v2, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=c8cfc53d45c879da916edddf71f3bddd datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"round 1000 obtained",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",false,"capsule: CONTROL_CBOR: key 7: padding code 3 is not defined: ERR_NON_CANONICAL_CBOR","ERR_NON_CANONICAL_CBOR"]]},
-  {"name":"payload_length L_MAX + 1","text":"capsule: CONTROL_CBOR: key 6: payload_length 8936830510563329 exceeds L_MAX = 8936830510563328: ERR_NON_CANONICAL_CBOR","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v2, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=c8cfc53d45c879da916edddf71f3bddd datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"round 1000 obtained",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",false,"capsule: CONTROL_CBOR: key 6: payload_length 8936830510563329 exceeds L_MAX = 8936830510563328: ERR_NON_CANONICAL_CBOR","ERR_NON_CANONICAL_CBOR"]]},
-  {"name":"payload_length of 7 bytes","text":"capsule: CONTROL_CBOR: key 6: codec: offset 93: a byte string of 7 bytes outside 8..8: ERR_NON_CANONICAL_CBOR","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v2, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=457",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=c8cfc53d45c879da916edddf71f3bddd datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"round 1000 obtained",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",false,"capsule: CONTROL_CBOR: key 6: codec: offset 93: a byte string of 7 bytes outside 8..8: ERR_NON_CANONICAL_CBOR","ERR_NON_CANONICAL_CBOR"]]},
-  {"name":"payload_length of 9 bytes","text":"capsule: CONTROL_CBOR: key 6: codec: offset 93: a byte string of 9 bytes outside 8..8: ERR_NON_CANONICAL_CBOR","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v2, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=459",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=c8cfc53d45c879da916edddf71f3bddd datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"round 1000 obtained",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",false,"capsule: CONTROL_CBOR: key 6: codec: offset 93: a byte string of 9 bytes outside 8..8: ERR_NON_CANONICAL_CBOR","ERR_NON_CANONICAL_CBOR"]]},
-  {"name":"payload_length as an unsigned integer","text":"capsule: CONTROL_CBOR: key 6: codec: offset 92: an unsigned integer where a byte string was expected: ERR_NON_CANONICAL_CBOR","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v2, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=454",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=c8cfc53d45c879da916edddf71f3bddd datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"round 1000 obtained",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",false,"capsule: CONTROL_CBOR: key 6: codec: offset 92: an unsigned integer where a byte string was expected: ERR_NON_CANONICAL_CBOR","ERR_NON_CANONICAL_CBOR"]]},
-  {"name":"last padding byte not zero","text":"capsule: PAYLOAD_AGE: byte 255 of the plaintext is padding and is not zero: ERR_INTEGRITY","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v2, PUBLIC_HEADER_LEN=159, SEALED_CONTROL_LEN=494",""],[3,"public header",true,"159 bytes",""],[4,"header validation",true,"capsule_id=3ab2c06d482609a9c7ae92f672599883 datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MjAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 2000, unlock at 2023-08-23T16:49:24Z",""],[8,"tlock stanza",true,"round 2000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"round 2000 obtained",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",true,"canonical CONTROL_CBOR",""],[15,"header binding",true,"matches",""],[16,"payload identity",true,"I_PAYLOAD recovered; L = 34, padding reforzado, P = 256",""],[17,"open payload",false,"capsule: PAYLOAD_AGE: byte 255 of the plaintext is padding and is not zero: ERR_INTEGRITY","ERR_INTEGRITY"]]},
-  {"name":"payload plaintext of P - 1 bytes","text":"capsule: PAYLOAD_AGE: the plaintext is 255 bytes, shorter than P = 256: ERR_INTEGRITY","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v2, PUBLIC_HEADER_LEN=159, SEALED_CONTROL_LEN=494",""],[3,"public header",true,"159 bytes",""],[4,"header validation",true,"capsule_id=3ab2c06d482609a9c7ae92f672599883 datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MjAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 2000, unlock at 2023-08-23T16:49:24Z",""],[8,"tlock stanza",true,"round 2000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"round 2000 obtained",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",true,"canonical CONTROL_CBOR",""],[15,"header binding",true,"matches",""],[16,"payload identity",true,"I_PAYLOAD recovered; L = 34, padding reforzado, P = 256",""],[17,"open payload",false,"capsule: PAYLOAD_AGE: the plaintext is 255 bytes, shorter than P = 256: ERR_INTEGRITY","ERR_INTEGRITY"]]},
-  {"name":"payload plaintext of P + 256 bytes","text":"capsule: PAYLOAD_AGE: the plaintext is longer than P = 256: ERR_INTEGRITY","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v2, PUBLIC_HEADER_LEN=159, SEALED_CONTROL_LEN=494",""],[3,"public header",true,"159 bytes",""],[4,"header validation",true,"capsule_id=3ab2c06d482609a9c7ae92f672599883 datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MjAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 2000, unlock at 2023-08-23T16:49:24Z",""],[8,"tlock stanza",true,"round 2000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"round 2000 obtained",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",true,"canonical CONTROL_CBOR",""],[15,"header binding",true,"matches",""],[16,"payload identity",true,"I_PAYLOAD recovered; L = 34, padding reforzado, P = 256",""],[17,"open payload",false,"capsule: PAYLOAD_AGE: the plaintext is longer than P = 256: ERR_INTEGRITY","ERR_INTEGRITY"]]},
-  {"name":"payload plaintext without padding, of L bytes","text":"capsule: PAYLOAD_AGE: the plaintext is 34 bytes, shorter than P = 256: ERR_INTEGRITY","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v2, PUBLIC_HEADER_LEN=159, SEALED_CONTROL_LEN=494",""],[3,"public header",true,"159 bytes",""],[4,"header validation",true,"capsule_id=3ab2c06d482609a9c7ae92f672599883 datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MjAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 2000, unlock at 2023-08-23T16:49:24Z",""],[8,"tlock stanza",true,"round 2000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"round 2000 obtained",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",true,"canonical CONTROL_CBOR",""],[15,"header binding",true,"matches",""],[16,"payload identity",true,"I_PAYLOAD recovered; L = 34, padding reforzado, P = 256",""],[17,"open payload",false,"capsule: PAYLOAD_AGE: the plaintext is 34 bytes, shorter than P = 256: ERR_INTEGRITY","ERR_INTEGRITY"]]},
-  {"name":"padding code 2 changed to 1, with L = 78000","text":"capsule: PAYLOAD_AGE: the plaintext is longer than P = 78080: ERR_INTEGRITY","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v2, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=c8cfc53d45c879da916edddf71f3bddd datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"round 1000 obtained",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",true,"canonical CONTROL_CBOR",""],[15,"header binding",true,"matches",""],[16,"payload identity",true,"I_PAYLOAD recovered; L = 78000, padding bloque256, P = 78080",""],[17,"open payload",false,"capsule: PAYLOAD_AGE: the plaintext is longer than P = 78080: ERR_INTEGRITY","ERR_INTEGRITY"]]},
-  {"name":"payload_length L - 1, the last byte of the content not zero","text":"capsule: PAYLOAD_AGE: byte 77999 of the plaintext is padding and is not zero: ERR_INTEGRITY","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v2, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=c8cfc53d45c879da916edddf71f3bddd datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"round 1000 obtained",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",true,"canonical CONTROL_CBOR",""],[15,"header binding",true,"matches",""],[16,"payload identity",true,"I_PAYLOAD recovered; L = 77999, padding reforzado, P = 79872",""],[17,"open payload",false,"capsule: PAYLOAD_AGE: byte 77999 of the plaintext is padding and is not zero: ERR_INTEGRITY","ERR_INTEGRITY"]]},
+  {"name":"format 2: tlock stanza U re-encoded with c0 + p","text":"capsule: age: agewrap: U of the tlock stanza is not the canonical encoding of a point of the key group: ERR_INTEGRITY","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v2, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=c8cfc53d45c879da916edddf71f3bddd datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"release supplied by the caller",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",false,"capsule: age: agewrap: U of the tlock stanza is not the canonical encoding of a point of the key group: ERR_INTEGRITY","ERR_INTEGRITY"]]},
+  {"name":"format 2: tlock stanza U is the point at infinity","text":"capsule: age: agewrap: U of the tlock stanza is the point at infinity: ERR_INTEGRITY","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v2, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=c8cfc53d45c879da916edddf71f3bddd datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"release supplied by the caller",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",false,"capsule: age: agewrap: U of the tlock stanza is the point at infinity: ERR_INTEGRITY","ERR_INTEGRITY"]]},
+  {"name":"format 2: tlock stanza U with the infinity flag and a payload","text":"capsule: age: agewrap: U of the tlock stanza is not the canonical encoding of a point of the key group: ERR_INTEGRITY","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v2, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=c8cfc53d45c879da916edddf71f3bddd datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"release supplied by the caller",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",false,"capsule: age: agewrap: U of the tlock stanza is not the canonical encoding of a point of the key group: ERR_INTEGRITY","ERR_INTEGRITY"]]},
+  {"name":"format 2: tlock stanza body of 127 bytes","text":"capsule: age: agewrap: tlock stanza body of 127 bytes, want 128: ERR_INTEGRITY","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v2, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=457",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=c8cfc53d45c879da916edddf71f3bddd datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"release supplied by the caller",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",false,"capsule: age: agewrap: tlock stanza body of 127 bytes, want 128: ERR_INTEGRITY","ERR_INTEGRITY"]]},
+  {"name":"format 2: tlock stanza body of 129 bytes","text":"capsule: age: agewrap: tlock stanza body of 129 bytes, want 128: ERR_INTEGRITY","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v2, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=459",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=c8cfc53d45c879da916edddf71f3bddd datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"release supplied by the caller",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",false,"capsule: age: agewrap: tlock stanza body of 129 bytes, want 128: ERR_INTEGRITY","ERR_INTEGRITY"]]},
+  {"name":"format 2: release signature re-encoded with x + p","text":"provider: the signature is not a canonical point encoding, or does not verify as the BLS signature of round 1004 under datekeys:quicknet:v1: ERR_RELEASE_INVALID","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v2, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=dbb9bc102bb15061d58e9c17d302e06f datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwNH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1004, unlock at 2023-08-23T15:59:36Z",""],[8,"tlock stanza",true,"round 1004, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"release supplied by the caller",""],[10,"release verification",false,"provider: the signature is not a canonical point encoding, or does not verify as the BLS signature of round 1004 under datekeys:quicknet:v1: ERR_RELEASE_INVALID","ERR_RELEASE_INVALID"]]},
+  {"name":"format 2: release signature is the point at infinity","text":"provider: the signature is not a canonical point encoding, or does not verify as the BLS signature of round 1000 under datekeys:quicknet:v1: ERR_RELEASE_INVALID","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v2, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=c8cfc53d45c879da916edddf71f3bddd datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"release supplied by the caller",""],[10,"release verification",false,"provider: the signature is not a canonical point encoding, or does not verify as the BLS signature of round 1000 under datekeys:quicknet:v1: ERR_RELEASE_INVALID","ERR_RELEASE_INVALID"]]},
+  {"name":"format 2: release signature with the infinity flag and a payload","text":"provider: the signature is not a canonical point encoding, or does not verify as the BLS signature of round 1000 under datekeys:quicknet:v1: ERR_RELEASE_INVALID","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v2, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=c8cfc53d45c879da916edddf71f3bddd datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"release supplied by the caller",""],[10,"release verification",false,"provider: the signature is not a canonical point encoding, or does not verify as the BLS signature of round 1000 under datekeys:quicknet:v1: ERR_RELEASE_INVALID","ERR_RELEASE_INVALID"]]},
+  {"name":"format 2: release signature negated","text":"provider: the signature is not a canonical point encoding, or does not verify as the BLS signature of round 1000 under datekeys:quicknet:v1: ERR_RELEASE_INVALID","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v2, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=c8cfc53d45c879da916edddf71f3bddd datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"release supplied by the caller",""],[10,"release verification",false,"provider: the signature is not a canonical point encoding, or does not verify as the BLS signature of round 1000 under datekeys:quicknet:v1: ERR_RELEASE_INVALID","ERR_RELEASE_INVALID"]]},
+  {"name":"format 2: negated release signature and U re-encoded with c0 + p","text":"provider: the signature is not a canonical point encoding, or does not verify as the BLS signature of round 1000 under datekeys:quicknet:v1: ERR_RELEASE_INVALID","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v2, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=c8cfc53d45c879da916edddf71f3bddd datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"release supplied by the caller",""],[10,"release verification",false,"provider: the signature is not a canonical point encoding, or does not verify as the BLS signature of round 1000 under datekeys:quicknet:v1: ERR_RELEASE_INVALID","ERR_RELEASE_INVALID"]]},
+  {"name":"format 2 time_only relabeled format 3","text":"capsule: CONTROL_CBOR: codec: datekeys-control schema version 2, want 3: ERR_UNSUPPORTED_VERSION","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v3, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=c8cfc53d45c879da916edddf71f3bddd datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"release supplied by the caller",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",false,"capsule: CONTROL_CBOR: codec: datekeys-control schema version 2, want 3: ERR_UNSUPPORTED_VERSION","ERR_UNSUPPORTED_VERSION"]]},
+  {"name":"format 1 time_only relabeled format 2","text":"capsule: CONTROL_CBOR: codec: datekeys-control schema version 1, want 2: ERR_UNSUPPORTED_VERSION","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v2, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=446",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ad4d676812b134ff8a3de263f77018b4 datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"release supplied by the caller",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",false,"capsule: CONTROL_CBOR: codec: datekeys-control schema version 1, want 2: ERR_UNSUPPORTED_VERSION","ERR_UNSUPPORTED_VERSION"]]},
+  {"name":"format 1 time_and_key with one stanza relabeled format 2, with the identity","text":"agewrap: INNER_ACCESS_AGE has 1 stanzas, want exactly 16: ERR_POLICY_STRUCTURE_MISMATCH","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v2, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=646",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=448e134a13457c319cab7fceaf7ffa1f datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_and_key profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"access credential",true,"1 identities to try",""],[9,"release",true,"release supplied by the caller",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",false,"agewrap: INNER_ACCESS_AGE has 1 stanzas, want exactly 16: ERR_POLICY_STRUCTURE_MISMATCH","ERR_POLICY_STRUCTURE_MISMATCH"]]},
+  {"name":"format 2 time_only relabeled format 1","text":"capsule: CONTROL_CBOR: codec: datekeys-control schema version 2, want 1: ERR_UNSUPPORTED_VERSION","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v1, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=c8cfc53d45c879da916edddf71f3bddd datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"release supplied by the caller",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",false,"capsule: CONTROL_CBOR: codec: datekeys-control schema version 2, want 1: ERR_UNSUPPORTED_VERSION","ERR_UNSUPPORTED_VERSION"]]},
+  {"name":"format 2 time_and_key relabeled format 1, with the identity","text":"capsule: CONTROL_CBOR: codec: datekeys-control schema version 2, want 1: ERR_UNSUPPORTED_VERSION","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v1, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=2128",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=fe68d3b3bb59db0c14b7ef57d8d6cb5e datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_and_key profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"access credential",true,"1 identities to try",""],[9,"release",true,"release supplied by the caller",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_and_key: INNER_ACCESS_AGE with 16 X25519 stanzas",""],[13,"open access layer",true,"identity matched exactly one stanza",""],[14,"control",false,"capsule: CONTROL_CBOR: codec: datekeys-control schema version 2, want 1: ERR_UNSUPPORTED_VERSION","ERR_UNSUPPORTED_VERSION"]]},
+  {"name":"INNER_ACCESS_AGE with 15 stanzas","text":"agewrap: INNER_ACCESS_AGE has 15 stanzas, want exactly 16: ERR_POLICY_STRUCTURE_MISMATCH","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v2, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=2030",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=fe68d3b3bb59db0c14b7ef57d8d6cb5e datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_and_key profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"access credential",true,"1 identities to try",""],[9,"release",true,"release supplied by the caller",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",false,"agewrap: INNER_ACCESS_AGE has 15 stanzas, want exactly 16: ERR_POLICY_STRUCTURE_MISMATCH","ERR_POLICY_STRUCTURE_MISMATCH"]]},
+  {"name":"INNER_ACCESS_AGE with 17 stanzas","text":"agewrap: INNER_ACCESS_AGE has 17 stanzas, want exactly 16: ERR_POLICY_STRUCTURE_MISMATCH","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v2, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=2226",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=fe68d3b3bb59db0c14b7ef57d8d6cb5e datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_and_key profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"access credential",true,"1 identities to try",""],[9,"release",true,"release supplied by the caller",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",false,"agewrap: INNER_ACCESS_AGE has 17 stanzas, want exactly 16: ERR_POLICY_STRUCTURE_MISMATCH","ERR_POLICY_STRUCTURE_MISMATCH"]]},
+  {"name":"16 stanzas, two for one recipient, and the identity of that recipient","text":"capsule: age: agewrap: one identity opens 2 INNER_ACCESS_AGE stanzas, want one per recipient: ERR_POLICY_STRUCTURE_MISMATCH","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v2, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=2128",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=fe68d3b3bb59db0c14b7ef57d8d6cb5e datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_and_key profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"access credential",true,"1 identities to try",""],[9,"release",true,"release supplied by the caller",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_and_key: INNER_ACCESS_AGE with 16 X25519 stanzas",""],[13,"open access layer",false,"capsule: age: agewrap: one identity opens 2 INNER_ACCESS_AGE stanzas, want one per recipient: ERR_POLICY_STRUCTURE_MISMATCH","ERR_POLICY_STRUCTURE_MISMATCH"]]},
+  {"name":"identity that is not a recipient of any of the 16","text":"capsule: age: agewrap: no supplied identity is a recipient of INNER_ACCESS_AGE: ERR_ACCESS_INVALID","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v2, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=2128",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=fe68d3b3bb59db0c14b7ef57d8d6cb5e datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_and_key profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"access credential",true,"1 identities to try",""],[9,"release",true,"release supplied by the caller",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_and_key: INNER_ACCESS_AGE with 16 X25519 stanzas",""],[13,"open access layer",false,"capsule: age: agewrap: no supplied identity is a recipient of INNER_ACCESS_AGE: ERR_ACCESS_INVALID","ERR_ACCESS_INVALID"]]},
+  {"name":"control of schema version 2 without key 6","text":"capsule: CONTROL_CBOR: key 6 is missing: ERR_NON_CANONICAL_CBOR","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v2, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=448",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=c8cfc53d45c879da916edddf71f3bddd datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"release supplied by the caller",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",false,"capsule: CONTROL_CBOR: key 6 is missing: ERR_NON_CANONICAL_CBOR","ERR_NON_CANONICAL_CBOR"]]},
+  {"name":"control of schema version 2 without key 7","text":"capsule: CONTROL_CBOR: key 7 is missing: ERR_NON_CANONICAL_CBOR","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v2, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=456",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=c8cfc53d45c879da916edddf71f3bddd datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"release supplied by the caller",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",false,"capsule: CONTROL_CBOR: key 7 is missing: ERR_NON_CANONICAL_CBOR","ERR_NON_CANONICAL_CBOR"]]},
+  {"name":"padding code 0","text":"capsule: CONTROL_CBOR: key 7: padding code 0 is not defined: ERR_NON_CANONICAL_CBOR","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v2, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=c8cfc53d45c879da916edddf71f3bddd datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"release supplied by the caller",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",false,"capsule: CONTROL_CBOR: key 7: padding code 0 is not defined: ERR_NON_CANONICAL_CBOR","ERR_NON_CANONICAL_CBOR"]]},
+  {"name":"padding code 3","text":"capsule: CONTROL_CBOR: key 7: padding code 3 is not defined: ERR_NON_CANONICAL_CBOR","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v2, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=c8cfc53d45c879da916edddf71f3bddd datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"release supplied by the caller",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",false,"capsule: CONTROL_CBOR: key 7: padding code 3 is not defined: ERR_NON_CANONICAL_CBOR","ERR_NON_CANONICAL_CBOR"]]},
+  {"name":"payload_length L_MAX + 1","text":"capsule: CONTROL_CBOR: key 6: payload_length 8936830510563329 exceeds L_MAX = 8936830510563328: ERR_NON_CANONICAL_CBOR","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v2, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=c8cfc53d45c879da916edddf71f3bddd datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"release supplied by the caller",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",false,"capsule: CONTROL_CBOR: key 6: payload_length 8936830510563329 exceeds L_MAX = 8936830510563328: ERR_NON_CANONICAL_CBOR","ERR_NON_CANONICAL_CBOR"]]},
+  {"name":"payload_length of 7 bytes","text":"capsule: CONTROL_CBOR: key 6: codec: offset 93: a byte string of 7 bytes outside 8..8: ERR_NON_CANONICAL_CBOR","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v2, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=457",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=c8cfc53d45c879da916edddf71f3bddd datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"release supplied by the caller",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",false,"capsule: CONTROL_CBOR: key 6: codec: offset 93: a byte string of 7 bytes outside 8..8: ERR_NON_CANONICAL_CBOR","ERR_NON_CANONICAL_CBOR"]]},
+  {"name":"payload_length of 9 bytes","text":"capsule: CONTROL_CBOR: key 6: codec: offset 93: a byte string of 9 bytes outside 8..8: ERR_NON_CANONICAL_CBOR","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v2, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=459",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=c8cfc53d45c879da916edddf71f3bddd datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"release supplied by the caller",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",false,"capsule: CONTROL_CBOR: key 6: codec: offset 93: a byte string of 9 bytes outside 8..8: ERR_NON_CANONICAL_CBOR","ERR_NON_CANONICAL_CBOR"]]},
+  {"name":"payload_length as an unsigned integer","text":"capsule: CONTROL_CBOR: key 6: codec: offset 92: an unsigned integer where a byte string was expected: ERR_NON_CANONICAL_CBOR","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v2, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=454",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=c8cfc53d45c879da916edddf71f3bddd datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"release supplied by the caller",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",false,"capsule: CONTROL_CBOR: key 6: codec: offset 92: an unsigned integer where a byte string was expected: ERR_NON_CANONICAL_CBOR","ERR_NON_CANONICAL_CBOR"]]},
+  {"name":"last padding byte not zero","text":"capsule: PAYLOAD_AGE: byte 255 of the plaintext is padding and is not zero: ERR_INTEGRITY","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v2, PUBLIC_HEADER_LEN=159, SEALED_CONTROL_LEN=494",""],[3,"public header",true,"159 bytes",""],[4,"header validation",true,"capsule_id=3ab2c06d482609a9c7ae92f672599883 datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MjAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 2000, unlock at 2023-08-23T16:49:24Z",""],[8,"tlock stanza",true,"round 2000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"release supplied by the caller",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",true,"canonical CONTROL_CBOR",""],[15,"header binding",true,"matches",""],[16,"payload identity",true,"I_PAYLOAD recovered; L = 34, padding reforzado, P = 256",""],[17,"open payload",false,"capsule: PAYLOAD_AGE: byte 255 of the plaintext is padding and is not zero: ERR_INTEGRITY","ERR_INTEGRITY"]]},
+  {"name":"payload plaintext of P - 1 bytes","text":"capsule: PAYLOAD_AGE: the plaintext is 255 bytes, shorter than P = 256: ERR_INTEGRITY","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v2, PUBLIC_HEADER_LEN=159, SEALED_CONTROL_LEN=494",""],[3,"public header",true,"159 bytes",""],[4,"header validation",true,"capsule_id=3ab2c06d482609a9c7ae92f672599883 datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MjAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 2000, unlock at 2023-08-23T16:49:24Z",""],[8,"tlock stanza",true,"round 2000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"release supplied by the caller",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",true,"canonical CONTROL_CBOR",""],[15,"header binding",true,"matches",""],[16,"payload identity",true,"I_PAYLOAD recovered; L = 34, padding reforzado, P = 256",""],[17,"open payload",false,"capsule: PAYLOAD_AGE: the plaintext is 255 bytes, shorter than P = 256: ERR_INTEGRITY","ERR_INTEGRITY"]]},
+  {"name":"payload plaintext of P + 256 bytes","text":"capsule: PAYLOAD_AGE: the plaintext is longer than P = 256: ERR_INTEGRITY","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v2, PUBLIC_HEADER_LEN=159, SEALED_CONTROL_LEN=494",""],[3,"public header",true,"159 bytes",""],[4,"header validation",true,"capsule_id=3ab2c06d482609a9c7ae92f672599883 datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MjAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 2000, unlock at 2023-08-23T16:49:24Z",""],[8,"tlock stanza",true,"round 2000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"release supplied by the caller",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",true,"canonical CONTROL_CBOR",""],[15,"header binding",true,"matches",""],[16,"payload identity",true,"I_PAYLOAD recovered; L = 34, padding reforzado, P = 256",""],[17,"open payload",false,"capsule: PAYLOAD_AGE: the plaintext is longer than P = 256: ERR_INTEGRITY","ERR_INTEGRITY"]]},
+  {"name":"payload plaintext without padding, of L bytes","text":"capsule: PAYLOAD_AGE: the plaintext is 34 bytes, shorter than P = 256: ERR_INTEGRITY","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v2, PUBLIC_HEADER_LEN=159, SEALED_CONTROL_LEN=494",""],[3,"public header",true,"159 bytes",""],[4,"header validation",true,"capsule_id=3ab2c06d482609a9c7ae92f672599883 datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MjAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 2000, unlock at 2023-08-23T16:49:24Z",""],[8,"tlock stanza",true,"round 2000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"release supplied by the caller",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",true,"canonical CONTROL_CBOR",""],[15,"header binding",true,"matches",""],[16,"payload identity",true,"I_PAYLOAD recovered; L = 34, padding reforzado, P = 256",""],[17,"open payload",false,"capsule: PAYLOAD_AGE: the plaintext is 34 bytes, shorter than P = 256: ERR_INTEGRITY","ERR_INTEGRITY"]]},
+  {"name":"padding code 2 changed to 1, with L = 78000","text":"capsule: PAYLOAD_AGE: the plaintext is longer than P = 78080: ERR_INTEGRITY","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v2, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=c8cfc53d45c879da916edddf71f3bddd datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"release supplied by the caller",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",true,"canonical CONTROL_CBOR",""],[15,"header binding",true,"matches",""],[16,"payload identity",true,"I_PAYLOAD recovered; L = 78000, padding bloque256, P = 78080",""],[17,"open payload",false,"capsule: PAYLOAD_AGE: the plaintext is longer than P = 78080: ERR_INTEGRITY","ERR_INTEGRITY"]]},
+  {"name":"payload_length L - 1, the last byte of the content not zero","text":"capsule: PAYLOAD_AGE: byte 77999 of the plaintext is padding and is not zero: ERR_INTEGRITY","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v2, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=c8cfc53d45c879da916edddf71f3bddd datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"release supplied by the caller",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",true,"canonical CONTROL_CBOR",""],[15,"header binding",true,"matches",""],[16,"payload identity",true,"I_PAYLOAD recovered; L = 77999, padding reforzado, P = 79872",""],[17,"open payload",false,"capsule: PAYLOAD_AGE: byte 77999 of the plaintext is padding and is not zero: ERR_INTEGRITY","ERR_INTEGRITY"]]},
   {"name":"format 1 time_and_key with one stanza relabeled format 2, with the .dkk","text":"capsule: the .dkk capsule_digest does not match this .dkc: ERR_ACCESS_INVALID","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v2, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=646",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=448e134a13457c319cab7fceaf7ffa1f datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_and_key profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"access credential",false,"capsule: the .dkk capsule_digest does not match this .dkc: ERR_ACCESS_INVALID","ERR_ACCESS_INVALID"]]},
   {"name":"format 2 time_and_key relabeled format 1, with the .dkk","text":"capsule: the .dkk capsule_digest does not match this .dkc: ERR_ACCESS_INVALID","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v1, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=2128",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=fe68d3b3bb59db0c14b7ef57d8d6cb5e datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_and_key profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"access credential",false,"capsule: the .dkk capsule_digest does not match this .dkc: ERR_ACCESS_INVALID","ERR_ACCESS_INVALID"]]},
   {"name":"INNER_ACCESS_AGE with 15 stanzas, with the .dkk","text":"capsule: the .dkk capsule_digest does not match this .dkc: ERR_ACCESS_INVALID","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v2, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=2030",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=fe68d3b3bb59db0c14b7ef57d8d6cb5e datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_and_key profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"access credential",false,"capsule: the .dkk capsule_digest does not match this .dkc: ERR_ACCESS_INVALID","ERR_ACCESS_INVALID"]]},
   {"name":"INNER_ACCESS_AGE with 17 stanzas, with the .dkk","text":"capsule: the .dkk capsule_digest does not match this .dkc: ERR_ACCESS_INVALID","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v2, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=2226",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=fe68d3b3bb59db0c14b7ef57d8d6cb5e datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_and_key profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"access credential",false,"capsule: the .dkk capsule_digest does not match this .dkc: ERR_ACCESS_INVALID","ERR_ACCESS_INVALID"]]},
   {"name":"16 stanzas, two for one recipient, with the .dkk","text":"capsule: the .dkk capsule_digest does not match this .dkc: ERR_ACCESS_INVALID","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v2, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=2128",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=fe68d3b3bb59db0c14b7ef57d8d6cb5e datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_and_key profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"access credential",false,"capsule: the .dkk capsule_digest does not match this .dkc: ERR_ACCESS_INVALID","ERR_ACCESS_INVALID"]]},
-  {"name":"format 3: PUBLIC_HEADER_A + SEALED_CONTROL_B","text":"capsule: header_binding does not match PRELUDE || PUBLIC_HEADER: ERR_HEADER_BINDING","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v3, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ff23599acbe9b0a742792dcb7cb1bc4c datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"round 1000 obtained",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",true,"canonical CONTROL_CBOR",""],[15,"header binding",false,"capsule: header_binding does not match PRELUDE || PUBLIC_HEADER: ERR_HEADER_BINDING","ERR_HEADER_BINDING"]]},
-  {"name":"format 3: SEALED_CONTROL_A + PAYLOAD_AGE_B","text":"capsule: PAYLOAD_AGE: agewrap: PAYLOAD_AGE is not encrypted to this control's R_PAYLOAD: ERR_INTEGRITY","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v3, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ff23599acbe9b0a742792dcb7cb1bc4c datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"round 1000 obtained",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",true,"canonical CONTROL_CBOR",""],[15,"header binding",true,"matches",""],[16,"payload identity",true,"I_PAYLOAD recovered; L = 659, padding reforzado, P = 768",""],[17,"open payload",false,"capsule: PAYLOAD_AGE: agewrap: PAYLOAD_AGE is not encrypted to this control's R_PAYLOAD: ERR_INTEGRITY","ERR_INTEGRITY"]]},
-  {"name":"format 3: DateKey A + release of round B","text":"provider: release for round 1001, expected 1000: ERR_ROUND_MISMATCH","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v3, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ff23599acbe9b0a742792dcb7cb1bc4c datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"round 1001 obtained",""],[10,"release verification",false,"provider: release for round 1001, expected 1000: ERR_ROUND_MISMATCH","ERR_ROUND_MISMATCH"]]},
+  {"name":"format 3: PUBLIC_HEADER_A + SEALED_CONTROL_B","text":"capsule: header_binding does not match PRELUDE || PUBLIC_HEADER: ERR_HEADER_BINDING","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v3, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ff23599acbe9b0a742792dcb7cb1bc4c datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"release supplied by the caller",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",true,"canonical CONTROL_CBOR",""],[15,"header binding",false,"capsule: header_binding does not match PRELUDE || PUBLIC_HEADER: ERR_HEADER_BINDING","ERR_HEADER_BINDING"]]},
+  {"name":"format 3: SEALED_CONTROL_A + PAYLOAD_AGE_B","text":"capsule: PAYLOAD_AGE: agewrap: PAYLOAD_AGE is not encrypted to this control's R_PAYLOAD: ERR_INTEGRITY","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v3, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ff23599acbe9b0a742792dcb7cb1bc4c datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"release supplied by the caller",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",true,"canonical CONTROL_CBOR",""],[15,"header binding",true,"matches",""],[16,"payload identity",true,"I_PAYLOAD recovered; L = 659, padding reforzado, P = 768",""],[17,"open payload",false,"capsule: PAYLOAD_AGE: agewrap: PAYLOAD_AGE is not encrypted to this control's R_PAYLOAD: ERR_INTEGRITY","ERR_INTEGRITY"]]},
+  {"name":"format 3: DateKey A + release of round B","text":"provider: release for round 1001, expected 1000: ERR_ROUND_MISMATCH","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v3, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ff23599acbe9b0a742792dcb7cb1bc4c datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"release supplied by the caller",""],[10,"release verification",false,"provider: release for round 1001, expected 1000: ERR_ROUND_MISMATCH","ERR_ROUND_MISMATCH"]]},
   {"name":"format 3: chain hash changed","text":"agewrap: tlock stanza chain hash \"abababababababababababababababababababababababababababababababab\", pinned profile datekeys:quicknet:v1 uses 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971: ERR_PROFILE_MISMATCH","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v3, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ff23599acbe9b0a742792dcb7cb1bc4c datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",false,"agewrap: tlock stanza chain hash \"abababababababababababababababababababababababababababababababab\", pinned profile datekeys:quicknet:v1 uses 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971: ERR_PROFILE_MISMATCH","ERR_PROFILE_MISMATCH"]]},
   {"name":"format 3: version changed","text":"capsule: framing version 4: ERR_UNSUPPORTED_VERSION","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",false,"capsule: framing version 4: ERR_UNSUPPORTED_VERSION","ERR_UNSUPPORTED_VERSION"]]},
   {"name":"format 3: flags != 0","text":"capsule: flags 0x80, reserved 0x0000: ERR_INVALID_FLAGS","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",false,"capsule: flags 0x80, reserved 0x0000: ERR_INVALID_FLAGS","ERR_INVALID_FLAGS"]]},
   {"name":"format 3: reserved != 0","text":"capsule: flags 0x0, reserved 0x0001: ERR_INVALID_FLAGS","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",false,"capsule: flags 0x0, reserved 0x0001: ERR_INVALID_FLAGS","ERR_INVALID_FLAGS"]]},
-  {"name":"format 3: payload truncated","text":"capsule: PAYLOAD_AGE: the age payload is truncated, has trailing data or fails STREAM authentication: ERR_INTEGRITY","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v3, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ff23599acbe9b0a742792dcb7cb1bc4c datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"round 1000 obtained",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",true,"canonical CONTROL_CBOR",""],[15,"header binding",true,"matches",""],[16,"payload identity",true,"I_PAYLOAD recovered; L = 659, padding reforzado, P = 768",""],[17,"open payload",false,"capsule: PAYLOAD_AGE: the age payload is truncated, has trailing data or fails STREAM authentication: ERR_INTEGRITY","ERR_INTEGRITY"]]},
-  {"name":"format 3: payload age modified","text":"capsule: PAYLOAD_AGE: the age payload is truncated, has trailing data or fails STREAM authentication: ERR_INTEGRITY","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v3, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ff23599acbe9b0a742792dcb7cb1bc4c datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"round 1000 obtained",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",true,"canonical CONTROL_CBOR",""],[15,"header binding",true,"matches",""],[16,"payload identity",true,"I_PAYLOAD recovered; L = 659, padding reforzado, P = 768",""],[17,"open payload",false,"capsule: PAYLOAD_AGE: the age payload is truncated, has trailing data or fails STREAM authentication: ERR_INTEGRITY","ERR_INTEGRITY"]]},
-  {"name":"format 3: control modified","text":"capsule: age: the age payload is truncated, has trailing data or fails STREAM authentication: ERR_INTEGRITY","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v3, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ff23599acbe9b0a742792dcb7cb1bc4c datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"round 1000 obtained",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",false,"capsule: age: the age payload is truncated, has trailing data or fails STREAM authentication: ERR_INTEGRITY","ERR_INTEGRITY"]]},
+  {"name":"format 3: payload truncated","text":"capsule: PAYLOAD_AGE: the age payload is truncated, has trailing data or fails STREAM authentication: ERR_INTEGRITY","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v3, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ff23599acbe9b0a742792dcb7cb1bc4c datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"release supplied by the caller",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",true,"canonical CONTROL_CBOR",""],[15,"header binding",true,"matches",""],[16,"payload identity",true,"I_PAYLOAD recovered; L = 659, padding reforzado, P = 768",""],[17,"open payload",false,"capsule: PAYLOAD_AGE: the age payload is truncated, has trailing data or fails STREAM authentication: ERR_INTEGRITY","ERR_INTEGRITY"]]},
+  {"name":"format 3: payload age modified","text":"capsule: PAYLOAD_AGE: the age payload is truncated, has trailing data or fails STREAM authentication: ERR_INTEGRITY","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v3, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ff23599acbe9b0a742792dcb7cb1bc4c datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"release supplied by the caller",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",true,"canonical CONTROL_CBOR",""],[15,"header binding",true,"matches",""],[16,"payload identity",true,"I_PAYLOAD recovered; L = 659, padding reforzado, P = 768",""],[17,"open payload",false,"capsule: PAYLOAD_AGE: the age payload is truncated, has trailing data or fails STREAM authentication: ERR_INTEGRITY","ERR_INTEGRITY"]]},
+  {"name":"format 3: control modified","text":"capsule: age: the age payload is truncated, has trailing data or fails STREAM authentication: ERR_INTEGRITY","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v3, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ff23599acbe9b0a742792dcb7cb1bc4c datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"release supplied by the caller",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",false,"capsule: age: the age payload is truncated, has trailing data or fails STREAM authentication: ERR_INTEGRITY","ERR_INTEGRITY"]]},
   {"name":"format 3: non-canonical dk1_ JSON","text":"capsule: PUBLIC_HEADER: datekey: not the canonical encoding dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0: ERR_DATEKEY_NON_CANONICAL","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v3, PUBLIC_HEADER_LEN=124, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"124 bytes",""],[4,"header validation",false,"capsule: PUBLIC_HEADER: datekey: not the canonical encoding dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0: ERR_DATEKEY_NON_CANONICAL","ERR_DATEKEY_NON_CANONICAL"]]},
   {"name":"format 3: unknown profile","text":"capsule: profile \"datekeys:evmnet:v1\" is not pinned: ERR_UNKNOWN_PROFILE","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v3, PUBLIC_HEADER_LEN=118, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"118 bytes",""],[4,"header validation",false,"capsule: profile \"datekeys:evmnet:v1\" is not pinned: ERR_UNKNOWN_PROFILE","ERR_UNKNOWN_PROFILE"]]},
-  {"name":"format 3: release of another round","text":"provider: the signature is not a canonical point encoding, or does not verify as the BLS signature of round 1000 under datekeys:quicknet:v1: ERR_RELEASE_INVALID","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v3, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ff23599acbe9b0a742792dcb7cb1bc4c datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"round 1000 obtained",""],[10,"release verification",false,"provider: the signature is not a canonical point encoding, or does not verify as the BLS signature of round 1000 under datekeys:quicknet:v1: ERR_RELEASE_INVALID","ERR_RELEASE_INVALID"]]},
-  {"name":"format 3: access_policy=time_only with time_and_key structure","text":"capsule: time_only capsule seals an age file: ERR_POLICY_STRUCTURE_MISMATCH","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v3, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=2128",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=29737cb54ad5310734ecf20720c2d317 datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"round 1000 obtained",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",false,"capsule: time_only capsule seals an age file: ERR_POLICY_STRUCTURE_MISMATCH","ERR_POLICY_STRUCTURE_MISMATCH"]]},
-  {"name":"format 3: access_policy=time_and_key with time_only structure","text":"capsule: time_and_key capsule does not seal an age file: ERR_POLICY_STRUCTURE_MISMATCH","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v3, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ff23599acbe9b0a742792dcb7cb1bc4c datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_and_key profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"access credential",true,"1 identities to try",""],[9,"release",true,"round 1000 obtained",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",false,"capsule: time_and_key capsule does not seal an age file: ERR_POLICY_STRUCTURE_MISMATCH","ERR_POLICY_STRUCTURE_MISMATCH"]]},
+  {"name":"format 3: release of another round","text":"provider: the signature is not a canonical point encoding, or does not verify as the BLS signature of round 1000 under datekeys:quicknet:v1: ERR_RELEASE_INVALID","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v3, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ff23599acbe9b0a742792dcb7cb1bc4c datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"release supplied by the caller",""],[10,"release verification",false,"provider: the signature is not a canonical point encoding, or does not verify as the BLS signature of round 1000 under datekeys:quicknet:v1: ERR_RELEASE_INVALID","ERR_RELEASE_INVALID"]]},
+  {"name":"format 3: access_policy=time_only with time_and_key structure","text":"capsule: time_only capsule seals an age file: ERR_POLICY_STRUCTURE_MISMATCH","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v3, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=2128",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=29737cb54ad5310734ecf20720c2d317 datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"release supplied by the caller",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",false,"capsule: time_only capsule seals an age file: ERR_POLICY_STRUCTURE_MISMATCH","ERR_POLICY_STRUCTURE_MISMATCH"]]},
+  {"name":"format 3: access_policy=time_and_key with time_only structure","text":"capsule: time_and_key capsule does not seal an age file: ERR_POLICY_STRUCTURE_MISMATCH","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v3, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ff23599acbe9b0a742792dcb7cb1bc4c datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_and_key profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"access credential",true,"1 identities to try",""],[9,"release",true,"release supplied by the caller",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",false,"capsule: time_and_key capsule does not seal an age file: ERR_POLICY_STRUCTURE_MISMATCH","ERR_POLICY_STRUCTURE_MISMATCH"]]},
   {"name":"format 3: extra stanza in OUTER_TIME_AGE","text":"capsule: OUTER_TIME_AGE must hold exactly one tlock stanza, found 2: ERR_POLICY_STRUCTURE_MISMATCH","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v3, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=556",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=3da4aa192170d6e6a84caf8d1b89665d datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",false,"capsule: OUTER_TIME_AGE must hold exactly one tlock stanza, found 2: ERR_POLICY_STRUCTURE_MISMATCH","ERR_POLICY_STRUCTURE_MISMATCH"]]},
   {"name":"format 3: extra stanza in PAYLOAD_AGE","text":"agewrap: PAYLOAD_AGE has 2 stanzas, want exactly one X25519 stanza: ERR_POLICY_STRUCTURE_MISMATCH","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v3, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=0a1312a462cba3721a98b38f2caebdd8 datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",false,"agewrap: PAYLOAD_AGE has 2 stanzas, want exactly one X25519 stanza: ERR_POLICY_STRUCTURE_MISMATCH","ERR_POLICY_STRUCTURE_MISMATCH"]]},
-  {"name":"format 3: non-X25519 stanza in INNER_ACCESS_AGE","text":"agewrap: INNER_ACCESS_AGE stanza 15 has type \"scrypt\", want \"X25519\": ERR_POLICY_STRUCTURE_MISMATCH","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v3, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=2110",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=d9b19f485bc3d438628e0ad1cdf53ce5 datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_and_key profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"access credential",true,"1 identities to try",""],[9,"release",true,"round 1000 obtained",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",false,"agewrap: INNER_ACCESS_AGE stanza 15 has type \"scrypt\", want \"X25519\": ERR_POLICY_STRUCTURE_MISMATCH","ERR_POLICY_STRUCTURE_MISMATCH"]]},
+  {"name":"format 3: non-X25519 stanza in INNER_ACCESS_AGE","text":"agewrap: INNER_ACCESS_AGE stanza 15 has type \"scrypt\", want \"X25519\": ERR_POLICY_STRUCTURE_MISMATCH","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v3, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=2110",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=d9b19f485bc3d438628e0ad1cdf53ce5 datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_and_key profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"access credential",true,"1 identities to try",""],[9,"release",true,"release supplied by the caller",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",false,"agewrap: INNER_ACCESS_AGE stanza 15 has type \"scrypt\", want \"X25519\": ERR_POLICY_STRUCTURE_MISMATCH","ERR_POLICY_STRUCTURE_MISMATCH"]]},
   {"name":"format 3: tlock stanza round differs from DateKey.round","text":"agewrap: tlock stanza round \"1001\", DateKey round 1000: ERR_ROUND_MISMATCH","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v3, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=16def2d8ead91535dac7a89d334e5bee datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",false,"agewrap: tlock stanza round \"1001\", DateKey round 1000: ERR_ROUND_MISMATCH","ERR_ROUND_MISMATCH"]]},
   {"name":"format 3: tlock stanza chain hash differs from the pinned profile","text":"agewrap: tlock stanza chain hash \"dbd506d6ef76e5f386f41c651dcb808c5bcbd75471cc4eafa3f4df7ad4e4c493\", pinned profile datekeys:quicknet:v1 uses 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971: ERR_PROFILE_MISMATCH","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v3, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=837d8abe415bf5784ef7d568f2fa71cb datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",false,"agewrap: tlock stanza chain hash \"dbd506d6ef76e5f386f41c651dcb808c5bcbd75471cc4eafa3f4df7ad4e4c493\", pinned profile datekeys:quicknet:v1 uses 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971: ERR_PROFILE_MISMATCH","ERR_PROFILE_MISMATCH"]]},
   {"name":"format 3: extension data of a type other than bstr","text":"capsule: PUBLIC_HEADER: key 6: extension \"org.example.label\": key 2: codec: offset 146: a text string where a byte string was expected: ERR_NON_CANONICAL_CBOR","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v3, PUBLIC_HEADER_LEN=159, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"159 bytes",""],[4,"header validation",false,"capsule: PUBLIC_HEADER: key 6: extension \"org.example.label\": key 2: codec: offset 146: a text string where a byte string was expected: ERR_NON_CANONICAL_CBOR","ERR_NON_CANONICAL_CBOR"]]},
   {"name":"format 3: empty extension data (h'')","text":"capsule: PUBLIC_HEADER: key 6: extension \"org.example.label\": data is present but empty; an extension without data omits key 2: ERR_NON_CANONICAL_CBOR","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v3, PUBLIC_HEADER_LEN=147, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"147 bytes",""],[4,"header validation",false,"capsule: PUBLIC_HEADER: key 6: extension \"org.example.label\": data is present but empty; an extension without data omits key 2: ERR_NON_CANONICAL_CBOR","ERR_NON_CANONICAL_CBOR"]]},
   {"name":"format 3: 65 extensions in one array","text":"capsule: PUBLIC_HEADER: key 6: extension: codec: offset 124: array of 65 items, at most 64: ERR_NON_CANONICAL_CBOR","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v3, PUBLIC_HEADER_LEN=1424, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"1424 bytes",""],[4,"header validation",false,"capsule: PUBLIC_HEADER: key 6: extension: codec: offset 124: array of 65 items, at most 64: ERR_NON_CANONICAL_CBOR","ERR_NON_CANONICAL_CBOR"]]},
-  {"name":"format 3: tlock stanza U re-encoded with c0 + p","text":"capsule: age: agewrap: U of the tlock stanza is not the canonical encoding of a point of the key group: ERR_INTEGRITY","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v3, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ff23599acbe9b0a742792dcb7cb1bc4c datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"round 1000 obtained",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",false,"capsule: age: agewrap: U of the tlock stanza is not the canonical encoding of a point of the key group: ERR_INTEGRITY","ERR_INTEGRITY"]]},
-  {"name":"format 3: tlock stanza U is the point at infinity","text":"capsule: age: agewrap: U of the tlock stanza is the point at infinity: ERR_INTEGRITY","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v3, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ff23599acbe9b0a742792dcb7cb1bc4c datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"round 1000 obtained",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",false,"capsule: age: agewrap: U of the tlock stanza is the point at infinity: ERR_INTEGRITY","ERR_INTEGRITY"]]},
-  {"name":"format 3: tlock stanza U with the infinity flag and a payload","text":"capsule: age: agewrap: U of the tlock stanza is not the canonical encoding of a point of the key group: ERR_INTEGRITY","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v3, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ff23599acbe9b0a742792dcb7cb1bc4c datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"round 1000 obtained",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",false,"capsule: age: agewrap: U of the tlock stanza is not the canonical encoding of a point of the key group: ERR_INTEGRITY","ERR_INTEGRITY"]]},
-  {"name":"format 3: tlock stanza body of 127 bytes","text":"capsule: age: agewrap: tlock stanza body of 127 bytes, want 128: ERR_INTEGRITY","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v3, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=457",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ff23599acbe9b0a742792dcb7cb1bc4c datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"round 1000 obtained",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",false,"capsule: age: agewrap: tlock stanza body of 127 bytes, want 128: ERR_INTEGRITY","ERR_INTEGRITY"]]},
-  {"name":"format 3: tlock stanza body of 129 bytes","text":"capsule: age: agewrap: tlock stanza body of 129 bytes, want 128: ERR_INTEGRITY","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v3, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=459",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ff23599acbe9b0a742792dcb7cb1bc4c datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"round 1000 obtained",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",false,"capsule: age: agewrap: tlock stanza body of 129 bytes, want 128: ERR_INTEGRITY","ERR_INTEGRITY"]]},
-  {"name":"format 3: release signature re-encoded with x + p","text":"provider: the signature is not a canonical point encoding, or does not verify as the BLS signature of round 1004 under datekeys:quicknet:v1: ERR_RELEASE_INVALID","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v3, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=6134b00a1f901953021415cdee365c49 datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwNH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1004, unlock at 2023-08-23T15:59:36Z",""],[8,"tlock stanza",true,"round 1004, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"round 1004 obtained",""],[10,"release verification",false,"provider: the signature is not a canonical point encoding, or does not verify as the BLS signature of round 1004 under datekeys:quicknet:v1: ERR_RELEASE_INVALID","ERR_RELEASE_INVALID"]]},
-  {"name":"format 3: release signature is the point at infinity","text":"provider: the signature is not a canonical point encoding, or does not verify as the BLS signature of round 1000 under datekeys:quicknet:v1: ERR_RELEASE_INVALID","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v3, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ff23599acbe9b0a742792dcb7cb1bc4c datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"round 1000 obtained",""],[10,"release verification",false,"provider: the signature is not a canonical point encoding, or does not verify as the BLS signature of round 1000 under datekeys:quicknet:v1: ERR_RELEASE_INVALID","ERR_RELEASE_INVALID"]]},
-  {"name":"format 3: release signature with the infinity flag and a payload","text":"provider: the signature is not a canonical point encoding, or does not verify as the BLS signature of round 1000 under datekeys:quicknet:v1: ERR_RELEASE_INVALID","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v3, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ff23599acbe9b0a742792dcb7cb1bc4c datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"round 1000 obtained",""],[10,"release verification",false,"provider: the signature is not a canonical point encoding, or does not verify as the BLS signature of round 1000 under datekeys:quicknet:v1: ERR_RELEASE_INVALID","ERR_RELEASE_INVALID"]]},
-  {"name":"format 3: release signature negated","text":"provider: the signature is not a canonical point encoding, or does not verify as the BLS signature of round 1000 under datekeys:quicknet:v1: ERR_RELEASE_INVALID","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v3, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ff23599acbe9b0a742792dcb7cb1bc4c datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"round 1000 obtained",""],[10,"release verification",false,"provider: the signature is not a canonical point encoding, or does not verify as the BLS signature of round 1000 under datekeys:quicknet:v1: ERR_RELEASE_INVALID","ERR_RELEASE_INVALID"]]},
-  {"name":"format 3: negated release signature and U re-encoded with c0 + p","text":"provider: the signature is not a canonical point encoding, or does not verify as the BLS signature of round 1000 under datekeys:quicknet:v1: ERR_RELEASE_INVALID","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v3, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ff23599acbe9b0a742792dcb7cb1bc4c datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"round 1000 obtained",""],[10,"release verification",false,"provider: the signature is not a canonical point encoding, or does not verify as the BLS signature of round 1000 under datekeys:quicknet:v1: ERR_RELEASE_INVALID","ERR_RELEASE_INVALID"]]},
-  {"name":"format 3 time_only relabeled format 2","text":"capsule: CONTROL_CBOR: codec: datekeys-control schema version 3, want 2: ERR_UNSUPPORTED_VERSION","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v2, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ff23599acbe9b0a742792dcb7cb1bc4c datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"round 1000 obtained",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",false,"capsule: CONTROL_CBOR: codec: datekeys-control schema version 3, want 2: ERR_UNSUPPORTED_VERSION","ERR_UNSUPPORTED_VERSION"]]},
-  {"name":"AREA_LEN 0","text":"capsule: BODY: AREA_LEN 0 is not a multiple of 512 from 512 to 65536: ERR_INTEGRITY","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v3, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ff23599acbe9b0a742792dcb7cb1bc4c datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"round 1000 obtained",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",true,"canonical CONTROL_CBOR",""],[15,"header binding",true,"matches",""],[16,"payload identity",true,"I_PAYLOAD recovered; L = 659, padding reforzado, P = 768",""],[17,"open payload",false,"capsule: BODY: AREA_LEN 0 is not a multiple of 512 from 512 to 65536: ERR_INTEGRITY","ERR_INTEGRITY"]]},
-  {"name":"AREA_LEN 511","text":"capsule: BODY: AREA_LEN 511 is not a multiple of 512 from 512 to 65536: ERR_INTEGRITY","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v3, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ff23599acbe9b0a742792dcb7cb1bc4c datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"round 1000 obtained",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",true,"canonical CONTROL_CBOR",""],[15,"header binding",true,"matches",""],[16,"payload identity",true,"I_PAYLOAD recovered; L = 659, padding reforzado, P = 768",""],[17,"open payload",false,"capsule: BODY: AREA_LEN 511 is not a multiple of 512 from 512 to 65536: ERR_INTEGRITY","ERR_INTEGRITY"]]},
-  {"name":"AREA_LEN 513","text":"capsule: BODY: AREA_LEN 513 is not a multiple of 512 from 512 to 65536: ERR_INTEGRITY","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v3, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ff23599acbe9b0a742792dcb7cb1bc4c datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"round 1000 obtained",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",true,"canonical CONTROL_CBOR",""],[15,"header binding",true,"matches",""],[16,"payload identity",true,"I_PAYLOAD recovered; L = 659, padding reforzado, P = 768",""],[17,"open payload",false,"capsule: BODY: AREA_LEN 513 is not a multiple of 512 from 512 to 65536: ERR_INTEGRITY","ERR_INTEGRITY"]]},
-  {"name":"AREA_LEN 66048","text":"capsule: BODY: AREA_LEN 66048 is not a multiple of 512 from 512 to 65536: ERR_INTEGRITY","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v3, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ff23599acbe9b0a742792dcb7cb1bc4c datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"round 1000 obtained",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",true,"canonical CONTROL_CBOR",""],[15,"header binding",true,"matches",""],[16,"payload identity",true,"I_PAYLOAD recovered; L = 659, padding reforzado, P = 768",""],[17,"open payload",false,"capsule: BODY: AREA_LEN 66048 is not a multiple of 512 from 512 to 65536: ERR_INTEGRITY","ERR_INTEGRITY"]]},
-  {"name":"SECURITY_LEN 0","text":"capsule: BODY: SECURITY_LEN 0 is not from 1 to AREA_LEN = 512: ERR_INTEGRITY","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v3, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ff23599acbe9b0a742792dcb7cb1bc4c datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"round 1000 obtained",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",true,"canonical CONTROL_CBOR",""],[15,"header binding",true,"matches",""],[16,"payload identity",true,"I_PAYLOAD recovered; L = 659, padding reforzado, P = 768",""],[17,"open payload",false,"capsule: BODY: SECURITY_LEN 0 is not from 1 to AREA_LEN = 512: ERR_INTEGRITY","ERR_INTEGRITY"]]},
-  {"name":"SECURITY_LEN 513, larger than AREA_LEN","text":"capsule: BODY: SECURITY_LEN 513 is not from 1 to AREA_LEN = 512: ERR_INTEGRITY","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v3, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ff23599acbe9b0a742792dcb7cb1bc4c datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"round 1000 obtained",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",true,"canonical CONTROL_CBOR",""],[15,"header binding",true,"matches",""],[16,"payload identity",true,"I_PAYLOAD recovered; L = 659, padding reforzado, P = 768",""],[17,"open payload",false,"capsule: BODY: SECURITY_LEN 513 is not from 1 to AREA_LEN = 512: ERR_INTEGRITY","ERR_INTEGRITY"]]},
-  {"name":"HEAD_LEN 0","text":"capsule: BODY: HEAD_LEN 0 is not from 1 to 16777216: ERR_INTEGRITY","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v3, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ff23599acbe9b0a742792dcb7cb1bc4c datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"round 1000 obtained",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",true,"canonical CONTROL_CBOR",""],[15,"header binding",true,"matches",""],[16,"payload identity",true,"I_PAYLOAD recovered; L = 659, padding reforzado, P = 768",""],[17,"open payload",false,"capsule: BODY: HEAD_LEN 0 is not from 1 to 16777216: ERR_INTEGRITY","ERR_INTEGRITY"]]},
-  {"name":"HEAD_LEN 2^24 + 1","text":"capsule: BODY: HEAD_LEN 16777217 is not from 1 to 16777216: ERR_INTEGRITY","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v3, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ff23599acbe9b0a742792dcb7cb1bc4c datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"round 1000 obtained",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",true,"canonical CONTROL_CBOR",""],[15,"header binding",true,"matches",""],[16,"payload identity",true,"I_PAYLOAD recovered; L = 659, padding reforzado, P = 768",""],[17,"open payload",false,"capsule: BODY: HEAD_LEN 16777217 is not from 1 to 16777216: ERR_INTEGRITY","ERR_INTEGRITY"]]},
-  {"name":"12 + AREA_LEN + HEAD_LEN = L + 1","text":"capsule: BODY: the frame, the area of 512 bytes and the head of 136 bytes exceed L = 659: ERR_INTEGRITY","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v3, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ff23599acbe9b0a742792dcb7cb1bc4c datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"round 1000 obtained",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",true,"canonical CONTROL_CBOR",""],[15,"header binding",true,"matches",""],[16,"payload identity",true,"I_PAYLOAD recovered; L = 659, padding reforzado, P = 768",""],[17,"open payload",false,"capsule: BODY: the frame, the area of 512 bytes and the head of 136 bytes exceed L = 659: ERR_INTEGRITY","ERR_INTEGRITY"]]},
-  {"name":"L < 12: 11","text":"capsule: BODY: L = 11 is shorter than the frame of 12 bytes: ERR_INTEGRITY","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v3, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ff23599acbe9b0a742792dcb7cb1bc4c datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"round 1000 obtained",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",true,"canonical CONTROL_CBOR",""],[15,"header binding",true,"matches",""],[16,"payload identity",true,"I_PAYLOAD recovered; L = 11, padding reforzado, P = 256",""],[17,"open payload",false,"capsule: BODY: L = 11 is shorter than the frame of 12 bytes: ERR_INTEGRITY","ERR_INTEGRITY"]]},
-  {"name":"a byte of the area not zero","text":"capsule: BODY: byte 511 of the security area is not zero: ERR_INTEGRITY","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v3, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ff23599acbe9b0a742792dcb7cb1bc4c datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"round 1000 obtained",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",true,"canonical CONTROL_CBOR",""],[15,"header binding",true,"matches",""],[16,"payload identity",true,"I_PAYLOAD recovered; L = 659, padding reforzado, P = 768",""],[17,"open payload",false,"capsule: BODY: byte 511 of the security area is not zero: ERR_INTEGRITY","ERR_INTEGRITY"]]},
-  {"name":"head of version 2","text":"capsule: head: codec: datekeys-head schema version 2, want 1: ERR_UNSUPPORTED_VERSION","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v3, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ff23599acbe9b0a742792dcb7cb1bc4c datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"round 1000 obtained",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",true,"canonical CONTROL_CBOR",""],[15,"header binding",true,"matches",""],[16,"payload identity",true,"I_PAYLOAD recovered; L = 659, padding reforzado, P = 768",""],[17,"open payload",false,"capsule: head: codec: datekeys-head schema version 2, want 1: ERR_UNSUPPORTED_VERSION","ERR_UNSUPPORTED_VERSION"]]},
-  {"name":"head of another type tag","text":"capsule: head: codec: type \"datekeys-heaD\", want \"datekeys-head\": ERR_NON_CANONICAL_CBOR","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v3, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ff23599acbe9b0a742792dcb7cb1bc4c datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"round 1000 obtained",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",true,"canonical CONTROL_CBOR",""],[15,"header binding",true,"matches",""],[16,"payload identity",true,"I_PAYLOAD recovered; L = 659, padding reforzado, P = 768",""],[17,"open payload",false,"capsule: head: codec: type \"datekeys-heaD\", want \"datekeys-head\": ERR_NON_CANONICAL_CBOR","ERR_NON_CANONICAL_CBOR"]]},
-  {"name":"head with a byte more within HEAD_LEN","text":"capsule: head: codec: offset 113: 1 trailing bytes: ERR_NON_CANONICAL_CBOR","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v3, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ff23599acbe9b0a742792dcb7cb1bc4c datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"round 1000 obtained",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",true,"canonical CONTROL_CBOR",""],[15,"header binding",true,"matches",""],[16,"payload identity",true,"I_PAYLOAD recovered; L = 660, padding reforzado, P = 768",""],[17,"open payload",false,"capsule: head: codec: offset 113: 1 trailing bytes: ERR_NON_CANONICAL_CBOR","ERR_NON_CANONICAL_CBOR"]]},
-  {"name":"paths b and a, in that order","text":"capsule: head: key 5: file 2: R8: the path is not after the path of file 1 in byte order: ERR_NON_CANONICAL_CBOR","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v3, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ff23599acbe9b0a742792dcb7cb1bc4c datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"round 1000 obtained",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",true,"canonical CONTROL_CBOR",""],[15,"header binding",true,"matches",""],[16,"payload identity",true,"I_PAYLOAD recovered; L = 691, padding reforzado, P = 768",""],[17,"open payload",false,"capsule: head: key 5: file 2: R8: the path is not after the path of file 1 in byte order: ERR_NON_CANONICAL_CBOR","ERR_NON_CANONICAL_CBOR"]]},
-  {"name":"paths b/.. and a, in that order","text":"capsule: head: key 5: file 2: R8: the path is not after the path of file 1 in byte order: ERR_NON_CANONICAL_CBOR","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v3, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ff23599acbe9b0a742792dcb7cb1bc4c datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"round 1000 obtained",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",true,"canonical CONTROL_CBOR",""],[15,"header binding",true,"matches",""],[16,"payload identity",true,"I_PAYLOAD recovered; L = 694, padding reforzado, P = 768",""],[17,"open payload",false,"capsule: head: key 5: file 2: R8: the path is not after the path of file 1 in byte order: ERR_NON_CANONICAL_CBOR","ERR_NON_CANONICAL_CBOR"]]},
-  {"name":"path of 1025 bytes","text":"capsule: head: key 5: file 1: key 0: codec: offset 60: a text string of 1025 bytes outside 0..1024: ERR_NON_CANONICAL_CBOR","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v3, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ff23599acbe9b0a742792dcb7cb1bc4c datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"round 1000 obtained",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",true,"canonical CONTROL_CBOR",""],[15,"header binding",true,"matches",""],[16,"payload identity",true,"I_PAYLOAD recovered; L = 1678, padding reforzado, P = 1792",""],[17,"open payload",false,"capsule: head: key 5: file 1: key 0: codec: offset 60: a text string of 1025 bytes outside 0..1024: ERR_NON_CANONICAL_CBOR","ERR_NON_CANONICAL_CBOR"]]},
-  {"name":"path ..","text":"capsule: head: file 1: R3: segment 1: the segment is two dots: ERR_HEAD_INVALID","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v3, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ff23599acbe9b0a742792dcb7cb1bc4c datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"round 1000 obtained",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",true,"canonical CONTROL_CBOR",""],[15,"header binding",true,"matches",""],[16,"payload identity",true,"I_PAYLOAD recovered; L = 653, padding reforzado, P = 768",""],[17,"open payload",false,"capsule: head: file 1: R3: segment 1: the segment is two dots: ERR_HEAD_INVALID","ERR_HEAD_INVALID"]]},
-  {"name":"path /a","text":"capsule: head: file 1: R2: segment 1 is empty: ERR_HEAD_INVALID","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v3, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ff23599acbe9b0a742792dcb7cb1bc4c datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"round 1000 obtained",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",true,"canonical CONTROL_CBOR",""],[15,"header binding",true,"matches",""],[16,"payload identity",true,"I_PAYLOAD recovered; L = 653, padding reforzado, P = 768",""],[17,"open payload",false,"capsule: head: file 1: R2: segment 1 is empty: ERR_HEAD_INVALID","ERR_HEAD_INVALID"]]},
-  {"name":"paths A.txt and a.txt","text":"capsule: head: R7: path 2 collides with path 1 in segment 1: ERR_HEAD_INVALID","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v3, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ff23599acbe9b0a742792dcb7cb1bc4c datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"round 1000 obtained",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",true,"canonical CONTROL_CBOR",""],[15,"header binding",true,"matches",""],[16,"payload identity",true,"I_PAYLOAD recovered; L = 699, padding reforzado, P = 768",""],[17,"open payload",false,"capsule: head: R7: path 2 collides with path 1 in segment 1: ERR_HEAD_INVALID","ERR_HEAD_INVALID"]]},
-  {"name":"paths ab and a, U+200C, b","text":"capsule: head: R7: path 2 collides with path 1 in segment 1: ERR_HEAD_INVALID","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v3, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ff23599acbe9b0a742792dcb7cb1bc4c datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"round 1000 obtained",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",true,"canonical CONTROL_CBOR",""],[15,"header binding",true,"matches",""],[16,"payload identity",true,"I_PAYLOAD recovered; L = 696, padding reforzado, P = 768",""],[17,"open payload",false,"capsule: head: R7: path 2 collides with path 1 in segment 1: ERR_HEAD_INVALID","ERR_HEAD_INVALID"]]},
-  {"name":"path CON.txt","text":"capsule: head: file 1: R6: segment 1: CON is a reserved device name: ERR_HEAD_INVALID","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v3, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ff23599acbe9b0a742792dcb7cb1bc4c datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"round 1000 obtained",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",true,"canonical CONTROL_CBOR",""],[15,"header binding",true,"matches",""],[16,"payload identity",true,"I_PAYLOAD recovered; L = 658, padding reforzado, P = 768",""],[17,"open payload",false,"capsule: head: file 1: R6: segment 1: CON is a reserved device name: ERR_HEAD_INVALID","ERR_HEAD_INVALID"]]},
-  {"name":"path CON.txt in full-width forms","text":"capsule: head: file 1: R6c: segment 1: code page 874 maps the segment to one that breaks R6: CON is a reserved device name: ERR_HEAD_INVALID","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v3, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ff23599acbe9b0a742792dcb7cb1bc4c datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"round 1000 obtained",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",true,"canonical CONTROL_CBOR",""],[15,"header binding",true,"matches",""],[16,"payload identity",true,"I_PAYLOAD recovered; L = 664, padding reforzado, P = 768",""],[17,"open payload",false,"capsule: head: file 1: R6c: segment 1: code page 874 maps the segment to one that breaks R6: CON is a reserved device name: ERR_HEAD_INVALID","ERR_HEAD_INVALID"]]},
-  {"name":"path ABCDEF~1","text":"capsule: head: file 1: R6b: segment 1: the segment has the form of an 8.3 alias: ERR_HEAD_INVALID","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v3, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ff23599acbe9b0a742792dcb7cb1bc4c datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"round 1000 obtained",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",true,"canonical CONTROL_CBOR",""],[15,"header binding",true,"matches",""],[16,"payload identity",true,"I_PAYLOAD recovered; L = 659, padding reforzado, P = 768",""],[17,"open payload",false,"capsule: head: file 1: R6b: segment 1: the segment has the form of an 8.3 alias: ERR_HEAD_INVALID","ERR_HEAD_INVALID"]]},
-  {"name":"path with U+202E","text":"capsule: head: file 1: R4: segment 1: invisible U+202E: ERR_HEAD_INVALID","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v3, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ff23599acbe9b0a742792dcb7cb1bc4c datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"round 1000 obtained",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",true,"canonical CONTROL_CBOR",""],[15,"header binding",true,"matches",""],[16,"payload identity",true,"I_PAYLOAD recovered; L = 660, padding reforzado, P = 768",""],[17,"open payload",false,"capsule: head: file 1: R4: segment 1: invisible U+202E: ERR_HEAD_INVALID","ERR_HEAD_INVALID"]]},
-  {"name":"path .datekeys-x","text":"capsule: head: file 1: R10: the first segment starts with \".datekeys-\": ERR_HEAD_INVALID","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v3, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ff23599acbe9b0a742792dcb7cb1bc4c datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"round 1000 obtained",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",true,"canonical CONTROL_CBOR",""],[15,"header binding",true,"matches",""],[16,"payload identity",true,"I_PAYLOAD recovered; L = 662, padding reforzado, P = 768",""],[17,"open payload",false,"capsule: head: file 1: R10: the first segment starts with \".datekeys-\": ERR_HEAD_INVALID","ERR_HEAD_INVALID"]]},
-  {"name":"comment with U+202E","text":"capsule: head: comment: text: bidirectional control U+202E: ERR_HEAD_INVALID","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v3, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ff23599acbe9b0a742792dcb7cb1bc4c datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"round 1000 obtained",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",true,"canonical CONTROL_CBOR",""],[15,"header binding",true,"matches",""],[16,"payload identity",true,"I_PAYLOAD recovered; L = 666, padding reforzado, P = 768",""],[17,"open payload",false,"capsule: head: comment: text: bidirectional control U+202E: ERR_HEAD_INVALID","ERR_HEAD_INVALID"]]},
-  {"name":"path a.","text":"capsule: head: file 1: R5: segment 1: the segment ends with '.': ERR_HEAD_INVALID","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v3, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ff23599acbe9b0a742792dcb7cb1bc4c datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"round 1000 obtained",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",true,"canonical CONTROL_CBOR",""],[15,"header binding",true,"matches",""],[16,"payload identity",true,"I_PAYLOAD recovered; L = 653, padding reforzado, P = 768",""],[17,"open payload",false,"capsule: head: file 1: R5: segment 1: the segment ends with '.': ERR_HEAD_INVALID","ERR_HEAD_INVALID"]]},
-  {"name":"paths A and a/b","text":"capsule: head: R7: path 2 collides with path 1 in segment 1: ERR_HEAD_INVALID","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v3, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ff23599acbe9b0a742792dcb7cb1bc4c datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"round 1000 obtained",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",true,"canonical CONTROL_CBOR",""],[15,"header binding",true,"matches",""],[16,"payload identity",true,"I_PAYLOAD recovered; L = 693, padding reforzado, P = 768",""],[17,"open payload",false,"capsule: head: R7: path 2 collides with path 1 in segment 1: ERR_HEAD_INVALID","ERR_HEAD_INVALID"]]},
-  {"name":"65536 implicit folders","text":"capsule: head: R9: 65536 folders, more than 65535: ERR_HEAD_INVALID","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v3, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ff23599acbe9b0a742792dcb7cb1bc4c datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"round 1000 obtained",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",true,"canonical CONTROL_CBOR",""],[15,"header binding",true,"matches",""],[16,"payload identity",true,"I_PAYLOAD recovered; L = 235309, padding reforzado, P = 237568",""],[17,"open payload",false,"capsule: head: R9: 65536 folders, more than 65535: ERR_HEAD_INVALID","ERR_HEAD_INVALID"]]},
-  {"name":"declared author with LF","text":"capsule: head: declared author: text: control U+000A in the declared author: ERR_HEAD_INVALID","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v3, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ff23599acbe9b0a742792dcb7cb1bc4c datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"round 1000 obtained",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",true,"canonical CONTROL_CBOR",""],[15,"header binding",true,"matches",""],[16,"payload identity",true,"I_PAYLOAD recovered; L = 671, padding reforzado, P = 768",""],[17,"open payload",false,"capsule: head: declared author: text: control U+000A in the declared author: ERR_HEAD_INVALID","ERR_HEAD_INVALID"]]},
-  {"name":"start of the first entry not 0","text":"capsule: head: file 1: start 1 is not 0, the end of the file before: ERR_HEAD_INVALID","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v3, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ff23599acbe9b0a742792dcb7cb1bc4c datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"round 1000 obtained",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",true,"canonical CONTROL_CBOR",""],[15,"header binding",true,"matches",""],[16,"payload identity",true,"I_PAYLOAD recovered; L = 659, padding reforzado, P = 768",""],[17,"open payload",false,"capsule: head: file 1: start 1 is not 0, the end of the file before: ERR_HEAD_INVALID","ERR_HEAD_INVALID"]]},
-  {"name":"end - start not size","text":"capsule: head: file 1: from start 0 to end 21 is not the size 22: ERR_HEAD_INVALID","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v3, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ff23599acbe9b0a742792dcb7cb1bc4c datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"round 1000 obtained",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",true,"canonical CONTROL_CBOR",""],[15,"header binding",true,"matches",""],[16,"payload identity",true,"I_PAYLOAD recovered; L = 659, padding reforzado, P = 768",""],[17,"open payload",false,"capsule: head: file 1: from start 0 to end 21 is not the size 22: ERR_HEAD_INVALID","ERR_HEAD_INVALID"]]},
-  {"name":"path a followed by VS16","text":"capsule: head: file 1: R4b: segment 1: U+FE0F is not part of an emoji variation sequence: ERR_HEAD_INVALID","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v3, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ff23599acbe9b0a742792dcb7cb1bc4c datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"round 1000 obtained",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",true,"canonical CONTROL_CBOR",""],[15,"header binding",true,"matches",""],[16,"payload identity",true,"I_PAYLOAD recovered; L = 655, padding reforzado, P = 768",""],[17,"open payload",false,"capsule: head: file 1: R4b: segment 1: U+FE0F is not part of an emoji variation sequence: ERR_HEAD_INVALID","ERR_HEAD_INVALID"]]},
-  {"name":"path with two ZWJ in a row","text":"capsule: head: file 1: R4b: segment 1: U+200D right after U+200D: ERR_HEAD_INVALID","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v3, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ff23599acbe9b0a742792dcb7cb1bc4c datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"round 1000 obtained",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",true,"canonical CONTROL_CBOR",""],[15,"header binding",true,"matches",""],[16,"payload identity",true,"I_PAYLOAD recovered; L = 659, padding reforzado, P = 768",""],[17,"open payload",false,"capsule: head: file 1: R4b: segment 1: U+200D right after U+200D: ERR_HEAD_INVALID","ERR_HEAD_INVALID"]]},
-  {"name":"comment with the tag U+E0041","text":"capsule: head: comment: text: invisible U+E0041: ERR_HEAD_INVALID","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v3, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ff23599acbe9b0a742792dcb7cb1bc4c datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"round 1000 obtained",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",true,"canonical CONTROL_CBOR",""],[15,"header binding",true,"matches",""],[16,"payload identity",true,"I_PAYLOAD recovered; L = 669, padding reforzado, P = 768",""],[17,"open payload",false,"capsule: head: comment: text: invisible U+E0041: ERR_HEAD_INVALID","ERR_HEAD_INVALID"]]},
-  {"name":"comment with the variation selector VS17","text":"capsule: head: comment: text: invisible U+E0100: ERR_HEAD_INVALID","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v3, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ff23599acbe9b0a742792dcb7cb1bc4c datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"round 1000 obtained",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",true,"canonical CONTROL_CBOR",""],[15,"header binding",true,"matches",""],[16,"payload identity",true,"I_PAYLOAD recovered; L = 669, padding reforzado, P = 768",""],[17,"open payload",false,"capsule: head: comment: text: invisible U+E0100: ERR_HEAD_INVALID","ERR_HEAD_INVALID"]]},
-  {"name":"start of an entry not the end of the one before","text":"capsule: head: file 2: start 12 is not 11, the end of the file before: ERR_HEAD_INVALID","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v3, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ff23599acbe9b0a742792dcb7cb1bc4c datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"round 1000 obtained",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",true,"canonical CONTROL_CBOR",""],[15,"header binding",true,"matches",""],[16,"payload identity",true,"I_PAYLOAD recovered; L = 691, padding reforzado, P = 768",""],[17,"open payload",false,"capsule: head: file 2: start 12 is not 11, the end of the file before: ERR_HEAD_INVALID","ERR_HEAD_INVALID"]]},
-  {"name":"end of the last file not C","text":"capsule: BODY: the files end at byte 21 of a content of 22 bytes: ERR_INTEGRITY","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v3, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ff23599acbe9b0a742792dcb7cb1bc4c datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"round 1000 obtained",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",true,"canonical CONTROL_CBOR",""],[15,"header binding",true,"matches",""],[16,"payload identity",true,"I_PAYLOAD recovered; L = 659, padding reforzado, P = 768",""],[17,"open payload",false,"capsule: BODY: the files end at byte 21 of a content of 22 bytes: ERR_INTEGRITY","ERR_INTEGRITY"]]},
-  {"name":"a byte of a file changed","text":"capsule: PAYLOAD_AGE: file 1: its SHA-256 is not the one of the head: ERR_INTEGRITY","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v3, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ff23599acbe9b0a742792dcb7cb1bc4c datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"round 1000 obtained",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",true,"canonical CONTROL_CBOR",""],[15,"header binding",true,"matches",""],[16,"payload identity",true,"I_PAYLOAD recovered; L = 659, padding reforzado, P = 768",""],[17,"open payload",false,"capsule: PAYLOAD_AGE: file 1: its SHA-256 is not the one of the head: ERR_INTEGRITY","ERR_INTEGRITY"]]},
-  {"name":"path .. and a padding byte not zero","text":"capsule: head: file 1: R3: segment 1: the segment is two dots: ERR_HEAD_INVALID","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v3, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ff23599acbe9b0a742792dcb7cb1bc4c datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"round 1000 obtained",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",true,"canonical CONTROL_CBOR",""],[15,"header binding",true,"matches",""],[16,"payload identity",true,"I_PAYLOAD recovered; L = 653, padding reforzado, P = 768",""],[17,"open payload",false,"capsule: head: file 1: R3: segment 1: the segment is two dots: ERR_HEAD_INVALID","ERR_HEAD_INVALID"]]},
-  {"name":"path .. and the next STREAM chunk corrupt","text":"capsule: PAYLOAD_AGE: the age payload is truncated, has trailing data or fails STREAM authentication: ERR_INTEGRITY","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v3, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=091119676ec081409c666846153ba7eb datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMX0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1001, unlock at 2023-08-23T15:59:27Z",""],[8,"tlock stanza",true,"round 1001, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"round 1001 obtained",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",true,"canonical CONTROL_CBOR",""],[15,"header binding",true,"matches",""],[16,"payload identity",true,"I_PAYLOAD recovered; L = 84078, padding reforzado, P = 86016",""],[17,"open payload",false,"capsule: PAYLOAD_AGE: the age payload is truncated, has trailing data or fails STREAM authentication: ERR_INTEGRITY","ERR_INTEGRITY"]]},
-  {"name":"path .. and a cut right after its chunk","text":"capsule: PAYLOAD_AGE: the age payload is truncated, has trailing data or fails STREAM authentication: ERR_INTEGRITY","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v3, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=091119676ec081409c666846153ba7eb datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMX0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1001, unlock at 2023-08-23T15:59:27Z",""],[8,"tlock stanza",true,"round 1001, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"round 1001 obtained",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",true,"canonical CONTROL_CBOR",""],[15,"header binding",true,"matches",""],[16,"payload identity",true,"I_PAYLOAD recovered; L = 84078, padding reforzado, P = 86016",""],[17,"open payload",false,"capsule: PAYLOAD_AGE: the age payload is truncated, has trailing data or fails STREAM authentication: ERR_INTEGRITY","ERR_INTEGRITY"]]},
-  {"name":"security of version 2 opens with the verdict X","text":"ok","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v3, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ff23599acbe9b0a742792dcb7cb1bc4c datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"round 1000 obtained",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",true,"canonical CONTROL_CBOR",""],[15,"header binding",true,"matches",""],[16,"payload identity",true,"I_PAYLOAD recovered; L = 659, padding reforzado, P = 768",""],[17,"open payload",true,"payload authenticated; BODY of 659 bytes, 1 files, area of 512 bytes",""],[18,"commit",true,"1 files",""]]},
-  {"name":"a signature of alg 4294967295 opens with the verdict F1","text":"ok","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v3, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ff23599acbe9b0a742792dcb7cb1bc4c datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"round 1000 obtained",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",true,"canonical CONTROL_CBOR",""],[15,"header binding",true,"matches",""],[16,"payload identity",true,"I_PAYLOAD recovered; L = 659, padding reforzado, P = 768",""],[17,"open payload",true,"payload authenticated; BODY of 659 bytes, 1 files, area of 512 bytes",""],[18,"commit",true,"1 files",""]]},
-  {"name":"a signature of alg 1 that does not verify opens with the verdict F2","text":"ok","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v3, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ff23599acbe9b0a742792dcb7cb1bc4c datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"round 1000 obtained",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",true,"canonical CONTROL_CBOR",""],[15,"header binding",true,"matches",""],[16,"payload identity",true,"I_PAYLOAD recovered; L = 659, padding reforzado, P = 768",""],[17,"open payload",true,"payload authenticated; BODY of 659 bytes, 1 files, area of 512 bytes",""],[18,"commit",true,"1 files",""]]},
-  {"name":"a seal of seal_type 4294967295 opens with the verdict S1","text":"ok","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v3, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ff23599acbe9b0a742792dcb7cb1bc4c datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"round 1000 obtained",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",true,"canonical CONTROL_CBOR",""],[15,"header binding",true,"matches",""],[16,"payload identity",true,"I_PAYLOAD recovered; L = 659, padding reforzado, P = 768",""],[17,"open payload",true,"payload authenticated; BODY of 659 bytes, 1 files, area of 512 bytes",""],[18,"commit",true,"1 files",""]]},
-  {"name":"the signature of alg 1 altered opens with the verdict F2","text":"ok","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v3, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=681476c1bfa81dd12fec810ee44fe7f7 datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"round 1000 obtained",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",true,"canonical CONTROL_CBOR",""],[15,"header binding",true,"matches",""],[16,"payload identity",true,"I_PAYLOAD recovered; L = 32915, padding reforzado, P = 34816",""],[17,"open payload",true,"payload authenticated; BODY of 32915 bytes, 1 files, area of 32768 bytes",""],[18,"commit",true,"1 files",""]]},
-  {"name":"the signature of alg 1 removed opens with the verdict F0","text":"ok","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v3, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=681476c1bfa81dd12fec810ee44fe7f7 datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"round 1000 obtained",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",true,"canonical CONTROL_CBOR",""],[15,"header binding",true,"matches",""],[16,"payload identity",true,"I_PAYLOAD recovered; L = 32915, padding reforzado, P = 34816",""],[17,"open payload",true,"payload authenticated; BODY of 32915 bytes, 1 files, area of 32768 bytes",""],[18,"commit",true,"1 files",""]]},
-  {"name":"the signature of alg 1 made again with another key opens with the verdict F4 of that key","text":"ok","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v3, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=681476c1bfa81dd12fec810ee44fe7f7 datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"round 1000 obtained",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",true,"canonical CONTROL_CBOR",""],[15,"header binding",true,"matches",""],[16,"payload identity",true,"I_PAYLOAD recovered; L = 32915, padding reforzado, P = 34816",""],[17,"open payload",true,"payload authenticated; BODY of 32915 bytes, 1 files, area of 32768 bytes",""],[18,"commit",true,"1 files",""]]},
-  {"name":"the signature of alg 1 transplanted to another capsule opens with the verdict F2","text":"ok","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v3, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=0cced8e8b035d6dd70f39923b407a96c datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"round 1000 obtained",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",true,"canonical CONTROL_CBOR",""],[15,"header binding",true,"matches",""],[16,"payload identity",true,"I_PAYLOAD recovered; L = 32915, padding reforzado, P = 34816",""],[17,"open payload",true,"payload authenticated; BODY of 32915 bytes, 1 files, area of 32768 bytes",""],[18,"commit",true,"1 files",""]]},
-  {"name":"a key of 31 bytes in a signature of alg 1 opens with the verdict F1","text":"ok","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v3, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=681476c1bfa81dd12fec810ee44fe7f7 datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"round 1000 obtained",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",true,"canonical CONTROL_CBOR",""],[15,"header binding",true,"matches",""],[16,"payload identity",true,"I_PAYLOAD recovered; L = 32915, padding reforzado, P = 34816",""],[17,"open payload",true,"payload authenticated; BODY of 32915 bytes, 1 files, area of 32768 bytes",""],[18,"commit",true,"1 files",""]]},
-  {"name":"a signature of 65 bytes of alg 1 opens with the verdict F1","text":"ok","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v3, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=681476c1bfa81dd12fec810ee44fe7f7 datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"round 1000 obtained",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",true,"canonical CONTROL_CBOR",""],[15,"header binding",true,"matches",""],[16,"payload identity",true,"I_PAYLOAD recovered; L = 32915, padding reforzado, P = 34816",""],[17,"open payload",true,"payload authenticated; BODY of 32915 bytes, 1 files, area of 32768 bytes",""],[18,"commit",true,"1 files",""]]},
-  {"name":"the area widened to 64 KiB after signing opens with the verdict F4 and the same AUTHOR_MESSAGE","text":"ok","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v3, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=681476c1bfa81dd12fec810ee44fe7f7 datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"round 1000 obtained",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",true,"canonical CONTROL_CBOR",""],[15,"header binding",true,"matches",""],[16,"payload identity",true,"I_PAYLOAD recovered; L = 65683, padding reforzado, P = 67584",""],[17,"open payload",true,"payload authenticated; BODY of 65683 bytes, 1 files, area of 65536 bytes",""],[18,"commit",true,"1 files",""]]},
-  {"name":"the public note changed in PUBLIC_HEADER","text":"capsule: header_binding does not match PRELUDE || PUBLIC_HEADER: ERR_HEADER_BINDING","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v3, PUBLIC_HEADER_LEN=169, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"169 bytes",""],[4,"header validation",true,"capsule_id=1999a39e1beae60b2fc9b157d11dab5a datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"round 1000 obtained",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",true,"canonical CONTROL_CBOR",""],[15,"header binding",false,"capsule: header_binding does not match PRELUDE || PUBLIC_HEADER: ERR_HEADER_BINDING","ERR_HEADER_BINDING"]]},
-  {"name":"format 3 time_only relabeled format 1","text":"capsule: CONTROL_CBOR: codec: datekeys-control schema version 3, want 1: ERR_UNSUPPORTED_VERSION","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v1, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ff23599acbe9b0a742792dcb7cb1bc4c datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"round 1000 obtained",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",false,"capsule: CONTROL_CBOR: codec: datekeys-control schema version 3, want 1: ERR_UNSUPPORTED_VERSION","ERR_UNSUPPORTED_VERSION"]]},
-  {"name":"format 3 time_and_key relabeled format 2, with the identity","text":"capsule: CONTROL_CBOR: codec: datekeys-control schema version 3, want 2: ERR_UNSUPPORTED_VERSION","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v2, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=2128",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=29737cb54ad5310734ecf20720c2d317 datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_and_key profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"access credential",true,"1 identities to try",""],[9,"release",true,"round 1000 obtained",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_and_key: INNER_ACCESS_AGE with 16 X25519 stanzas",""],[13,"open access layer",true,"identity matched exactly one stanza",""],[14,"control",false,"capsule: CONTROL_CBOR: codec: datekeys-control schema version 3, want 2: ERR_UNSUPPORTED_VERSION","ERR_UNSUPPORTED_VERSION"]]},
-  {"name":"format 3 time_and_key relabeled format 2, with the .dkk","text":"capsule: the .dkk capsule_digest does not match this .dkc: ERR_ACCESS_INVALID","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v2, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=2128",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=29737cb54ad5310734ecf20720c2d317 datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_and_key profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"access credential",false,"capsule: the .dkk capsule_digest does not match this .dkc: ERR_ACCESS_INVALID","ERR_ACCESS_INVALID"]]}
+  {"name":"format 3: tlock stanza U re-encoded with c0 + p","text":"capsule: age: agewrap: U of the tlock stanza is not the canonical encoding of a point of the key group: ERR_INTEGRITY","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v3, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ff23599acbe9b0a742792dcb7cb1bc4c datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"release supplied by the caller",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",false,"capsule: age: agewrap: U of the tlock stanza is not the canonical encoding of a point of the key group: ERR_INTEGRITY","ERR_INTEGRITY"]]},
+  {"name":"format 3: tlock stanza U is the point at infinity","text":"capsule: age: agewrap: U of the tlock stanza is the point at infinity: ERR_INTEGRITY","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v3, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ff23599acbe9b0a742792dcb7cb1bc4c datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"release supplied by the caller",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",false,"capsule: age: agewrap: U of the tlock stanza is the point at infinity: ERR_INTEGRITY","ERR_INTEGRITY"]]},
+  {"name":"format 3: tlock stanza U with the infinity flag and a payload","text":"capsule: age: agewrap: U of the tlock stanza is not the canonical encoding of a point of the key group: ERR_INTEGRITY","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v3, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ff23599acbe9b0a742792dcb7cb1bc4c datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"release supplied by the caller",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",false,"capsule: age: agewrap: U of the tlock stanza is not the canonical encoding of a point of the key group: ERR_INTEGRITY","ERR_INTEGRITY"]]},
+  {"name":"format 3: tlock stanza body of 127 bytes","text":"capsule: age: agewrap: tlock stanza body of 127 bytes, want 128: ERR_INTEGRITY","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v3, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=457",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ff23599acbe9b0a742792dcb7cb1bc4c datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"release supplied by the caller",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",false,"capsule: age: agewrap: tlock stanza body of 127 bytes, want 128: ERR_INTEGRITY","ERR_INTEGRITY"]]},
+  {"name":"format 3: tlock stanza body of 129 bytes","text":"capsule: age: agewrap: tlock stanza body of 129 bytes, want 128: ERR_INTEGRITY","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v3, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=459",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ff23599acbe9b0a742792dcb7cb1bc4c datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"release supplied by the caller",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",false,"capsule: age: agewrap: tlock stanza body of 129 bytes, want 128: ERR_INTEGRITY","ERR_INTEGRITY"]]},
+  {"name":"format 3: release signature re-encoded with x + p","text":"provider: the signature is not a canonical point encoding, or does not verify as the BLS signature of round 1004 under datekeys:quicknet:v1: ERR_RELEASE_INVALID","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v3, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=6134b00a1f901953021415cdee365c49 datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwNH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1004, unlock at 2023-08-23T15:59:36Z",""],[8,"tlock stanza",true,"round 1004, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"release supplied by the caller",""],[10,"release verification",false,"provider: the signature is not a canonical point encoding, or does not verify as the BLS signature of round 1004 under datekeys:quicknet:v1: ERR_RELEASE_INVALID","ERR_RELEASE_INVALID"]]},
+  {"name":"format 3: release signature is the point at infinity","text":"provider: the signature is not a canonical point encoding, or does not verify as the BLS signature of round 1000 under datekeys:quicknet:v1: ERR_RELEASE_INVALID","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v3, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ff23599acbe9b0a742792dcb7cb1bc4c datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"release supplied by the caller",""],[10,"release verification",false,"provider: the signature is not a canonical point encoding, or does not verify as the BLS signature of round 1000 under datekeys:quicknet:v1: ERR_RELEASE_INVALID","ERR_RELEASE_INVALID"]]},
+  {"name":"format 3: release signature with the infinity flag and a payload","text":"provider: the signature is not a canonical point encoding, or does not verify as the BLS signature of round 1000 under datekeys:quicknet:v1: ERR_RELEASE_INVALID","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v3, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ff23599acbe9b0a742792dcb7cb1bc4c datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"release supplied by the caller",""],[10,"release verification",false,"provider: the signature is not a canonical point encoding, or does not verify as the BLS signature of round 1000 under datekeys:quicknet:v1: ERR_RELEASE_INVALID","ERR_RELEASE_INVALID"]]},
+  {"name":"format 3: release signature negated","text":"provider: the signature is not a canonical point encoding, or does not verify as the BLS signature of round 1000 under datekeys:quicknet:v1: ERR_RELEASE_INVALID","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v3, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ff23599acbe9b0a742792dcb7cb1bc4c datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"release supplied by the caller",""],[10,"release verification",false,"provider: the signature is not a canonical point encoding, or does not verify as the BLS signature of round 1000 under datekeys:quicknet:v1: ERR_RELEASE_INVALID","ERR_RELEASE_INVALID"]]},
+  {"name":"format 3: negated release signature and U re-encoded with c0 + p","text":"provider: the signature is not a canonical point encoding, or does not verify as the BLS signature of round 1000 under datekeys:quicknet:v1: ERR_RELEASE_INVALID","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v3, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ff23599acbe9b0a742792dcb7cb1bc4c datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"release supplied by the caller",""],[10,"release verification",false,"provider: the signature is not a canonical point encoding, or does not verify as the BLS signature of round 1000 under datekeys:quicknet:v1: ERR_RELEASE_INVALID","ERR_RELEASE_INVALID"]]},
+  {"name":"format 3 time_only relabeled format 2","text":"capsule: CONTROL_CBOR: codec: datekeys-control schema version 3, want 2: ERR_UNSUPPORTED_VERSION","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v2, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ff23599acbe9b0a742792dcb7cb1bc4c datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"release supplied by the caller",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",false,"capsule: CONTROL_CBOR: codec: datekeys-control schema version 3, want 2: ERR_UNSUPPORTED_VERSION","ERR_UNSUPPORTED_VERSION"]]},
+  {"name":"AREA_LEN 0","text":"capsule: BODY: AREA_LEN 0 is not a multiple of 512 from 512 to 65536: ERR_INTEGRITY","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v3, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ff23599acbe9b0a742792dcb7cb1bc4c datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"release supplied by the caller",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",true,"canonical CONTROL_CBOR",""],[15,"header binding",true,"matches",""],[16,"payload identity",true,"I_PAYLOAD recovered; L = 659, padding reforzado, P = 768",""],[17,"open payload",false,"capsule: BODY: AREA_LEN 0 is not a multiple of 512 from 512 to 65536: ERR_INTEGRITY","ERR_INTEGRITY"]]},
+  {"name":"AREA_LEN 511","text":"capsule: BODY: AREA_LEN 511 is not a multiple of 512 from 512 to 65536: ERR_INTEGRITY","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v3, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ff23599acbe9b0a742792dcb7cb1bc4c datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"release supplied by the caller",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",true,"canonical CONTROL_CBOR",""],[15,"header binding",true,"matches",""],[16,"payload identity",true,"I_PAYLOAD recovered; L = 659, padding reforzado, P = 768",""],[17,"open payload",false,"capsule: BODY: AREA_LEN 511 is not a multiple of 512 from 512 to 65536: ERR_INTEGRITY","ERR_INTEGRITY"]]},
+  {"name":"AREA_LEN 513","text":"capsule: BODY: AREA_LEN 513 is not a multiple of 512 from 512 to 65536: ERR_INTEGRITY","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v3, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ff23599acbe9b0a742792dcb7cb1bc4c datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"release supplied by the caller",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",true,"canonical CONTROL_CBOR",""],[15,"header binding",true,"matches",""],[16,"payload identity",true,"I_PAYLOAD recovered; L = 659, padding reforzado, P = 768",""],[17,"open payload",false,"capsule: BODY: AREA_LEN 513 is not a multiple of 512 from 512 to 65536: ERR_INTEGRITY","ERR_INTEGRITY"]]},
+  {"name":"AREA_LEN 66048","text":"capsule: BODY: AREA_LEN 66048 is not a multiple of 512 from 512 to 65536: ERR_INTEGRITY","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v3, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ff23599acbe9b0a742792dcb7cb1bc4c datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"release supplied by the caller",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",true,"canonical CONTROL_CBOR",""],[15,"header binding",true,"matches",""],[16,"payload identity",true,"I_PAYLOAD recovered; L = 659, padding reforzado, P = 768",""],[17,"open payload",false,"capsule: BODY: AREA_LEN 66048 is not a multiple of 512 from 512 to 65536: ERR_INTEGRITY","ERR_INTEGRITY"]]},
+  {"name":"SECURITY_LEN 0","text":"capsule: BODY: SECURITY_LEN 0 is not from 1 to AREA_LEN = 512: ERR_INTEGRITY","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v3, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ff23599acbe9b0a742792dcb7cb1bc4c datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"release supplied by the caller",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",true,"canonical CONTROL_CBOR",""],[15,"header binding",true,"matches",""],[16,"payload identity",true,"I_PAYLOAD recovered; L = 659, padding reforzado, P = 768",""],[17,"open payload",false,"capsule: BODY: SECURITY_LEN 0 is not from 1 to AREA_LEN = 512: ERR_INTEGRITY","ERR_INTEGRITY"]]},
+  {"name":"SECURITY_LEN 513, larger than AREA_LEN","text":"capsule: BODY: SECURITY_LEN 513 is not from 1 to AREA_LEN = 512: ERR_INTEGRITY","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v3, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ff23599acbe9b0a742792dcb7cb1bc4c datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"release supplied by the caller",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",true,"canonical CONTROL_CBOR",""],[15,"header binding",true,"matches",""],[16,"payload identity",true,"I_PAYLOAD recovered; L = 659, padding reforzado, P = 768",""],[17,"open payload",false,"capsule: BODY: SECURITY_LEN 513 is not from 1 to AREA_LEN = 512: ERR_INTEGRITY","ERR_INTEGRITY"]]},
+  {"name":"HEAD_LEN 0","text":"capsule: BODY: HEAD_LEN 0 is not from 1 to 16777216: ERR_INTEGRITY","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v3, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ff23599acbe9b0a742792dcb7cb1bc4c datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"release supplied by the caller",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",true,"canonical CONTROL_CBOR",""],[15,"header binding",true,"matches",""],[16,"payload identity",true,"I_PAYLOAD recovered; L = 659, padding reforzado, P = 768",""],[17,"open payload",false,"capsule: BODY: HEAD_LEN 0 is not from 1 to 16777216: ERR_INTEGRITY","ERR_INTEGRITY"]]},
+  {"name":"HEAD_LEN 2^24 + 1","text":"capsule: BODY: HEAD_LEN 16777217 is not from 1 to 16777216: ERR_INTEGRITY","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v3, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ff23599acbe9b0a742792dcb7cb1bc4c datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"release supplied by the caller",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",true,"canonical CONTROL_CBOR",""],[15,"header binding",true,"matches",""],[16,"payload identity",true,"I_PAYLOAD recovered; L = 659, padding reforzado, P = 768",""],[17,"open payload",false,"capsule: BODY: HEAD_LEN 16777217 is not from 1 to 16777216: ERR_INTEGRITY","ERR_INTEGRITY"]]},
+  {"name":"12 + AREA_LEN + HEAD_LEN = L + 1","text":"capsule: BODY: the frame, the area of 512 bytes and the head of 136 bytes exceed L = 659: ERR_INTEGRITY","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v3, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ff23599acbe9b0a742792dcb7cb1bc4c datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"release supplied by the caller",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",true,"canonical CONTROL_CBOR",""],[15,"header binding",true,"matches",""],[16,"payload identity",true,"I_PAYLOAD recovered; L = 659, padding reforzado, P = 768",""],[17,"open payload",false,"capsule: BODY: the frame, the area of 512 bytes and the head of 136 bytes exceed L = 659: ERR_INTEGRITY","ERR_INTEGRITY"]]},
+  {"name":"L < 12: 11","text":"capsule: BODY: L = 11 is shorter than the frame of 12 bytes: ERR_INTEGRITY","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v3, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ff23599acbe9b0a742792dcb7cb1bc4c datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"release supplied by the caller",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",true,"canonical CONTROL_CBOR",""],[15,"header binding",true,"matches",""],[16,"payload identity",true,"I_PAYLOAD recovered; L = 11, padding reforzado, P = 256",""],[17,"open payload",false,"capsule: BODY: L = 11 is shorter than the frame of 12 bytes: ERR_INTEGRITY","ERR_INTEGRITY"]]},
+  {"name":"a byte of the area not zero","text":"capsule: BODY: byte 511 of the security area is not zero: ERR_INTEGRITY","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v3, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ff23599acbe9b0a742792dcb7cb1bc4c datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"release supplied by the caller",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",true,"canonical CONTROL_CBOR",""],[15,"header binding",true,"matches",""],[16,"payload identity",true,"I_PAYLOAD recovered; L = 659, padding reforzado, P = 768",""],[17,"open payload",false,"capsule: BODY: byte 511 of the security area is not zero: ERR_INTEGRITY","ERR_INTEGRITY"]]},
+  {"name":"head of version 2","text":"capsule: head: codec: datekeys-head schema version 2, want 1: ERR_UNSUPPORTED_VERSION","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v3, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ff23599acbe9b0a742792dcb7cb1bc4c datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"release supplied by the caller",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",true,"canonical CONTROL_CBOR",""],[15,"header binding",true,"matches",""],[16,"payload identity",true,"I_PAYLOAD recovered; L = 659, padding reforzado, P = 768",""],[17,"open payload",false,"capsule: head: codec: datekeys-head schema version 2, want 1: ERR_UNSUPPORTED_VERSION","ERR_UNSUPPORTED_VERSION"]]},
+  {"name":"head of another type tag","text":"capsule: head: codec: type \"datekeys-heaD\", want \"datekeys-head\": ERR_NON_CANONICAL_CBOR","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v3, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ff23599acbe9b0a742792dcb7cb1bc4c datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"release supplied by the caller",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",true,"canonical CONTROL_CBOR",""],[15,"header binding",true,"matches",""],[16,"payload identity",true,"I_PAYLOAD recovered; L = 659, padding reforzado, P = 768",""],[17,"open payload",false,"capsule: head: codec: type \"datekeys-heaD\", want \"datekeys-head\": ERR_NON_CANONICAL_CBOR","ERR_NON_CANONICAL_CBOR"]]},
+  {"name":"head with a byte more within HEAD_LEN","text":"capsule: head: codec: offset 113: 1 trailing bytes: ERR_NON_CANONICAL_CBOR","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v3, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ff23599acbe9b0a742792dcb7cb1bc4c datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"release supplied by the caller",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",true,"canonical CONTROL_CBOR",""],[15,"header binding",true,"matches",""],[16,"payload identity",true,"I_PAYLOAD recovered; L = 660, padding reforzado, P = 768",""],[17,"open payload",false,"capsule: head: codec: offset 113: 1 trailing bytes: ERR_NON_CANONICAL_CBOR","ERR_NON_CANONICAL_CBOR"]]},
+  {"name":"paths b and a, in that order","text":"capsule: head: key 5: file 2: R8: the path is not after the path of file 1 in byte order: ERR_NON_CANONICAL_CBOR","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v3, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ff23599acbe9b0a742792dcb7cb1bc4c datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"release supplied by the caller",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",true,"canonical CONTROL_CBOR",""],[15,"header binding",true,"matches",""],[16,"payload identity",true,"I_PAYLOAD recovered; L = 691, padding reforzado, P = 768",""],[17,"open payload",false,"capsule: head: key 5: file 2: R8: the path is not after the path of file 1 in byte order: ERR_NON_CANONICAL_CBOR","ERR_NON_CANONICAL_CBOR"]]},
+  {"name":"paths b/.. and a, in that order","text":"capsule: head: key 5: file 2: R8: the path is not after the path of file 1 in byte order: ERR_NON_CANONICAL_CBOR","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v3, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ff23599acbe9b0a742792dcb7cb1bc4c datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"release supplied by the caller",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",true,"canonical CONTROL_CBOR",""],[15,"header binding",true,"matches",""],[16,"payload identity",true,"I_PAYLOAD recovered; L = 694, padding reforzado, P = 768",""],[17,"open payload",false,"capsule: head: key 5: file 2: R8: the path is not after the path of file 1 in byte order: ERR_NON_CANONICAL_CBOR","ERR_NON_CANONICAL_CBOR"]]},
+  {"name":"path of 1025 bytes","text":"capsule: head: key 5: file 1: key 0: codec: offset 60: a text string of 1025 bytes outside 0..1024: ERR_NON_CANONICAL_CBOR","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v3, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ff23599acbe9b0a742792dcb7cb1bc4c datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"release supplied by the caller",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",true,"canonical CONTROL_CBOR",""],[15,"header binding",true,"matches",""],[16,"payload identity",true,"I_PAYLOAD recovered; L = 1678, padding reforzado, P = 1792",""],[17,"open payload",false,"capsule: head: key 5: file 1: key 0: codec: offset 60: a text string of 1025 bytes outside 0..1024: ERR_NON_CANONICAL_CBOR","ERR_NON_CANONICAL_CBOR"]]},
+  {"name":"path ..","text":"capsule: head: file 1: R3: segment 1: the segment is two dots: ERR_HEAD_INVALID","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v3, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ff23599acbe9b0a742792dcb7cb1bc4c datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"release supplied by the caller",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",true,"canonical CONTROL_CBOR",""],[15,"header binding",true,"matches",""],[16,"payload identity",true,"I_PAYLOAD recovered; L = 653, padding reforzado, P = 768",""],[17,"open payload",false,"capsule: head: file 1: R3: segment 1: the segment is two dots: ERR_HEAD_INVALID","ERR_HEAD_INVALID"]]},
+  {"name":"path /a","text":"capsule: head: file 1: R2: segment 1 is empty: ERR_HEAD_INVALID","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v3, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ff23599acbe9b0a742792dcb7cb1bc4c datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"release supplied by the caller",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",true,"canonical CONTROL_CBOR",""],[15,"header binding",true,"matches",""],[16,"payload identity",true,"I_PAYLOAD recovered; L = 653, padding reforzado, P = 768",""],[17,"open payload",false,"capsule: head: file 1: R2: segment 1 is empty: ERR_HEAD_INVALID","ERR_HEAD_INVALID"]]},
+  {"name":"paths A.txt and a.txt","text":"capsule: head: R7: path 2 collides with path 1 in segment 1: ERR_HEAD_INVALID","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v3, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ff23599acbe9b0a742792dcb7cb1bc4c datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"release supplied by the caller",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",true,"canonical CONTROL_CBOR",""],[15,"header binding",true,"matches",""],[16,"payload identity",true,"I_PAYLOAD recovered; L = 699, padding reforzado, P = 768",""],[17,"open payload",false,"capsule: head: R7: path 2 collides with path 1 in segment 1: ERR_HEAD_INVALID","ERR_HEAD_INVALID"]]},
+  {"name":"paths ab and a, U+200C, b","text":"capsule: head: R7: path 2 collides with path 1 in segment 1: ERR_HEAD_INVALID","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v3, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ff23599acbe9b0a742792dcb7cb1bc4c datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"release supplied by the caller",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",true,"canonical CONTROL_CBOR",""],[15,"header binding",true,"matches",""],[16,"payload identity",true,"I_PAYLOAD recovered; L = 696, padding reforzado, P = 768",""],[17,"open payload",false,"capsule: head: R7: path 2 collides with path 1 in segment 1: ERR_HEAD_INVALID","ERR_HEAD_INVALID"]]},
+  {"name":"path CON.txt","text":"capsule: head: file 1: R6: segment 1: CON is a reserved device name: ERR_HEAD_INVALID","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v3, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ff23599acbe9b0a742792dcb7cb1bc4c datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"release supplied by the caller",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",true,"canonical CONTROL_CBOR",""],[15,"header binding",true,"matches",""],[16,"payload identity",true,"I_PAYLOAD recovered; L = 658, padding reforzado, P = 768",""],[17,"open payload",false,"capsule: head: file 1: R6: segment 1: CON is a reserved device name: ERR_HEAD_INVALID","ERR_HEAD_INVALID"]]},
+  {"name":"path CON.txt in full-width forms","text":"capsule: head: file 1: R6c: segment 1: code page 874 maps the segment to one that breaks R6: CON is a reserved device name: ERR_HEAD_INVALID","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v3, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ff23599acbe9b0a742792dcb7cb1bc4c datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"release supplied by the caller",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",true,"canonical CONTROL_CBOR",""],[15,"header binding",true,"matches",""],[16,"payload identity",true,"I_PAYLOAD recovered; L = 664, padding reforzado, P = 768",""],[17,"open payload",false,"capsule: head: file 1: R6c: segment 1: code page 874 maps the segment to one that breaks R6: CON is a reserved device name: ERR_HEAD_INVALID","ERR_HEAD_INVALID"]]},
+  {"name":"path ABCDEF~1","text":"capsule: head: file 1: R6b: segment 1: the segment has the form of an 8.3 alias: ERR_HEAD_INVALID","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v3, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ff23599acbe9b0a742792dcb7cb1bc4c datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"release supplied by the caller",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",true,"canonical CONTROL_CBOR",""],[15,"header binding",true,"matches",""],[16,"payload identity",true,"I_PAYLOAD recovered; L = 659, padding reforzado, P = 768",""],[17,"open payload",false,"capsule: head: file 1: R6b: segment 1: the segment has the form of an 8.3 alias: ERR_HEAD_INVALID","ERR_HEAD_INVALID"]]},
+  {"name":"path with U+202E","text":"capsule: head: file 1: R4: segment 1: invisible U+202E: ERR_HEAD_INVALID","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v3, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ff23599acbe9b0a742792dcb7cb1bc4c datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"release supplied by the caller",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",true,"canonical CONTROL_CBOR",""],[15,"header binding",true,"matches",""],[16,"payload identity",true,"I_PAYLOAD recovered; L = 660, padding reforzado, P = 768",""],[17,"open payload",false,"capsule: head: file 1: R4: segment 1: invisible U+202E: ERR_HEAD_INVALID","ERR_HEAD_INVALID"]]},
+  {"name":"path .datekeys-x","text":"capsule: head: file 1: R10: the first segment starts with \".datekeys-\": ERR_HEAD_INVALID","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v3, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ff23599acbe9b0a742792dcb7cb1bc4c datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"release supplied by the caller",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",true,"canonical CONTROL_CBOR",""],[15,"header binding",true,"matches",""],[16,"payload identity",true,"I_PAYLOAD recovered; L = 662, padding reforzado, P = 768",""],[17,"open payload",false,"capsule: head: file 1: R10: the first segment starts with \".datekeys-\": ERR_HEAD_INVALID","ERR_HEAD_INVALID"]]},
+  {"name":"comment with U+202E","text":"capsule: head: comment: text: bidirectional control U+202E: ERR_HEAD_INVALID","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v3, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ff23599acbe9b0a742792dcb7cb1bc4c datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"release supplied by the caller",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",true,"canonical CONTROL_CBOR",""],[15,"header binding",true,"matches",""],[16,"payload identity",true,"I_PAYLOAD recovered; L = 666, padding reforzado, P = 768",""],[17,"open payload",false,"capsule: head: comment: text: bidirectional control U+202E: ERR_HEAD_INVALID","ERR_HEAD_INVALID"]]},
+  {"name":"path a.","text":"capsule: head: file 1: R5: segment 1: the segment ends with '.': ERR_HEAD_INVALID","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v3, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ff23599acbe9b0a742792dcb7cb1bc4c datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"release supplied by the caller",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",true,"canonical CONTROL_CBOR",""],[15,"header binding",true,"matches",""],[16,"payload identity",true,"I_PAYLOAD recovered; L = 653, padding reforzado, P = 768",""],[17,"open payload",false,"capsule: head: file 1: R5: segment 1: the segment ends with '.': ERR_HEAD_INVALID","ERR_HEAD_INVALID"]]},
+  {"name":"paths A and a/b","text":"capsule: head: R7: path 2 collides with path 1 in segment 1: ERR_HEAD_INVALID","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v3, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ff23599acbe9b0a742792dcb7cb1bc4c datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"release supplied by the caller",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",true,"canonical CONTROL_CBOR",""],[15,"header binding",true,"matches",""],[16,"payload identity",true,"I_PAYLOAD recovered; L = 693, padding reforzado, P = 768",""],[17,"open payload",false,"capsule: head: R7: path 2 collides with path 1 in segment 1: ERR_HEAD_INVALID","ERR_HEAD_INVALID"]]},
+  {"name":"65536 implicit folders","text":"capsule: head: R9: 65536 folders, more than 65535: ERR_HEAD_INVALID","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v3, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ff23599acbe9b0a742792dcb7cb1bc4c datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"release supplied by the caller",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",true,"canonical CONTROL_CBOR",""],[15,"header binding",true,"matches",""],[16,"payload identity",true,"I_PAYLOAD recovered; L = 235309, padding reforzado, P = 237568",""],[17,"open payload",false,"capsule: head: R9: 65536 folders, more than 65535: ERR_HEAD_INVALID","ERR_HEAD_INVALID"]]},
+  {"name":"declared author with LF","text":"capsule: head: declared author: text: control U+000A in the declared author: ERR_HEAD_INVALID","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v3, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ff23599acbe9b0a742792dcb7cb1bc4c datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"release supplied by the caller",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",true,"canonical CONTROL_CBOR",""],[15,"header binding",true,"matches",""],[16,"payload identity",true,"I_PAYLOAD recovered; L = 671, padding reforzado, P = 768",""],[17,"open payload",false,"capsule: head: declared author: text: control U+000A in the declared author: ERR_HEAD_INVALID","ERR_HEAD_INVALID"]]},
+  {"name":"start of the first entry not 0","text":"capsule: head: file 1: start 1 is not 0, the end of the file before: ERR_HEAD_INVALID","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v3, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ff23599acbe9b0a742792dcb7cb1bc4c datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"release supplied by the caller",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",true,"canonical CONTROL_CBOR",""],[15,"header binding",true,"matches",""],[16,"payload identity",true,"I_PAYLOAD recovered; L = 659, padding reforzado, P = 768",""],[17,"open payload",false,"capsule: head: file 1: start 1 is not 0, the end of the file before: ERR_HEAD_INVALID","ERR_HEAD_INVALID"]]},
+  {"name":"end - start not size","text":"capsule: head: file 1: from start 0 to end 21 is not the size 22: ERR_HEAD_INVALID","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v3, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ff23599acbe9b0a742792dcb7cb1bc4c datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"release supplied by the caller",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",true,"canonical CONTROL_CBOR",""],[15,"header binding",true,"matches",""],[16,"payload identity",true,"I_PAYLOAD recovered; L = 659, padding reforzado, P = 768",""],[17,"open payload",false,"capsule: head: file 1: from start 0 to end 21 is not the size 22: ERR_HEAD_INVALID","ERR_HEAD_INVALID"]]},
+  {"name":"path a followed by VS16","text":"capsule: head: file 1: R4b: segment 1: U+FE0F is not part of an emoji variation sequence: ERR_HEAD_INVALID","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v3, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ff23599acbe9b0a742792dcb7cb1bc4c datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"release supplied by the caller",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",true,"canonical CONTROL_CBOR",""],[15,"header binding",true,"matches",""],[16,"payload identity",true,"I_PAYLOAD recovered; L = 655, padding reforzado, P = 768",""],[17,"open payload",false,"capsule: head: file 1: R4b: segment 1: U+FE0F is not part of an emoji variation sequence: ERR_HEAD_INVALID","ERR_HEAD_INVALID"]]},
+  {"name":"path with two ZWJ in a row","text":"capsule: head: file 1: R4b: segment 1: U+200D right after U+200D: ERR_HEAD_INVALID","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v3, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ff23599acbe9b0a742792dcb7cb1bc4c datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"release supplied by the caller",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",true,"canonical CONTROL_CBOR",""],[15,"header binding",true,"matches",""],[16,"payload identity",true,"I_PAYLOAD recovered; L = 659, padding reforzado, P = 768",""],[17,"open payload",false,"capsule: head: file 1: R4b: segment 1: U+200D right after U+200D: ERR_HEAD_INVALID","ERR_HEAD_INVALID"]]},
+  {"name":"comment with the tag U+E0041","text":"capsule: head: comment: text: invisible U+E0041: ERR_HEAD_INVALID","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v3, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ff23599acbe9b0a742792dcb7cb1bc4c datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"release supplied by the caller",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",true,"canonical CONTROL_CBOR",""],[15,"header binding",true,"matches",""],[16,"payload identity",true,"I_PAYLOAD recovered; L = 669, padding reforzado, P = 768",""],[17,"open payload",false,"capsule: head: comment: text: invisible U+E0041: ERR_HEAD_INVALID","ERR_HEAD_INVALID"]]},
+  {"name":"comment with the variation selector VS17","text":"capsule: head: comment: text: invisible U+E0100: ERR_HEAD_INVALID","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v3, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ff23599acbe9b0a742792dcb7cb1bc4c datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"release supplied by the caller",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",true,"canonical CONTROL_CBOR",""],[15,"header binding",true,"matches",""],[16,"payload identity",true,"I_PAYLOAD recovered; L = 669, padding reforzado, P = 768",""],[17,"open payload",false,"capsule: head: comment: text: invisible U+E0100: ERR_HEAD_INVALID","ERR_HEAD_INVALID"]]},
+  {"name":"start of an entry not the end of the one before","text":"capsule: head: file 2: start 12 is not 11, the end of the file before: ERR_HEAD_INVALID","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v3, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ff23599acbe9b0a742792dcb7cb1bc4c datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"release supplied by the caller",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",true,"canonical CONTROL_CBOR",""],[15,"header binding",true,"matches",""],[16,"payload identity",true,"I_PAYLOAD recovered; L = 691, padding reforzado, P = 768",""],[17,"open payload",false,"capsule: head: file 2: start 12 is not 11, the end of the file before: ERR_HEAD_INVALID","ERR_HEAD_INVALID"]]},
+  {"name":"end of the last file not C","text":"capsule: BODY: the files end at byte 21 of a content of 22 bytes: ERR_INTEGRITY","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v3, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ff23599acbe9b0a742792dcb7cb1bc4c datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"release supplied by the caller",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",true,"canonical CONTROL_CBOR",""],[15,"header binding",true,"matches",""],[16,"payload identity",true,"I_PAYLOAD recovered; L = 659, padding reforzado, P = 768",""],[17,"open payload",false,"capsule: BODY: the files end at byte 21 of a content of 22 bytes: ERR_INTEGRITY","ERR_INTEGRITY"]]},
+  {"name":"a byte of a file changed","text":"capsule: PAYLOAD_AGE: file 1: its SHA-256 is not the one of the head: ERR_INTEGRITY","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v3, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ff23599acbe9b0a742792dcb7cb1bc4c datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"release supplied by the caller",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",true,"canonical CONTROL_CBOR",""],[15,"header binding",true,"matches",""],[16,"payload identity",true,"I_PAYLOAD recovered; L = 659, padding reforzado, P = 768",""],[17,"open payload",false,"capsule: PAYLOAD_AGE: file 1: its SHA-256 is not the one of the head: ERR_INTEGRITY","ERR_INTEGRITY"]]},
+  {"name":"path .. and a padding byte not zero","text":"capsule: head: file 1: R3: segment 1: the segment is two dots: ERR_HEAD_INVALID","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v3, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ff23599acbe9b0a742792dcb7cb1bc4c datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"release supplied by the caller",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",true,"canonical CONTROL_CBOR",""],[15,"header binding",true,"matches",""],[16,"payload identity",true,"I_PAYLOAD recovered; L = 653, padding reforzado, P = 768",""],[17,"open payload",false,"capsule: head: file 1: R3: segment 1: the segment is two dots: ERR_HEAD_INVALID","ERR_HEAD_INVALID"]]},
+  {"name":"path .. and the next STREAM chunk corrupt","text":"capsule: PAYLOAD_AGE: the age payload is truncated, has trailing data or fails STREAM authentication: ERR_INTEGRITY","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v3, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=091119676ec081409c666846153ba7eb datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMX0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1001, unlock at 2023-08-23T15:59:27Z",""],[8,"tlock stanza",true,"round 1001, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"release supplied by the caller",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",true,"canonical CONTROL_CBOR",""],[15,"header binding",true,"matches",""],[16,"payload identity",true,"I_PAYLOAD recovered; L = 84078, padding reforzado, P = 86016",""],[17,"open payload",false,"capsule: PAYLOAD_AGE: the age payload is truncated, has trailing data or fails STREAM authentication: ERR_INTEGRITY","ERR_INTEGRITY"]]},
+  {"name":"path .. and a cut right after its chunk","text":"capsule: PAYLOAD_AGE: the age payload is truncated, has trailing data or fails STREAM authentication: ERR_INTEGRITY","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v3, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=091119676ec081409c666846153ba7eb datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMX0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1001, unlock at 2023-08-23T15:59:27Z",""],[8,"tlock stanza",true,"round 1001, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"release supplied by the caller",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",true,"canonical CONTROL_CBOR",""],[15,"header binding",true,"matches",""],[16,"payload identity",true,"I_PAYLOAD recovered; L = 84078, padding reforzado, P = 86016",""],[17,"open payload",false,"capsule: PAYLOAD_AGE: the age payload is truncated, has trailing data or fails STREAM authentication: ERR_INTEGRITY","ERR_INTEGRITY"]]},
+  {"name":"security of version 2 opens with the verdict X","text":"ok","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v3, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ff23599acbe9b0a742792dcb7cb1bc4c datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"release supplied by the caller",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",true,"canonical CONTROL_CBOR",""],[15,"header binding",true,"matches",""],[16,"payload identity",true,"I_PAYLOAD recovered; L = 659, padding reforzado, P = 768",""],[17,"open payload",true,"payload authenticated; BODY of 659 bytes, 1 files, area of 512 bytes",""],[18,"commit",true,"1 files",""]]},
+  {"name":"a signature of alg 4294967295 opens with the verdict F1","text":"ok","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v3, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ff23599acbe9b0a742792dcb7cb1bc4c datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"release supplied by the caller",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",true,"canonical CONTROL_CBOR",""],[15,"header binding",true,"matches",""],[16,"payload identity",true,"I_PAYLOAD recovered; L = 659, padding reforzado, P = 768",""],[17,"open payload",true,"payload authenticated; BODY of 659 bytes, 1 files, area of 512 bytes",""],[18,"commit",true,"1 files",""]]},
+  {"name":"a signature of alg 1 that does not verify opens with the verdict F2","text":"ok","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v3, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ff23599acbe9b0a742792dcb7cb1bc4c datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"release supplied by the caller",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",true,"canonical CONTROL_CBOR",""],[15,"header binding",true,"matches",""],[16,"payload identity",true,"I_PAYLOAD recovered; L = 659, padding reforzado, P = 768",""],[17,"open payload",true,"payload authenticated; BODY of 659 bytes, 1 files, area of 512 bytes",""],[18,"commit",true,"1 files",""]]},
+  {"name":"a seal of seal_type 4294967295 opens with the verdict S1","text":"ok","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v3, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ff23599acbe9b0a742792dcb7cb1bc4c datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"release supplied by the caller",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",true,"canonical CONTROL_CBOR",""],[15,"header binding",true,"matches",""],[16,"payload identity",true,"I_PAYLOAD recovered; L = 659, padding reforzado, P = 768",""],[17,"open payload",true,"payload authenticated; BODY of 659 bytes, 1 files, area of 512 bytes",""],[18,"commit",true,"1 files",""]]},
+  {"name":"the signature of alg 1 altered opens with the verdict F2","text":"ok","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v3, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=681476c1bfa81dd12fec810ee44fe7f7 datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"release supplied by the caller",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",true,"canonical CONTROL_CBOR",""],[15,"header binding",true,"matches",""],[16,"payload identity",true,"I_PAYLOAD recovered; L = 32915, padding reforzado, P = 34816",""],[17,"open payload",true,"payload authenticated; BODY of 32915 bytes, 1 files, area of 32768 bytes",""],[18,"commit",true,"1 files",""]]},
+  {"name":"the signature of alg 1 removed opens with the verdict F0","text":"ok","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v3, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=681476c1bfa81dd12fec810ee44fe7f7 datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"release supplied by the caller",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",true,"canonical CONTROL_CBOR",""],[15,"header binding",true,"matches",""],[16,"payload identity",true,"I_PAYLOAD recovered; L = 32915, padding reforzado, P = 34816",""],[17,"open payload",true,"payload authenticated; BODY of 32915 bytes, 1 files, area of 32768 bytes",""],[18,"commit",true,"1 files",""]]},
+  {"name":"the signature of alg 1 made again with another key opens with the verdict F4 of that key","text":"ok","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v3, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=681476c1bfa81dd12fec810ee44fe7f7 datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"release supplied by the caller",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",true,"canonical CONTROL_CBOR",""],[15,"header binding",true,"matches",""],[16,"payload identity",true,"I_PAYLOAD recovered; L = 32915, padding reforzado, P = 34816",""],[17,"open payload",true,"payload authenticated; BODY of 32915 bytes, 1 files, area of 32768 bytes",""],[18,"commit",true,"1 files",""]]},
+  {"name":"the signature of alg 1 transplanted to another capsule opens with the verdict F2","text":"ok","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v3, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=0cced8e8b035d6dd70f39923b407a96c datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"release supplied by the caller",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",true,"canonical CONTROL_CBOR",""],[15,"header binding",true,"matches",""],[16,"payload identity",true,"I_PAYLOAD recovered; L = 32915, padding reforzado, P = 34816",""],[17,"open payload",true,"payload authenticated; BODY of 32915 bytes, 1 files, area of 32768 bytes",""],[18,"commit",true,"1 files",""]]},
+  {"name":"a key of 31 bytes in a signature of alg 1 opens with the verdict F1","text":"ok","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v3, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=681476c1bfa81dd12fec810ee44fe7f7 datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"release supplied by the caller",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",true,"canonical CONTROL_CBOR",""],[15,"header binding",true,"matches",""],[16,"payload identity",true,"I_PAYLOAD recovered; L = 32915, padding reforzado, P = 34816",""],[17,"open payload",true,"payload authenticated; BODY of 32915 bytes, 1 files, area of 32768 bytes",""],[18,"commit",true,"1 files",""]]},
+  {"name":"a signature of 65 bytes of alg 1 opens with the verdict F1","text":"ok","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v3, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=681476c1bfa81dd12fec810ee44fe7f7 datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"release supplied by the caller",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",true,"canonical CONTROL_CBOR",""],[15,"header binding",true,"matches",""],[16,"payload identity",true,"I_PAYLOAD recovered; L = 32915, padding reforzado, P = 34816",""],[17,"open payload",true,"payload authenticated; BODY of 32915 bytes, 1 files, area of 32768 bytes",""],[18,"commit",true,"1 files",""]]},
+  {"name":"the area widened to 64 KiB after signing opens with the verdict F4 and the same AUTHOR_MESSAGE","text":"ok","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v3, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=681476c1bfa81dd12fec810ee44fe7f7 datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"release supplied by the caller",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",true,"canonical CONTROL_CBOR",""],[15,"header binding",true,"matches",""],[16,"payload identity",true,"I_PAYLOAD recovered; L = 65683, padding reforzado, P = 67584",""],[17,"open payload",true,"payload authenticated; BODY of 65683 bytes, 1 files, area of 65536 bytes",""],[18,"commit",true,"1 files",""]]},
+  {"name":"the public note changed in PUBLIC_HEADER","text":"capsule: header_binding does not match PRELUDE || PUBLIC_HEADER: ERR_HEADER_BINDING","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v3, PUBLIC_HEADER_LEN=169, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"169 bytes",""],[4,"header validation",true,"capsule_id=1999a39e1beae60b2fc9b157d11dab5a datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"release supplied by the caller",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",true,"canonical CONTROL_CBOR",""],[15,"header binding",false,"capsule: header_binding does not match PRELUDE || PUBLIC_HEADER: ERR_HEADER_BINDING","ERR_HEADER_BINDING"]]},
+  {"name":"format 3 time_only relabeled format 1","text":"capsule: CONTROL_CBOR: codec: datekeys-control schema version 3, want 1: ERR_UNSUPPORTED_VERSION","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v1, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=458",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ff23599acbe9b0a742792dcb7cb1bc4c datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"release supplied by the caller",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_only: CONTROL_CBOR sealed directly",""],[14,"control",false,"capsule: CONTROL_CBOR: codec: datekeys-control schema version 3, want 1: ERR_UNSUPPORTED_VERSION","ERR_UNSUPPORTED_VERSION"]]},
+  {"name":"format 3 time_and_key relabeled format 2, with the identity","text":"capsule: CONTROL_CBOR: codec: datekeys-control schema version 3, want 2: ERR_UNSUPPORTED_VERSION","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v2, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=2128",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=29737cb54ad5310734ecf20720c2d317 datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_and_key profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"access credential",true,"1 identities to try",""],[9,"release",true,"release supplied by the caller",""],[10,"release verification",true,"BLS signature valid under the pinned key",""],[11,"open sealed control",true,"one tlock stanza, header MAC valid",""],[12,"policy structure",true,"time_and_key: INNER_ACCESS_AGE with 16 X25519 stanzas",""],[13,"open access layer",true,"identity matched exactly one stanza",""],[14,"control",false,"capsule: CONTROL_CBOR: codec: datekeys-control schema version 3, want 2: ERR_UNSUPPORTED_VERSION","ERR_UNSUPPORTED_VERSION"]]},
+  {"name":"format 3 time_and_key relabeled format 2, with the .dkk","text":"capsule: the .dkk capsule_digest does not match this .dkc: ERR_ACCESS_INVALID","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v2, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=2128",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=29737cb54ad5310734ecf20720c2d317 datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_and_key profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"access credential",false,"capsule: the .dkk capsule_digest does not match this .dkc: ERR_ACCESS_INVALID","ERR_ACCESS_INVALID"]]},
+  {"name":"round not reached yet, from a network source","text":"capsule: round 1000 is published at 2023-08-23T15:59:24Z, it is 2023-08-23T15:59:23Z: ERR_RELEASE_UNAVAILABLE","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v1, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=446",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ad4d676812b134ff8a3de263f77018b4 datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",false,"capsule: round 1000 is published at 2023-08-23T15:59:24Z, it is 2023-08-23T15:59:23Z: ERR_RELEASE_UNAVAILABLE","ERR_RELEASE_UNAVAILABLE"]]},
+  {"name":"release of another round, from a network source","text":"testkit: the release is discarded: provider: release for round 1001, expected 1000: ERR_ROUND_MISMATCH: ERR_RELEASE_UNAVAILABLE","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v1, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=446",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ad4d676812b134ff8a3de263f77018b4 datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",false,"testkit: the release is discarded: provider: release for round 1001, expected 1000: ERR_ROUND_MISMATCH: ERR_RELEASE_UNAVAILABLE","ERR_RELEASE_UNAVAILABLE"]]},
+  {"name":"release object of another chain","text":"provider: release of chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e970, the pinned profile datekeys:quicknet:v1 is chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971: ERR_PROFILE_MISMATCH","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v1, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=446",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ad4d676812b134ff8a3de263f77018b4 datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"release supplied by the caller",""],[10,"release verification",false,"provider: release of chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e970, the pinned profile datekeys:quicknet:v1 is chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971: ERR_PROFILE_MISMATCH","ERR_PROFILE_MISMATCH"]]},
+  {"name":"release object of another chain and another round, with a clock behind","text":"provider: release of chain d2db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971, the pinned profile datekeys:quicknet:v1 is chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971: ERR_PROFILE_MISMATCH","checks":[[1,"parse DKC1",true,"magic DKC1",""],[2,"prelude",true,"DKC1 v1, PUBLIC_HEADER_LEN=121, SEALED_CONTROL_LEN=446",""],[3,"public header",true,"121 bytes",""],[4,"header validation",true,"capsule_id=ad4d676812b134ff8a3de263f77018b4 datekey=dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0 policy=time_only profile=datekeys:quicknet:v1",""],[5,"sealed control structure",true,"one tlock stanza",""],[6,"payload structure",true,"one X25519 stanza",""],[7,"condition",true,"round 1000, unlock at 2023-08-23T15:59:24Z",""],[8,"tlock stanza",true,"round 1000, chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971",""],[9,"release",true,"release supplied by the caller; round 1000 is published at 2023-08-23T15:59:24Z and the clock says 2023-08-23T15:59:23Z: it may be behind",""],[10,"release verification",false,"provider: release of chain d2db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971, the pinned profile datekeys:quicknet:v1 is chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971: ERR_PROFILE_MISMATCH","ERR_PROFILE_MISMATCH"]]}
  ]
 }

test/vectors/open_cases.json

@@ -1,5 +1,5 @@
 {
- "spec": "0.14",
+ "spec": "0.15",
  "generator": "tool/open_go_vectors.go",
  "source": "c531e936fa8188a4aab01575607cc85d4f5d4fa4",
  "description": "capsule.Open of a .dkc, as edits of a fixture, given the release (null: none), or a source that fails with source_error (its text and its code, none for a plain error); the clock now; the registry of profiles, empty when registry is empty; the extensions known at (id, version) with valid data valid_data (testkit.KnownExtensions), or reject_all, a registry that knows every extension and rejects all data with that text; the age identities, the .dkk decoded before (dkk, with its material replaced by dkk_material) or the .dkk still encoded (dkk_file); a sink that fails at sink_fail (begin, create i, write i, close i or commit, with the text no and the call); an output that fails with disk full when output_fail; accept, refuse to refuse every verdict with not trusted; and author_keys, the author keys saved with their labels. The outcome: result (ok, refused, or the code), text, the checks as [step, name, ok, detail, code], the release requests, the state of the sink, the content (length and SHA-256) or the files ([path, size, SHA-256 of what the sink received]) of a capsule that opens, the verdicts of a capsule of format 3 that opens (signature, seal, lines, author_key and author_label of alg 1, sealed_at), and the unusable extensions of each object as [id, version, text].",

test/vectors/open_heads.json

@@ -1,5 +1,5 @@
 {
- "spec": "0.14",
+ "spec": "0.15",
  "generator": "tool/open_go_vectors.go",
  "source": "c531e936fa8188a4aab01575607cc85d4f5d4fa4",
  "description": "HEAD_CBOR of a fixed seed, valid and broken in each layer of spec §69.1, through capsule.DecodeHead with no registry: the result, the code and the text; with_registry when the registry of the extensions a version 1 and org.example version 2 with data 01 (testkit.KnownExtensions) gives another. encode: capsule.EncodeHead of the decoded heads, their extensions reordered, repeated or in both arrays.",

test/vectors/open_inspect.json

@@ -1,5 +1,5 @@
 {
- "spec": "0.14",
+ "spec": "0.15",
  "generator": "tool/open_go_vectors.go",
  "source": "c531e936fa8188a4aab01575607cc85d4f5d4fa4",
  "description": "texts: the texts of the errors of capsule.Inspect, and results: for each mutation of testdata/vectors/inspect_differential.json, in its order, the index of its text in texts, -1 when steps 1 to 8 pass. views: the exact output of datekeys inspect -json (internal/inspectview) for time_only_extensions with another PUBLIC_HEADER, with the registry standard (extension.Standard), none, or reject_all, which knows every extension and rejects all data with not today.",

test/vectors/open_notes.json

@@ -1,5 +1,5 @@
 {
- "spec": "0.14",
+ "spec": "0.15",
  "generator": "tool/open_go_vectors.go",
  "source": "c531e936fa8188a4aab01575607cc85d4f5d4fa4",
  "description": "The public note of spec §24.1: extension.CheckNote on the string of the bytes data; extension.Note and Header.UnusableNote of noncritical arrays (usable, text, unusable); and extension.Standard, in the order of check, on a note of version 1 with its bytes, absent data when empty: CheckNoncriticalIn of PUBLIC_HEADER (unusable, as [id, version, text]) and CheckWrite in its noncritical array (result and text).",

test/vectors/open_vectors.g.dart

@@ -15,7 +15,7 @@ const openRecordsJson = r'''
 /// Part of test/vectors/open_cases.json: its cases on those fixtures.
 const openCasesJson = r'''
 {
- "spec": "0.14",
+ "spec": "0.15",
  "generator": "tool/open_go_vectors.go",
  "source": "c531e936fa8188a4aab01575607cc85d4f5d4fa4",
  "description": "Part of open_cases.json.",
@@ -97,7 +97,7 @@ const openCasesJson = r'''
 /// Part of test/vectors/open_heads.json.
 const openHeadsJson = r'''
 {
- "spec": "0.14",
+ "spec": "0.15",
  "generator": "tool/open_go_vectors.go",
  "source": "c531e936fa8188a4aab01575607cc85d4f5d4fa4",
  "description": "Part of open_heads.json.",
@@ -166,7 +166,7 @@ const openHeadsJson = r'''
 /// Part of test/vectors/open_notes.json.
 const openNotesJson = r'''
 {
- "spec": "0.14",
+ "spec": "0.15",
  "generator": "tool/open_go_vectors.go",
  "source": "c531e936fa8188a4aab01575607cc85d4f5d4fa4",
  "description": "Part of open_notes.json.",
@@ -520,7 +520,7 @@ const openNotesJson = r'''
 /// The views of test/vectors/open_inspect.json, and every sixth mutation of testdata/vectors/inspect_differential.json of those fixtures, with the text of Go.
 const openInspectJson = r'''
 {
- "spec": "0.14",
+ "spec": "0.15",
  "generator": "tool/open_go_vectors.go",
  "source": "c531e936fa8188a4aab01575607cc85d4f5d4fa4",
  "description": "Part of open_inspect.json.",

test/vectors/release_archive_texts.json

@@ -0,0 +1,89 @@
+{
+ "cases": [
+  {
+   "name": "round 999",
+   "bytes": "a5007818646174656b6579732d72656c656173652d61726368697665010102582052db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971031903e80405b44679b9a59af2ec876b1a6b1ad52ea9b1615fc3982b19576350f93447cb1125e342b73a8dd2bacbe47e4b6b63ed5e39b33bf3667cbd5a82de3a24b4e0e9fe5513cc1a0e840368c6e31f5fcfa79bea03f73896b25883abf2853d10337fb8fa41000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a40658b820c0f8c10207524179a2031ba9537688a0d04e4851b58026be9a341fee3b96fb48ffad28483d84b40a5864aa",
+   "round": 999,
+   "text": "provider: release archive: round 999 is not in the archive, which holds 5 rounds from 1000: ERR_RELEASE_UNAVAILABLE"
+  },
+  {
+   "name": "round 1002",
+   "bytes": "a5007818646174656b6579732d72656c656173652d61726368697665010102582052db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971031903e80405b44679b9a59af2ec876b1a6b1ad52ea9b1615fc3982b19576350f93447cb1125e342b73a8dd2bacbe47e4b6b63ed5e39b33bf3667cbd5a82de3a24b4e0e9fe5513cc1a0e840368c6e31f5fcfa79bea03f73896b25883abf2853d10337fb8fa41000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a40658b820c0f8c10207524179a2031ba9537688a0d04e4851b58026be9a341fee3b96fb48ffad28483d84b40a5864aa",
+   "round": 1002,
+   "text": "provider: release archive: round 1002 is missing: its entry is zeros: ERR_RELEASE_UNAVAILABLE"
+  },
+  {
+   "name": "round 1005",
+   "bytes": "a5007818646174656b6579732d72656c656173652d61726368697665010102582052db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971031903e80405b44679b9a59af2ec876b1a6b1ad52ea9b1615fc3982b19576350f93447cb1125e342b73a8dd2bacbe47e4b6b63ed5e39b33bf3667cbd5a82de3a24b4e0e9fe5513cc1a0e840368c6e31f5fcfa79bea03f73896b25883abf2853d10337fb8fa41000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a40658b820c0f8c10207524179a2031ba9537688a0d04e4851b58026be9a341fee3b96fb48ffad28483d84b40a5864aa",
+   "round": 1005,
+   "text": "provider: release archive: round 1005 is not in the archive, which holds 5 rounds from 1000: ERR_RELEASE_UNAVAILABLE"
+  },
+  {
+   "name": "another chain",
+   "bytes": "a5007818646174656b6579732d72656c656173652d61726368697665010102582052db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e970031903e80405b44679b9a59af2ec876b1a6b1ad52ea9b1615fc3982b19576350f93447cb1125e342b73a8dd2bacbe47e4b6b63ed5e39b33bf3667cbd5a82de3a24b4e0e9fe5513cc1a0e840368c6e31f5fcfa79bea03f73896b25883abf2853d10337fb8fa41000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a40658b820c0f8c10207524179a2031ba9537688a0d04e4851b58026be9a341fee3b96fb48ffad28483d84b40a5864aa",
+   "round": 1000,
+   "text": "provider: release archive: archive of chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e970, the pinned profile datekeys:quicknet:v1 is chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971: ERR_RELEASE_UNAVAILABLE"
+  },
+  {
+   "name": "a byte missing",
+   "bytes": "a5007818646174656b6579732d72656c656173652d61726368697665010102582052db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971031903e80405b44679b9a59af2ec876b1a6b1ad52ea9b1615fc3982b19576350f93447cb1125e342b73a8dd2bacbe47e4b6b63ed5e39b33bf3667cbd5a82de3a24b4e0e9fe5513cc1a0e840368c6e31f5fcfa79bea03f73896b25883abf2853d10337fb8fa41000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a40658b820c0f8c10207524179a2031ba9537688a0d04e4851b58026be9a341fee3b96fb48ffad28483d84b40a5864",
+   "round": 1000,
+   "text": "provider: release archive: 310 bytes, its header announces 5 rounds of 48 bytes: ERR_RELEASE_UNAVAILABLE"
+  },
+  {
+   "name": "a byte more",
+   "bytes": "a5007818646174656b6579732d72656c656173652d61726368697665010102582052db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971031903e80405b44679b9a59af2ec876b1a6b1ad52ea9b1615fc3982b19576350f93447cb1125e342b73a8dd2bacbe47e4b6b63ed5e39b33bf3667cbd5a82de3a24b4e0e9fe5513cc1a0e840368c6e31f5fcfa79bea03f73896b25883abf2853d10337fb8fa41000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a40658b820c0f8c10207524179a2031ba9537688a0d04e4851b58026be9a341fee3b96fb48ffad28483d84b40a5864aa00",
+   "round": 1000,
+   "text": "provider: release archive: 312 bytes, its header announces 5 rounds of 48 bytes: ERR_RELEASE_UNAVAILABLE"
+  },
+  {
+   "name": "empty",
+   "bytes": "",
+   "round": 1000,
+   "text": "provider: release archive: not an archive of version 1: ERR_RELEASE_UNAVAILABLE"
+  },
+  {
+   "name": "a release object",
+   "bytes": "a50070646174656b6579732d72656c65617365010102582052db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971031903e8045830b44679b9a59af2ec876b1a6b1ad52ea9b1615fc3982b19576350f93447cb1125e342b73a8dd2bacbe47e4b6b63ed5e39",
+   "round": 1000,
+   "text": "provider: release archive: not an archive of version 1: ERR_RELEASE_UNAVAILABLE"
+  },
+  {
+   "name": "header version 2",
+   "bytes": "a5007818646174656b6579732d72656c656173652d61726368697665010202582052db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971031903e80405b44679b9a59af2ec876b1a6b1ad52ea9b1615fc3982b19576350f93447cb1125e342b73a8dd2bacbe47e4b6b63ed5e39b33bf3667cbd5a82de3a24b4e0e9fe5513cc1a0e840368c6e31f5fcfa79bea03f73896b25883abf2853d10337fb8fa41000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a40658b820c0f8c10207524179a2031ba9537688a0d04e4851b58026be9a341fee3b96fb48ffad28483d84b40a5864aa",
+   "round": 1000,
+   "text": "provider: release archive: not an archive of version 1: ERR_RELEASE_UNAVAILABLE"
+  },
+  {
+   "name": "count 0",
+   "bytes": "a5007818646174656b6579732d72656c656173652d61726368697665010102582052db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971031903e80400b44679b9a59af2ec876b1a6b1ad52ea9b1615fc3982b19576350f93447cb1125e342b73a8dd2bacbe47e4b6b63ed5e39b33bf3667cbd5a82de3a24b4e0e9fe5513cc1a0e840368c6e31f5fcfa79bea03f73896b25883abf2853d10337fb8fa41000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a40658b820c0f8c10207524179a2031ba9537688a0d04e4851b58026be9a341fee3b96fb48ffad28483d84b40a5864aa",
+   "round": 1000,
+   "text": "provider: release archive: round 1000 is not in the archive, which holds 0 rounds from 1000: ERR_RELEASE_UNAVAILABLE"
+  },
+  {
+   "name": "first round in four bytes",
+   "bytes": "a5007818646174656b6579732d72656c656173652d61726368697665010102582052db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971031a000003e80405b44679b9a59af2ec876b1a6b1ad52ea9b1615fc3982b19576350f93447cb1125e342b73a8dd2bacbe47e4b6b63ed5e39b33bf3667cbd5a82de3a24b4e0e9fe5513cc1a0e840368c6e31f5fcfa79bea03f73896b25883abf2853d10337fb8fa41000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a40658b820c0f8c10207524179a2031ba9537688a0d04e4851b58026be9a341fee3b96fb48ffad28483d84b40a5864aa",
+   "round": 1000,
+   "text": "provider: release archive: its header does not decode: key 3: codec: offset 66: 1000 is not in its shortest form (initial byte 0x1a): ERR_NON_CANONICAL_CBOR: ERR_RELEASE_UNAVAILABLE"
+  },
+  {
+   "name": "four keys",
+   "bytes": "a4007818646174656b6579732d72656c656173652d61726368697665010102582052db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971b44679b9a59af2ec876b1a6b1ad52ea9b1615fc3982b19576350f93447cb1125e342b73a8dd2bacbe47e4b6b63ed5e39b33bf3667cbd5a82de3a24b4e0e9fe5513cc1a0e840368c6e31f5fcfa79bea03f73896b25883abf2853d10337fb8fa41000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a40658b820c0f8c10207524179a2031ba9537688a0d04e4851b58026be9a341fee3b96fb48ffad28483d84b40a5864aa",
+   "round": 1000,
+   "text": "provider: release archive: its header does not decode: 4 keys, want all 5: ERR_RELEASE_UNAVAILABLE"
+  },
+  {
+   "name": "only the header",
+   "bytes": "a5007818646174656b6579732d72656c656173652d61726368697665010102582052db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971031903e80405",
+   "round": 1000,
+   "text": "provider: release archive: 71 bytes, its header announces 5 rounds of 48 bytes: ERR_RELEASE_UNAVAILABLE"
+  },
+  {
+   "name": "count 6 and 6 entries",
+   "bytes": "a5007818646174656b6579732d72656c656173652d61726368697665010102582052db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971031903e80406b44679b9a59af2ec876b1a6b1ad52ea9b1615fc3982b19576350f93447cb1125e342b73a8dd2bacbe47e4b6b63ed5e39b33bf3667cbd5a82de3a24b4e0e9fe5513cc1a0e840368c6e31f5fcfa79bea03f73896b25883abf2853d10337fb8fa41000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a40658b820c0f8c10207524179a2031ba9537688a0d04e4851b58026be9a341fee3b96fb48ffad28483d84b40a5864aa000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
+   "round": 1005,
+   "text": "provider: release archive: round 1005 is missing: its entry is zeros: ERR_RELEASE_UNAVAILABLE"
+  }
+ ],
+ "generator": "tool/release_archive_go_texts.go"
+}

test/vectors/security_vectors.g.dart

@@ -5,7 +5,7 @@
 /// Part of test/vectors/security_vectors.json.
 const securityVectorsJson = r'''
 {
- "spec": "0.14",
+ "spec": "0.15",
  "generator": "tool/security_go_vectors.go",
  "description": "Part of test/vectors/security_vectors.json: every eighth evaluation.",
  "contexts": [

test/vectors/security_vectors.json

@@ -1,5 +1,5 @@
 {
- "spec": "0.14",
+ "spec": "0.15",
  "generator": "tool/security_go_vectors.go",
  "description": "The security area of format 3 as package capsule of the Go reference gives it at the draft v0.12: commitments (PayloadCommit, ControlCommit with decode_format and format, or the text of its error, HeadDigest, SignersDigest, AuthorMessage, AuthorCode as Go's string and its bytes, SigPart, SealSubject); encode (EncodeSecurity, EncodeSecurityWith, EncodeAuthorSignature, EncodeSeal); evaluate: EvaluateSecurityIn of SECURITY_CBOR (hex, parts as [hex, repeat], or a base with edits) in the context of the index, EvaluateSecurity when null: the verdicts, author_key and author_label of alg 1, lines as indices into texts, alg and seal_type as read, and cms, the parts that only the reader of CMS evaluates; lines: Verdicts.Lines and SealedAt of verdicts built here; holder: holderText of a name, or of UTF-16 code units, and a hash. See the header of tool/security_go_vectors.go.",
  "contexts": [

test/vectors/securitycms_vectors.g.dart

@@ -6,7 +6,7 @@
 /// Part of test/vectors/securitycms_vectors.json.
 const securityCmsVectorsJson = r'''
 {
- "spec": "0.14",
+ "spec": "0.15",
  "generator": "tool/security_go_vectors.go",
  "description": "Part of test/vectors/securitycms_vectors.json: its contexts and texts, its bases whole, and some of its cases, each built area as its hexadecimal.",
  "contexts": [

test/vectors/securitycms_vectors.json

@@ -1,5 +1,5 @@
 {
- "spec": "0.14",
+ "spec": "0.15",
  "generator": "tool/security_go_vectors.go",
  "description": "Signatures of alg 2 and seals of seal_type 2 that this program makes, with keys of labels and the deterministic signatures of Go, as package capsule of the Go reference at the draft v0.12 evaluates them with EvaluateSecurityIn in the context of the index: the verdicts, the lines as indices into texts, alg and seal_type as read, cms, the detail of the signers and of a valid seal as the lines of security_vectors.json write it, sealed_at, and author_key of alg 1. An area is pieces (the hexadecimal of bytes, or the index of a chunk, each chunk itself pieces of the chunks before it), or a base edited in its target (value, the SignedData of key 2; signers, its SIGNERS; token, that of key 3) and written again with the encoders of capsule; sha256 is the first 8 bytes of the SHA-256 of the area. See the header of tool/security_go_vectors.go.",
  "contexts": [

test/vectors/tlock_steps.g.dart

@@ -5,7 +5,7 @@
 /// The text of testdata/vectors/tlock_steps.json.
 const tlockStepsJson = r'''
 {
-  "spec": "0.14",
+  "spec": "0.15",
   "description": "Steps 10 and 11 of spec §63 for Quicknet, value by value, over published releases. Step 10: M = SHA-256(uint64_be(round)), H(M) the hash to G1 of RFC 9380 with the suite BLS12381G1_XMD:SHA-256_SSWU_RO_ and the DST dst, and e(H(M), public_key) = e(signature, G2). Step 11: a stanza body U || V || W built with the sigma and the file key of the vector; H2 = SHA-256(\"IBE-H2\" || e(signature, U))[:16], sigma = V XOR H2, H4 = SHA-256(\"IBE-H4\" || sigma)[:16], file_key = W XOR H4, and r = H3(sigma, file_key): h3_base = SHA-256(\"IBE-H3\" || sigma || file_key), then for i = 1, 2, ... d = SHA-256(uint16_le(i) || h3_base), its first byte shifted one bit to the right, until it is below the order of the group; r·G2 = U. Generated by the reference implementation and checked against drand, kyber, tlock and agewrap. See testdata/README.md.",
   "profile": "datekeys:quicknet:v1",
   "scheme": "bls-unchained-g1-rfc9380",

testdata/README.md

@@ -1,7 +1,7 @@
 # DateKeys test data
 
 Official vectors, fixtures and corpora of the DateKeys Protocol Specification
-v0.14, generated by the reference implementation.
+v0.15, generated by the reference implementation.
 Another implementation consumes them as they are: this file documents every
 format, so that no Go code has to be read. The rules that decide each verdict
 are in the specification; this file points to them, and states only what
@@ -21,7 +21,10 @@ added since. The local gate (`scripts/check.sh`) and CI run it and fail if any
 committed file changes: every file below is exactly what the implementation
 computes today.
 
-The `spec` field of every file is `"0.14"`, the version this module declares.
+The `spec` field of every file is `"0.15"`, the version this module declares.
+v0.15 adds the release object and a release in the caller's hand (§47.1,
+§63 step 9.c): `vectors/release.json`, the files of `releases/`, and the
+field `source` of `mutations.json`.
 What v0.12 changes from v0.11, the texts of the verdicts of a certificate and
 of a seal, the profile of a certificate and the rules of the addresses and of
 the padding of a locator, is in the files: the verdicts and the lines of
@@ -48,6 +51,9 @@ Conventions for every file:
 | `vectors/dk1.json` | canonical `dk1_` strings, and rejected encodings with their code | §18, §19, §66 |
 | `vectors/cbor.json` | the CBOR profile, and one block of vectors per schema, CONTROL_CBOR in the three formats | §58, CDDL |
 | `vectors/tlock_ibe.json` | H2 of the tlock IBE: the serialization of an element of GT | §63 step 11 |
+| `vectors/release.json` | the release object, the content of a `.dkr` file, and drand's JSON, each with the result of step 10; the lookups of a local release archive | §47.1, §50, §63 step 10 (v0.15) |
+| `releases/<round>.dkr` | the release object of each published round of the tests: 1000, 1001, 1004 and 2000 | §47.1 (v0.15) |
+| `releases/archive_1000_1004.bin` | a local release archive, the informative format of §50, of rounds 1000 to 1004, two of them missing | §50 (v0.15) |
 | `vectors/tlock_steps.json` | steps 10 and 11 for Quicknet value by value: the message of a round, its hash to G1, and the decryption of a tlock stanza with H2, H4, H3 and the file key | §63 steps 10 and 11 (v0.14) |
 | `vectors/padding.json` | the padding of formats 2 and 3: P for each content length L, and the length of PAYLOAD_AGE | §29.1 |
 | `vectors/paths.json` | the paths of a format 3 head: the rules of one entry, and those of the paths of a head | §29.5 |
@@ -60,7 +66,7 @@ Conventions for every file:
 | `vectors/resolved_ip.json` | the IP address a name of a locator resolves to, NAT64 included, and whether a reader may connect | §44.1 (v0.13) |
 | `vectors/wordkey.json` | the key of words: the words of a text, what a writer refuses, and the identity the words derive | §38.1, §64 |
 | `vectors/locator.json` | the extension `datekeys.capsule` of a `.dkk`, its envelope and its locator, and what a reader rejects and uses of them | §44.1, §64 |
-| `vectors/mutations.json` | the mutation corpus: the 178 mutations of §64 and further cases | §63, §64 |
+| `vectors/mutations.json` | the mutation corpus: the 178 mutations of §64 and further cases, each with the kind of its release source | §63, §64 |
 | `vectors/inspect_differential.json` | 5110 mutations of fourteen fixtures with the verdict of steps 1 to 8 | §63 |
 | `fixtures/<name>.dkc`, `<name>.json` | official capsules and every intermediate value | §67 |
 | `fixtures/<name>.dkk`, `<name>.dkk.json` | official access keys | §68 |
@@ -312,6 +318,58 @@ serialization at once. The same 576 bytes with the twelve coordinates of Fp in
 reverse order, c0 first at every level as `Fp12.toBytes` of `@noble/curves`
 writes them, give `0118eea9d5971745f71e3c94926f1717` and another FK_TIME.
 
+## `vectors/release.json` and `releases/`
+
+The release object of spec v0.15, §47.1: the release of a round as a file,
+`.dkr`, that a person keeps next to the capsule. It is deterministic CBOR with
+the profile of §58, a map of five keys, all required:
+
+```text
+0 → "datekeys-release"
+1 → 1
+2 → chain_hash (32 bytes)
+3 → round (1 to 2^53 − 1)
+4 → signature (1 to 96 bytes; 48 in Quicknet)
+```
+
+The object of a round above 255 measures 111 bytes. `releases/<round>.dkr` is
+the object of each published round the fixtures use, 1000, 1001, 1004 and
+2000, with the Quicknet chain hash: the release that opens each fixture, as a
+file.
+
+`release.json` has three lists:
+
+- `objects`: an `encoding` in hexadecimal, the `round` of the DateKey it is
+  checked against, and the `result`, `ok` or a code, with the `text` of the
+  error of the reference. When the encoding decodes, `release` is what it
+  says: `round`, `signature` and `chain_hash`. The checks are those of step
+  10 for a release in the caller's hand (spec v0.15, §63): the size of the
+  object, from 1 to 1024 bytes, before anything else; its type and version;
+  its encoding and schema (all three `ERR_NON_CANONICAL_CBOR`, but a version
+  other than 1, `ERR_UNSUPPORTED_VERSION`); then, against the pinned profile
+  and the DateKey, the chain hash (`ERR_PROFILE_MISMATCH`), the round
+  (`ERR_ROUND_MISMATCH`) and the signature (`ERR_RELEASE_INVALID`), in that
+  order. A case with several faults gets the code of the first.
+- `json`: drand's JSON, which a reader accepts too as the input of the
+  caller, never as the release object: an `input` whose first byte other than
+  a JSON space is `{`. It has `round` and `signature` in hexadecimal, of either
+  case, and may have `randomness`, which must then be SHA-256 of the
+  signature; it names no chain, so its `release` has no `chain_hash`. Any
+  failure to read it is `ERR_RELEASE_INVALID`, and so is one of more than
+  8192 bytes; then the round and the signature, as for an object.
+- `archive`: the lookups of the local archive `releases/archive_1000_1004.bin`,
+  an informative format (spec v0.15, §50). It is the `header`, the
+  deterministic CBOR map `{0: "datekeys-release-archive", 1: 1, 2: chain_hash,
+  3: first round, 4: number of rounds}`, followed by the 48-byte signature of
+  each round, one after another; a round the archive lacks is 48 zero bytes.
+  This one holds rounds 1000 to 1004, and 1002 and 1003 are zeros. Each lookup
+  gives a `round` and its `result`: `ok` with the `encoding` of the release
+  object the archive supplies, the `.dkr` of that round, or
+  `ERR_RELEASE_UNAVAILABLE` for a round the archive lacks or does not cover.
+
+The texts are those of the reference, for an implementation that wants to
+match them; the codes are normative.
+
 ## `vectors/tlock_steps.json`
 
 Steps 10 and 11 of spec §63 for Quicknet, every intermediate value written
@@ -321,7 +379,7 @@ flow).
 
 ```json
 {
-  "spec": "0.14",
+  "spec": "0.15",
   "description": "…",
   "profile": "datekeys:quicknet:v1",
   "scheme": "bls-unchained-g1-rfc9380",
@@ -753,6 +811,7 @@ reading flow (`capsule.Open`, §63) must fail.
   "spec": true,
   "dkc": { "base": "time_only.dkc", "edits": [[4, 1, "04"]] },
   "release": { "round": 1000, "signature": "b446…" },
+  "source": "supplied",
   "now": "2023-08-23T15:59:24Z",
   "registry": "default",
   "network": false,
@@ -770,8 +829,9 @@ reading flow (`capsule.Open`, §63) must fail.
   named "format 2: …" (66 to 98), the 23 of the list of format 2 (99 to 121),
   5 further cases (122 to 126), the same 33 on the format 3 fixtures, named
   "format 3: …" (127 to 159), the 48 of the list of format 3 (160 to 207), the
-  8 of the list of v0.11 that a capsule can hold (208 to 215), and 3 further
-  cases (216 to 218). A line of the lists of §64 with several values, such as
+  8 of the list of v0.11 that a capsule can hold (208 to 215), 3 further
+  cases (216 to 218), and the 4 cases of the source of the release of v0.15
+  (219 to 222). A line of the lists of §64 with several values, such as
   "AREA_LEN 0, 511, 513 o 66048", is one case for each.
 - `dkc`: the capsule, as edits of a fixture (see above). The reader gets it as a
   seekable file, so that the `capsule_digest` of an offered `.dkk` is checked
@@ -784,13 +844,23 @@ reading flow (`capsule.Open`, §63) must fail.
   is asked for. The reader must verify it (§51): a case may serve a release of
   another round, a round with the signature of another, or a signature that is
   not the canonical encoding of a point (§12.2). `null` means that no release
-  is available (`ERR_RELEASE_UNAVAILABLE`). The release is supplied directly,
-  as the caller's own, so one that breaks the rules of step 10 gets the code
-  of step 10; a source that fetched it over a network would have discarded
-  it, and the code would be `ERR_RELEASE_UNAVAILABLE` at step 9 (spec §63
-  steps 9 and 10).
-- `now`: the reader's clock, RFC 3339. No release is requested before the round
-  time of the DateKey.
+  is available (`ERR_RELEASE_UNAVAILABLE`). `chain_hash`, present in two
+  cases only, is the chain the release object names when it is not the
+  Quicknet chain.
+- `source` (v0.15): what kind of source answers, spec v0.15 §63 step 9:
+  - `supplied`: the release is in the caller's hand, as a `.dkr` would be.
+    The reader is given the release object of `release`, with the Quicknet
+    chain hash unless `chain_hash` says another, and decodes and verifies it
+    at step 10: one that breaks a rule of step 10 gets the code of step 10.
+    The clock is not compared with the round time (step 9.c): with a `now`
+    before it, the capsule opens all the same. Every case but three is
+    `supplied`.
+  - `network`: a network source, such as a drand relay. It is never asked
+    before the round time (step 9.c), and it verifies its answer with the
+    rules of step 10 and discards it when it fails, so the reader gets no
+    release: `ERR_RELEASE_UNAVAILABLE` at step 9.
+- `now`: the reader's clock, RFC 3339. A network source is not asked before
+  the round time of the DateKey; a release in hand is not compared with it.
 - `registry`: `default` pins exactly the Quicknet profile of
   `profile_quicknet.json`; `empty` pins none.
 - `extensions`: the extensions the application implements. Each entry is known
@@ -803,9 +873,10 @@ reading flow (`capsule.Open`, §63) must fail.
   data" and "known critical .dkk extension with invalid data", at steps 4, 14
   and 9, depend on it. Absent: the application knows no extension, the state
   of the base protocol V1.
-- `network`: whether the failure may come after a release request. When false,
-  the reader must fail without requesting any release (§27, §63): every failure
-  of steps 1 to 8 and of step 9 before the request (9.a to 9.c).
+- `network`: whether the failure may come after a release request, to a
+  network source or to the caller's release in hand. When false, the reader
+  must fail without requesting any release (§27, §63): every failure of steps
+  1 to 8 and of step 9 before the request (9.a to 9.c).
 - `frozen`: the capsule was built once with age randomness; its bytes are kept
   and never regenerated. These cases have no `base`.
 - `error`, `step`: the expected code and the step of §63 that fails. For a
@@ -815,6 +886,19 @@ reading flow (`capsule.Open`, §63) must fail.
   format 3, and seven of the list of v0.11.
 
 Every case reproduces offline: the recorded release stands in for the network.
+
+What v0.15 changed in this file: every case gained `source`, `supplied` but
+for three; the further case "round not reached yet", a valid release of round
+1000 and a clock one nanosecond before its round time, was
+`ERR_RELEASE_UNAVAILABLE` at step 9 and now opens (`ok`, step 0, with
+`network` true), because the release is in the caller's hand; and four cases
+were added at the end: the same capsule and clock with a network source,
+still `ERR_RELEASE_UNAVAILABLE` at step 9 without any request; a release of
+another round from a network source, discarded, `ERR_RELEASE_UNAVAILABLE` at
+step 9, where the same release in hand is `ERR_ROUND_MISMATCH` at step 10;
+and two release objects of another chain, `ERR_PROFILE_MISMATCH` at step 10,
+one of them of another round too and with a clock behind. No other case
+changed its result.
 A reader that implements only steps 1 to 8 can replay every case whose `step` is
 at most 8: 57 cases, 39 of them from §64. Steps 1 to 8 are summarised in "The
 checks of steps 1 to 8" below.
@@ -825,7 +909,8 @@ What happens between step 8 and the release request is spec §63 step 9: for
 `time_and_key` only, an offered `.dkk` is checked as an object and then bound
 to the capsule (9.a), at least one credential must be offered (9.b), and for
 either policy a `now` before the round time of the DateKey fails without a
-request (9.c); only then is the release requested. For `time_only` the
+request to a network source (9.c), while a release in hand is not compared
+with it; only then is the release requested. For `time_only` the
 credentials play no part: the §64 case "access_policy=time_only with
 time_and_key structure" offers a `.dkk` whose `capsule_digest` is that of the
 unmutated capsule, and fails at step 12, not at step 9. The codes after the
@@ -834,8 +919,9 @@ file (steps 11, 13 and 17), are those of spec §63 as well. In this corpus:
 
 - identities are not examined before the release (spec §63 step 13);
 - a `release` of `null` is `ERR_RELEASE_UNAVAILABLE` at step 9;
-- every `release` is supplied directly, so an invalid one fails at step 10:
-  the source is not a network source, which would discard it at step 9;
+- a `release` of a `supplied` case is in the caller's hand, so an invalid one
+  fails at step 10, and step 9.c does not apply to it; a `network` source
+  discards it at step 9, and is not asked before the round time;
 - every `.dkk` offered decodes: the corpus checks step 9.a, not the decoding
   of a `.dkk`, whose errors spec §63 also places at step 9.a.
 

testdata/SOURCE.json

@@ -1,142 +1,148 @@
 {
   "module": "g.activething.com/go/DateKeys",
-  "commit": "39b2033e3ccf54a91bda8d7e3ced39b26dbfa58c",
+  "commit": "3c3e7370c2b6319e1fc261a1b26c88f1d43e3fa6",
   "files": {
-    "README.md": "799d72ac1b30d8dc3769732712db40ad3c24ae6d58099280e14b39b3fdeb232c",
+    "README.md": "4cf931dfa0a1d3a33dd24cef95b3f4fc30d190ed912ee8d30808ac9bc3aca930",
     "fixtures/empty_payload.dkc": "871e9bf05b52bbae17f3adfbbf97b46e7f0e53aa8f57bcaa506e43f36f53a9d4",
     "fixtures/empty_payload.inspect.json": "373e5d012b023ad58bbb54cbdffe0bed9e50c637438a4083ddb74d5414c59f59",
-    "fixtures/empty_payload.json": "6da4e8b868fe96c198730bd0d4416cd2133a4a601296519eca174200bce98b50",
+    "fixtures/empty_payload.json": "d1fc459ab76d4ee0231a8c6b7dfc212fcf8da90e7a392b30133f646b3a9df4db",
     "fixtures/empty_payload.plaintext": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
     "fixtures/format2_empty_payload.dkc": "7aea2b5aa48b1a46053716f733d50fab9cd0b80b1be67631bcc06c5bb765dc21",
     "fixtures/format2_empty_payload.inspect.json": "d0bb7356d3970986e6b197640f0b3b38abe9fabf1740b745171b358aa28903ff",
-    "fixtures/format2_empty_payload.json": "46acca809abefca332fea81cc124b8506fbbb0655e66983cdf614f3c78c0e8a2",
+    "fixtures/format2_empty_payload.json": "699cc67dd448ba69ecc52ad97a1947175b46f9d64859a6fd018ecae8fbe12508",
     "fixtures/format2_empty_payload.plaintext": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
     "fixtures/format2_time_and_key_portable.dkc": "600892659fe4890223e895876275f656995d170fda42b07fb2bec0ca51ce4b43",
     "fixtures/format2_time_and_key_portable.dkk": "095b7bc516a22bf0c2366f0af3cd48bfe857a2354d6e2a9b285278b95e450fe0",
-    "fixtures/format2_time_and_key_portable.dkk.json": "e32128d0a1cba1fa1a6d8f5736728fe5d2342ac36efddfd8884cd5b256a369df",
+    "fixtures/format2_time_and_key_portable.dkk.json": "0f95e43881b140330415ca98a284913c22dab9af3b9e16da0f4d2b1b5229d768",
     "fixtures/format2_time_and_key_portable.inspect.json": "522c9a98e5911c86f5f24f278971cf7c7588f6c88aaede3dd1129ee4e042868a",
-    "fixtures/format2_time_and_key_portable.json": "20ce55ecb3d2aec77592dd56c1930f3f53594b83c8a881317460e01b5cae1a24",
+    "fixtures/format2_time_and_key_portable.json": "960bd78f54c91d0f8afcb9a1fdc18a7c7a7d74363ac1b77aa4ebef183d258dc6",
     "fixtures/format2_time_and_key_portable.plaintext": "937492203d207d6fe36161b8696bf1f05b8b4cc56d855c44853f4b76aad3a05b",
     "fixtures/format2_time_and_key_recipients.dkc": "1a44fd8708c92e2e0a10cfcb1d864a71331ea9af25d97e1a42e969dc898959e3",
     "fixtures/format2_time_and_key_recipients.dkk": "2ad99b1556086ec311d7f0b3bd3aaba05e75f45c4fa22490b0d5e8bb0b1a222e",
-    "fixtures/format2_time_and_key_recipients.dkk.json": "5223a3b01b6e0c8f9cb6244e4edb9eec0d5c2b90111b2f748f12f330431df920",
+    "fixtures/format2_time_and_key_recipients.dkk.json": "9d7e89e390e253bc1a432fa36ca2c37abbd6e88a0ac2fc25e87c1b7bb442e7d1",
     "fixtures/format2_time_and_key_recipients.inspect.json": "d975a9eddd45f5d59618ea2455d574d807e57daf08585e840d07986f261bf099",
-    "fixtures/format2_time_and_key_recipients.json": "3f3b85f0b870867335bc3b0a820d6022e490904878d65a84984e347da2f49f9c",
+    "fixtures/format2_time_and_key_recipients.json": "34abdf930940ff7ac7b28de597bda3fdcadc94a074912e5220153bd85f9e096c",
     "fixtures/format2_time_and_key_recipients.plaintext": "0e9fd50e98a85953aa9cf07a11ee3c62bb3d7622f344f1c6ce744d1ed111659f",
     "fixtures/format2_time_and_key_sixteen.dkc": "7aaac5c18f216bf53df326ecc817179640a53408cf25dfd50488910a762dc381",
     "fixtures/format2_time_and_key_sixteen.inspect.json": "492cd0b0dca0030df9332b098d22b4f6aa4adfb57d5540de5325e3e6d5aa3667",
-    "fixtures/format2_time_and_key_sixteen.json": "ef2b4107e9b24d350681a6c5f00476d7bbf987f65b6a1a2070255cc4b08b6308",
+    "fixtures/format2_time_and_key_sixteen.json": "30b8103e730e3cea5b8b39078b61022c8e3e168dec70c27a7aa69c83046853ee",
     "fixtures/format2_time_and_key_sixteen.plaintext": "e5abfb7b5fdbf297277b6cc4729c15d85435e890b653c2e2342b7031ecd9eab9",
     "fixtures/format2_time_only.dkc": "f5a40ac6b8a08a0c12db6114c2bca23522d6a77b512b509a217fb15f367813c4",
     "fixtures/format2_time_only.inspect.json": "40a8683f5204c7b6369558e4775ae6bb6fed978097e9e660de64c06c167b043e",
-    "fixtures/format2_time_only.json": "aa844c0b985cb6822a0ca4a2fa9acfa37260dfe3358336ee2735351a6c853648",
+    "fixtures/format2_time_only.json": "4a3c76f1a75fbc39399c5bd7f8c355565c2ea826ad1284dd056953af8aedb009",
     "fixtures/format2_time_only.plaintext": "53b8ee821fb7b678e89d4f93da1812339f6cc1ab83aac6ed1432db99df784be5",
     "fixtures/format2_time_only_bloque256.dkc": "aae769c30d04920801d8b293d30864fbe223c9c9353ec2b4907a1ee1996e39f9",
     "fixtures/format2_time_only_bloque256.inspect.json": "767766414ad547f0ba95b40059e14b62c81b5489a2afcbc683bf227334d61be7",
-    "fixtures/format2_time_only_bloque256.json": "63b9c57c6d4b8be71c584afa79584f47f6365677adcefe07db9c2162827df922",
+    "fixtures/format2_time_only_bloque256.json": "7dbd8dc320dbed995be9cb5830ca9a50d4fb8e956b1d468408f6199c97fc26f4",
     "fixtures/format2_time_only_bloque256.plaintext": "53b8ee821fb7b678e89d4f93da1812339f6cc1ab83aac6ed1432db99df784be5",
     "fixtures/format2_time_only_extensions.dkc": "fb406100d5703a2e888983b3175ed34a09a34469cc722256e5cf535dd728fbe9",
     "fixtures/format2_time_only_extensions.inspect.json": "1595d793c1d35bfdaa36576b75f53d734a9e07c2a8a12036295dbaee7f5a7f5a",
-    "fixtures/format2_time_only_extensions.json": "2f7f4664bc9845d6f976616b8347ae5bb0d0e380c5c1bc396d83b3e22e432c2f",
+    "fixtures/format2_time_only_extensions.json": "bfe30126441ea1b1b2e9b7cb0cbbce71d5f26f98b77004893b46ebf4be6b573f",
     "fixtures/format2_time_only_extensions.plaintext": "1129768e195e2f1e50b7a6f926b6eebef120212c29b5642c8a662c503b2a9131",
     "fixtures/format3_area_1024.dkc": "41ea2eed0293e4fef7f4a307b7f16aaf1339f5bf6f4ded7a6a9ae1aebeb0133c",
     "fixtures/format3_area_1024.inspect.json": "06e6b347926242ae5540f16a053f6a3545743986989bc0be8c39918bce968686",
-    "fixtures/format3_area_1024.json": "59a9e7d5575a57154d524ddeeba6cd84ac746da6831ba66588d7bb718953e3c3",
+    "fixtures/format3_area_1024.json": "06319a474d9e6c545185aa282be407908f98cb97a1ad5128fc0d557adc45695d",
     "fixtures/format3_area_1024.plaintext": "043830350a287cba1fd50f6c063f70a74209895ff0cf03147bb4e5ccdfc206b5",
     "fixtures/format3_bloque256.dkc": "ff18444f434164ba8e7b26d38c76c7855dc6b0593b2fc8b4e9a95dbf9252d55d",
     "fixtures/format3_bloque256.inspect.json": "d0007080da5ce079c6ffa3a56bf8ce519d2846a31cc1082fd027f401e4f7bade",
-    "fixtures/format3_bloque256.json": "71dd9668f9dd1121dbd86de46c6561b821bb0fd5b90135685d4c4744a02a1a06",
+    "fixtures/format3_bloque256.json": "e551a2224454cd5a416d6e91e2ab0947249a906dac3ef028a3dd45ee441e62b9",
     "fixtures/format3_bloque256.plaintext": "9ff2843e40bc1280dbfea8dce9386a42d06e8b43742c2cc6257540770cb53c73",
     "fixtures/format3_comment_only.dkc": "7f98a89413f08655bbbab28b96585dfa6173c1705dd81a900deba2100d19f2ef",
     "fixtures/format3_comment_only.inspect.json": "fb56eca8bf42c8c47fde4a1d6b2580fcff386f2f58b566820731dce388542196",
-    "fixtures/format3_comment_only.json": "42136f5029312236554a12569e9eca36b1ce5651d7db9e20ef3cb5fba4553234",
+    "fixtures/format3_comment_only.json": "1aff9f9c3531e269fc48b25c4e224e6b547ba1d5eba187ed6afa3eaff82c26f8",
     "fixtures/format3_comment_only.plaintext": "bc5b05885e608f036d8a14fde8738a8c53b395b71c3bcee99c1eab37ea23e80e",
     "fixtures/format3_note.dkc": "da1bee54231252a0fd98439e24588125c5521f6e5a2c6641b499e6b22192c0eb",
     "fixtures/format3_note.inspect.json": "dcebb62407097c757bb62552be5d315155ba8a35dec175e95c3f6fddd6e81869",
-    "fixtures/format3_note.json": "31eb7b8f64686e818ea9d621f9a1bba7b68c6781dee0919a66cd31e31f0eedec",
+    "fixtures/format3_note.json": "70bae49ca3ee84dcd4fecc572d500ce61cb014cc1e43385ae172cf414e10fa41",
     "fixtures/format3_note.plaintext": "0468737c5141be936f59d2823122e87661d4ae155a1df036b4cad1ea6620c17b",
     "fixtures/format3_seal_unsupported.dkc": "ae3219fbdbd1de4cef6fade1a3fb3f6e5d5e2e8af54d9516b05f0a48136913ad",
     "fixtures/format3_seal_unsupported.inspect.json": "b3a7a1038192394c1f844fed994011646f3e78d1cf311c18cb5c936249b95f14",
-    "fixtures/format3_seal_unsupported.json": "79d2204d7c769a54b98e3b023da6a241dadbee065142f29ffaab3fb9c0a549e8",
+    "fixtures/format3_seal_unsupported.json": "fedb92f17376cb90d91bce6777e152739d63bee884809ec9458dd5610d939d66",
     "fixtures/format3_seal_unsupported.plaintext": "0f865221d26545762712271faf835cb2e9980f8fb15c9d3b94fb6747cf16c1df",
     "fixtures/format3_sealed.dkc": "dde5a072d8783227d28279d06d3d226a1fb967c766da626f889d1c6fd76ac9c7",
     "fixtures/format3_sealed.inspect.json": "b984a0755332bad838025e47f8e917b9f18b9bb5c068c2d1ef0070db8e42849c",
-    "fixtures/format3_sealed.json": "ffb93eff785a8bf045d3b6cbda0f8f25feb62337ccf90e7debb96fd1e9592e9f",
+    "fixtures/format3_sealed.json": "b925f7daae6d21c139b529a10900b9f67adb121b18670682969da3d1faa4e382",
     "fixtures/format3_sealed.plaintext": "aea0f5feb40acd81ca3b02dd21ea15510234da3ab52b374322f3206e7632d47b",
     "fixtures/format3_security_v2.dkc": "3d02b39ace010d74604554e378d22fe5ce00cecd998c0f797d657b17620b8912",
     "fixtures/format3_security_v2.inspect.json": "dba4d21f1d4e228a17c761bae9a4b8c5a91cd9c0123e3141d3782a43c139321e",
-    "fixtures/format3_security_v2.json": "72b980a6377ef0273ad2b82157851d37c9ba35da44b3bc6c75f13bf95ba6b3c7",
+    "fixtures/format3_security_v2.json": "47bf9cf26e04f1c87eaf669d3d3811846bffd188dc6a90b3ac96cc45ea1ff256",
     "fixtures/format3_security_v2.plaintext": "0c58ef40e4b1c7afde0f6e0a1f4ed7e3d45405757c5143a095f0c2b58042669f",
     "fixtures/format3_signature_unsupported.dkc": "e8e3106d8d73bb7b845062e0fe42af21df7d7cd8f63c335cab8dedb3e690df31",
     "fixtures/format3_signature_unsupported.inspect.json": "6db653db27604cb07e2cb2c23545fb68542c121e85002762f26c6d39e63bf00c",
-    "fixtures/format3_signature_unsupported.json": "44dacb87b9c170c5ed0b2d565cfb7542c1e1face2624f4c26a40bb4fcbe65810",
+    "fixtures/format3_signature_unsupported.json": "1e2e173ede53f38fb368289fc616325b18c7e07fd87d5eda28ace180087f151e",
     "fixtures/format3_signature_unsupported.plaintext": "9fe05e6b3a463371b33fc6a81b81d538e572789a8d03ace9f752a931f4ca4728",
     "fixtures/format3_signed.dkc": "3c7d3c9e24c02853a0c7761b93bea1120b27fce396468d8d0f68e53aeb668c5e",
     "fixtures/format3_signed.inspect.json": "7c37054d542869e766147350e2fa72695f209d39a03726757008e2c2291b0e97",
-    "fixtures/format3_signed.json": "95e3161f90c84edb026c6d90c75e1f293646ac8bdfc73b03d76ce7ac6c2efaeb",
+    "fixtures/format3_signed.json": "725b6cdb41ad9a5d34ec5327f7b0f1b667510fea6a9b1fb714be582ed55eaaed",
     "fixtures/format3_signed.plaintext": "3de3ccab0ac74f95a76aa45c0f85e1749d4b4a051d87e81828eff6bf24372000",
     "fixtures/format3_signed_cms.dkc": "d658f8d5ac2c5550c07b8f8fd6883b2f6dc02ceafc47d436ea02d8950b2548d2",
     "fixtures/format3_signed_cms.inspect.json": "afadf530e8146687b25c03f26100ebff18e7f481e0ef09378816bad582270de5",
-    "fixtures/format3_signed_cms.json": "8a6047ba60047462f41ebe2e52c5ab4c6e13c60cf0bebd478a5f1611d5e0b88a",
+    "fixtures/format3_signed_cms.json": "eac7b9c2d2470ef140f41cf7c94e32657e2949a40f621a07340f7d2342ee7dc1",
     "fixtures/format3_signed_cms.plaintext": "31c35eeeee856277b605fe44203a8f4786bb8f591eda3b6ee58252df5b3cf2f0",
     "fixtures/format3_single.dkc": "9f68664af8733255084be9036a100b75d27bd16106bf0acff94ce469dd1d1743",
     "fixtures/format3_single.inspect.json": "7878da921c17aada50e00d5911ea97e8558633a1684fb96acbd00d6f1b117529",
-    "fixtures/format3_single.json": "45a497461b8128f0ec89cea43171b370cc5025592860c9f3fdd732a0000e7c0d",
+    "fixtures/format3_single.json": "0a31c6d416ec3e6acd891172881f4f5738c36e01c9583be48f0376324641d17b",
     "fixtures/format3_single.plaintext": "74f9dd84d07e95a31e6dc063bf65ce414197acf84aac445eabc76fa4e3f24936",
     "fixtures/format3_time_and_key_portable.dkc": "680d29962e575689a31543df28433dae7737abd9a793e9cae92ef40920d09636",
     "fixtures/format3_time_and_key_portable.dkk": "54cc64d849395234b3e093e47f432b72781ccc13f455c9ef394e3554ab566751",
-    "fixtures/format3_time_and_key_portable.dkk.json": "388e05ce647fc9399fc5ce4fcb5478320ec340013135b0fc7eb8c5b238015466",
+    "fixtures/format3_time_and_key_portable.dkk.json": "a3aff664132ec3d6da8f016c44978733ad8b9e500dec08d5c08a1a1c39a09071",
     "fixtures/format3_time_and_key_portable.inspect.json": "f269af86f5bf84c22a1038fd78db146af93166150755eb1ca35cf15e224035b4",
-    "fixtures/format3_time_and_key_portable.json": "6b2831efeec32d2a92301acfa20e74446bcdc7f446d0b9cde1d5d87fd5c6d4b5",
+    "fixtures/format3_time_and_key_portable.json": "0a545aab8299c5af039b57092276cf5db62e73ef74e6e1046834f6886a34bbf0",
     "fixtures/format3_time_and_key_portable.plaintext": "e6684cf607c102bfa4d6977742d5a7520b0e09483282181bd6d8f5f4ba5f7726",
     "fixtures/format3_tree.dkc": "217f378faaf795f6a9c416b564fb8931bb2e896918aee870120fd14f9a5da7d1",
     "fixtures/format3_tree.inspect.json": "643a9dfdc2d0c44b8a1636909c66ed81bfd8c50df2a4cad6566832a8e47ba938",
-    "fixtures/format3_tree.json": "93a0880b55fedff0e66167c71b89ee7ae595b033fbcab7484233025e5ac42eaa",
+    "fixtures/format3_tree.json": "1d2ed3e28c5075ead9898757b971298273c4b20acee27911286dc250aa7d0143",
     "fixtures/format3_tree.plaintext": "f69ac5f450966f7d0e9161aa37451d4260b194a750e3e132c02e8a15ba561cfa",
     "fixtures/format3_unsigned.dkc": "317ab722ae3812a25ddd78b4c98c586363e5587c8d3634c881ce7c421af19168",
     "fixtures/format3_unsigned.inspect.json": "2f52f7286d6bd4c846ddd63b10b4989b25d17501a989a2e9deb25e4db0859e1a",
-    "fixtures/format3_unsigned.json": "6098828d2be7d2f5db4b7535895274136f4ad404dddaf8fe70cd855934412da4",
+    "fixtures/format3_unsigned.json": "bce5d7fcf60ddb553e2bbe5b501892ae7a13488b4095fdad598dc3207690dfb3",
     "fixtures/format3_unsigned.plaintext": "25527e5e2e1ce02056d4419fb89f7b0ce35e4920f93217f58dcf62a4377f8af5",
     "fixtures/time_and_key_portable.dkc": "2e97878078bae6358037a9c264f379a3cbe839f767d69836b0343f35657b2972",
     "fixtures/time_and_key_portable.dkk": "e528fa2c832c91119f0684bb9d6fb3c4c2d0d55183482890e7c4fe92f668426a",
-    "fixtures/time_and_key_portable.dkk.json": "fd98c997a7684e9a350c489bf6d0ff9e24e38ab8c1665cc203fa31a29fb47e6a",
+    "fixtures/time_and_key_portable.dkk.json": "4535028d6559cd368a44a6f03ebf8bcbcc2bdac4fcf13374aae541618b81c99f",
     "fixtures/time_and_key_portable.inspect.json": "238c1f8ca6a6bf69f20bf26f5676e89a0b07e83b4362628560fc2f7522a202c9",
-    "fixtures/time_and_key_portable.json": "45a91d8ad99a5e1265de29af4130d0c1a7c3a0a7e6caeda7f758e6372c7e4c0f",
+    "fixtures/time_and_key_portable.json": "389f36834ffb86a4c60950872a540caf8a8a94f65d02f56ce5f7922e06bf933c",
     "fixtures/time_and_key_portable.plaintext": "937492203d207d6fe36161b8696bf1f05b8b4cc56d855c44853f4b76aad3a05b",
     "fixtures/time_and_key_portable_extension.dkk": "0bf463a7c65627b7dda2234d728df89ec5b835816a2a37b91497d8fecc5ea548",
-    "fixtures/time_and_key_portable_extension.dkk.json": "5ca66340a242c4165f1febb0400dc52f0f47011e7befa8fa6c3b2c144bb6d3c0",
+    "fixtures/time_and_key_portable_extension.dkk.json": "e6f4015f10403926a8e2d3399f78ba99a48ce6c4760e24174c1521046c23efb2",
     "fixtures/time_and_key_recipients.dkc": "69ac110380f5d768b5b6afaa157a50ed17d8ceccfbd4604ffa5b6da38539b635",
     "fixtures/time_and_key_recipients.dkk": "19f6c47150c3194712d454f43c7392b7344e6b4e7b074d83e9ca5f563a8e072f",
-    "fixtures/time_and_key_recipients.dkk.json": "c9e1a2f63b8e2218026e5a2591f7acf8b42c3803f837c38ce6dc878d3450d40a",
+    "fixtures/time_and_key_recipients.dkk.json": "f206ed1a51fc6aac7b2faabd2e3519224f68f7b9b9643653dbdf5b6139f042e0",
     "fixtures/time_and_key_recipients.inspect.json": "4b32c63d18febe0772837fbcd75a0c971e31378bf799201b720a9d32bdcd8c2b",
-    "fixtures/time_and_key_recipients.json": "db62a8647a1bfe098b05a7fe9f723f40da399d696c2bcd4a65547f7458670350",
+    "fixtures/time_and_key_recipients.json": "2cdbc03ef027879b36c68de56e205960e774858a3ff170aba66d630de27c7303",
     "fixtures/time_and_key_recipients.plaintext": "0e9fd50e98a85953aa9cf07a11ee3c62bb3d7622f344f1c6ce744d1ed111659f",
     "fixtures/time_only.dkc": "99e915810d595f1092700b728f5e5081d78efe83f5343e76325b1bcc2c33ccf2",
     "fixtures/time_only.inspect.json": "a4d45f945d6ba6616c01e120ac1133785e5279fea7dcab706b5feee287be8884",
-    "fixtures/time_only.json": "c7920af7a8afd5873e95363d1b2411715355263dcb6f87c11d3b4102f200fc1b",
+    "fixtures/time_only.json": "9e66fedbfcf6ffec45648d8afdb7592eecd645751703051d1f60af1d0b7f9f01",
     "fixtures/time_only.plaintext": "53b8ee821fb7b678e89d4f93da1812339f6cc1ab83aac6ed1432db99df784be5",
     "fixtures/time_only_extensions.dkc": "0446c9b73e267adcb24e5cc89afba2544a386ec9a050016e06517a4a57aa2085",
     "fixtures/time_only_extensions.inspect.json": "6f957b028da8a4a495b5e951ced0b91e0678128dac4e962b02d024b9439a0ba1",
-    "fixtures/time_only_extensions.json": "29eea35b3a3e157c6af442358058d71e5e947ad1cc7bd29b72a86c3c4d2f677b",
+    "fixtures/time_only_extensions.json": "4bb636805cc681ba1c74aa426f5afda72580f4350929a720da49eeccee3eb2be",
     "fixtures/time_only_extensions.plaintext": "1129768e195e2f1e50b7a6f926b6eebef120212c29b5642c8a662c503b2a9131",
-    "vectors/cbor.json": "b209674a9967657f9ea33ca0cc9d63e185c0007f192bfc6af182d7e97923d646",
-    "vectors/dk1.json": "d403ff60a5e1ecb9d21950ff4111e496462b367a08b536e3167952e245acb478",
-    "vectors/ed25519_strict.json": "daa4022006b0d8c1b6728c74b1abdc5c700979d5e9b5ea7e3966dae45c81c687",
-    "vectors/head_schema.json": "995a81cf9497a13fae8e22d04f405d4bc7daf5c48023085677ecd0cd8984adcb",
-    "vectors/inspect_differential.json": "97d9f0f47fb30d16373c52242e5ffa364256ff728177e5dce2fa9d532ba116d7",
-    "vectors/locator.json": "38f72731dd74db59253950c820316eed19281b9c63a23817d501dea3fbbd6ba9",
-    "vectors/mutations.json": "76d8d572ce5743ff56242d45d507124a1309d5871a701095c0e2cbcadd3bdfee",
-    "vectors/note.json": "a0e44b493d5d7c7548d727b79122dad0151c1598b0db6a358844e8b193635223",
-    "vectors/padding.json": "3555875043cc2961af43fbdb0b26eb198ce7822547d6d909b8e327511c732ed5",
-    "vectors/path_fold.json": "bd5db6c03d4ed4920c5da084ec0b8cfc584f6ace387b123c589c17449cb43896",
-    "vectors/paths.json": "50bdc57d6650143478e5f58421a6adf7511deacc35e3fc1d49d6b0f37d792fb9",
-    "vectors/profile_quicknet.json": "623d920e712e0b4eafdf85d4e3d363d81c33427c484964c4e12e5f695982b28f",
-    "vectors/quicknet_rounds.json": "beb38f35cda20be4b5dc17efeccd3ec82d676624a2b1f4030d2a317b618ce038",
-    "vectors/resolved_ip.json": "01c676cbdb815a3b0b0a2416f392a4b855f238f9378f3bf7efeae4a25ce50cdb",
-    "vectors/security.json": "7eb7dbce804c62ca8cc3f080ea192b2a7b717b5d4716d2d061dd06855d0818e6",
-    "vectors/security_cms.json": "139d9bf130f3932aa73cfe68f8d7ce7f728b2467b857732ff5404dd4b4e242d4",
-    "vectors/tlock_ibe.json": "37c07ec4f1806dfdbbcc5fe2b1c53a92695c6ba8702a6e9c1e7010d58ae936d9",
-    "vectors/tlock_steps.json": "d43ee8b71661803d21988266bf3fe00f3a36b41c74ebc1675b383f1323a87af1",
-    "vectors/wordkey.json": "c5241f306de01b1ae3437b8dfec7b2b117d1f305ebecae71c36d0957ff987e53"
+    "releases/1000.dkr": "5d2e86210d2e8d64ce36e55edf3ff6c8997fda4bc06fec7fd5feb0dd6cab8293",
+    "releases/1001.dkr": "2b55dcc09dfe8fa97192aa6d9a85f9fc50206142d52f66329261cfe9e03de755",
+    "releases/1004.dkr": "aabdffe0fb944d8796528a6682fdbafb448b1e5da164ee039b6c3ee7f354e766",
+    "releases/2000.dkr": "9e37be0004850faaa8541658a90ee8aba0832fccf2b695df42c89cb3f7de29ff",
+    "releases/archive_1000_1004.bin": "bb53d542abd704f3af9f6436c9178f65bf812a06630607b3aad3a09eaed0cce1",
+    "vectors/cbor.json": "715c8e7ca88d17c4e68a8764350217f108e96484e59282d384a032169d36bfb8",
+    "vectors/dk1.json": "e2b849b1f606e7961a8571c305dcd0c4374f03c8943a3a715b20a9a43002ea44",
+    "vectors/ed25519_strict.json": "eb47ac6b5e879ca3e115f6551b81e5b6fe5bf5050aa7b829804e915705c3a1ad",
+    "vectors/head_schema.json": "29493360d4cf97c3ad488a8ce58221804b17511523756cea1efb87e6fbc13444",
+    "vectors/inspect_differential.json": "bdc5210415084cde71aa84fbaa7ebbcd81e0f1800b411c6dbacc5e553b4021dd",
+    "vectors/locator.json": "02476c2f5e421bfc35e2f7b2498ab1d395fd7ef5971fb46dd16fe0abfb6f7a11",
+    "vectors/mutations.json": "e3ce6a57a57e49bfdb726fb8e9e6e36711c65a23b08e751aab00f8c4dbfcade3",
+    "vectors/note.json": "f02feea92b22c98227c21e725b3d3e8b303ec647c4cab3fd9b4b71261273818e",
+    "vectors/padding.json": "7cd6ac71fd978e21c5f93870a211035f98028b9020422f727e407c477e4514bb",
+    "vectors/path_fold.json": "75e4fa473da4b394d32ac107a5e9559b0d3358ce1b39e5d7403366aa35c2efff",
+    "vectors/paths.json": "a33ecdbd6a191d693600e18879e15a5813d77b133d46f30c5535aae72eeaeb04",
+    "vectors/profile_quicknet.json": "e291d5167cdce9b9e24993571a7f349e35fbbcfea793665883ec9ec8d479b498",
+    "vectors/quicknet_rounds.json": "bf990896dddc51a91e309143fede773adeae918ef47433e0ab6132a4456ce9a8",
+    "vectors/release.json": "4e9d4902c041d70361bcf6e0f069b963fa91c22e494f3239ffeda2c2688da5b5",
+    "vectors/resolved_ip.json": "7c554e7c3f272a62a89c3f3e97203dc7d5dc50290bbe356f4a8efd44a19eea70",
+    "vectors/security.json": "6045492767cbeb02fce5b6faf6cd0e179ffe96c898c8c023793e4a138b0277f0",
+    "vectors/security_cms.json": "4915fa3cfe93b1ad92e91a68bba7517c3b2dc3e33fd9def7340b3a045eff99cf",
+    "vectors/tlock_ibe.json": "5c1def934c89c1638187058e9dcb76ac9fffd148885a9869a1dc7b19d2df76b6",
+    "vectors/tlock_steps.json": "661c5214c30ea3ea08e7f54f779346b6e838e68a0732ea2110ddcbf07a25cd35",
+    "vectors/wordkey.json": "1ef9f07d84e7d99d68433a89371c79a407c4e10f33547210bfdf1d7378956d6b"
   }
 }

testdata/fixtures/empty_payload.json

@@ -1,6 +1,6 @@
 {
   "description": "time_only capsule with an empty payload",
-  "spec": "0.14",
+  "spec": "0.15",
   "format": 1,
   "file": "empty_payload.dkc",
   "sha256": "871e9bf05b52bbae17f3adfbbf97b46e7f0e53aa8f57bcaa506e43f36f53a9d4",

testdata/fixtures/format2_empty_payload.json

@@ -1,6 +1,6 @@
 {
   "description": "format 2 time_only capsule with an empty content: L = 0, P = 256",
-  "spec": "0.14",
+  "spec": "0.15",
   "format": 2,
   "file": "format2_empty_payload.dkc",
   "sha256": "7aea2b5aa48b1a46053716f733d50fab9cd0b80b1be67631bcc06c5bb765dc21",

testdata/fixtures/format2_time_and_key_portable.dkk.json

@@ -1,6 +1,6 @@
 {
   "description": "portable X25519 .dkk of format2_time_and_key_portable.dkc",
-  "spec": "0.14",
+  "spec": "0.15",
   "file": "format2_time_and_key_portable.dkk",
   "sha256": "095b7bc516a22bf0c2366f0af3cd48bfe857a2354d6e2a9b285278b95e450fe0",
   "credential_id": "e3c7be83cbf1fbd6b115c96411b3bd01",

testdata/fixtures/format2_time_and_key_portable.json

@@ -1,6 +1,6 @@
 {
   "description": "format 2 time_and_key capsule with one credential, a portable .dkk, and 15 dummies",
-  "spec": "0.14",
+  "spec": "0.15",
   "format": 2,
   "file": "format2_time_and_key_portable.dkc",
   "sha256": "600892659fe4890223e895876275f656995d170fda42b07fb2bec0ca51ce4b43",

testdata/fixtures/format2_time_and_key_recipients.dkk.json

@@ -1,6 +1,6 @@
 {
   "description": "portable X25519 .dkk of format2_time_and_key_recipients.dkc",
-  "spec": "0.14",
+  "spec": "0.15",
   "file": "format2_time_and_key_recipients.dkk",
   "sha256": "2ad99b1556086ec311d7f0b3bd3aaba05e75f45c4fa22490b0d5e8bb0b1a222e",
   "credential_id": "93cedf68421710e83908ec683b104436",

testdata/fixtures/format2_time_and_key_recipients.json

@@ -1,6 +1,6 @@
 {
   "description": "format 2 time_and_key capsule for three known X25519 recipients and a portable .dkk, and 12 dummies",
-  "spec": "0.14",
+  "spec": "0.15",
   "format": 2,
   "file": "format2_time_and_key_recipients.dkc",
   "sha256": "1a44fd8708c92e2e0a10cfcb1d864a71331ea9af25d97e1a42e969dc898959e3",

testdata/fixtures/format2_time_and_key_sixteen.json

@@ -1,6 +1,6 @@
 {
   "description": "format 2 time_and_key capsule for sixteen known X25519 recipients, without dummies",
-  "spec": "0.14",
+  "spec": "0.15",
   "format": 2,
   "file": "format2_time_and_key_sixteen.dkc",
   "sha256": "7aaac5c18f216bf53df326ecc817179640a53408cf25dfd50488910a762dc381",

testdata/fixtures/format2_time_only.json

@@ -1,6 +1,6 @@
 {
   "description": "format 2 time_only capsule, padding code 2 (reforzado): L = 78000, P = 79872, two STREAM chunks",
-  "spec": "0.14",
+  "spec": "0.15",
   "format": 2,
   "file": "format2_time_only.dkc",
   "sha256": "f5a40ac6b8a08a0c12db6114c2bca23522d6a77b512b509a217fb15f367813c4",

testdata/fixtures/format2_time_only_bloque256.json

@@ -1,6 +1,6 @@
 {
   "description": "format 2 time_only capsule with the content of format2_time_only and padding code 1 (bloque256): L = 78000, P = 78080",
-  "spec": "0.14",
+  "spec": "0.15",
   "format": 2,
   "file": "format2_time_only_bloque256.dkc",
   "sha256": "aae769c30d04920801d8b293d30864fbe223c9c9353ec2b4907a1ee1996e39f9",

testdata/fixtures/format2_time_only_extensions.json

@@ -1,6 +1,6 @@
 {
   "description": "format 2 time_only capsule with a noncritical PUBLIC_HEADER extension and a noncritical CONTROL_CBOR extension",
-  "spec": "0.14",
+  "spec": "0.15",
   "format": 2,
   "file": "format2_time_only_extensions.dkc",
   "sha256": "fb406100d5703a2e888983b3175ed34a09a34469cc722256e5cf535dd728fbe9",

testdata/fixtures/format3_area_1024.json

@@ -1,6 +1,6 @@
 {
   "description": "format 3 time_only capsule with a security area of 1024 bytes, as a later version may write it, holding the empty security",
-  "spec": "0.14",
+  "spec": "0.15",
   "format": 3,
   "file": "format3_area_1024.dkc",
   "sha256": "41ea2eed0293e4fef7f4a307b7f16aaf1339f5bf6f4ded7a6a9ae1aebeb0133c",

testdata/fixtures/format3_bloque256.json

@@ -1,6 +1,6 @@
 {
   "description": "format 3 time_only capsule with padding code 1 (bloque256) and one file of 20000 bytes",
-  "spec": "0.14",
+  "spec": "0.15",
   "format": 3,
   "file": "format3_bloque256.dkc",
   "sha256": "ff18444f434164ba8e7b26d38c76c7855dc6b0593b2fc8b4e9a95dbf9252d55d",

testdata/fixtures/format3_comment_only.json

@@ -1,6 +1,6 @@
 {
   "description": "format 3 time_only capsule with a comment of two lines, the second one with a TAB, a declared author and no files",
-  "spec": "0.14",
+  "spec": "0.15",
   "format": 3,
   "file": "format3_comment_only.dkc",
   "sha256": "7f98a89413f08655bbbab28b96585dfa6173c1705dd81a900deba2100d19f2ef",

testdata/fixtures/format3_note.json

@@ -1,6 +1,6 @@
 {
   "description": "format 3 time_only capsule with a single file, nota.txt, and the public note «Cartas del viaje a Lisboa» in the noncritical array of PUBLIC_HEADER (spec v0.11, §24.1)",
-  "spec": "0.14",
+  "spec": "0.15",
   "format": 3,
   "file": "format3_note.dkc",
   "sha256": "da1bee54231252a0fd98439e24588125c5521f6e5a2c6641b499e6b22192c0eb",

testdata/fixtures/format3_seal_unsupported.json

@@ -1,6 +1,6 @@
 {
   "description": "format 3 time_only capsule with an author-signature of alg 4294967295, as in format3_signature_unsupported, and a seal of seal_type 4294967295, reserved for tests, with a random token of 32 bytes: verdicts F1 and S1",
-  "spec": "0.14",
+  "spec": "0.15",
   "format": 3,
   "file": "format3_seal_unsupported.dkc",
   "sha256": "ae3219fbdbd1de4cef6fade1a3fb3f6e5d5e2e8af54d9516b05f0a48136913ad",

testdata/fixtures/format3_sealed.json

@@ -1,6 +1,6 @@
 {
   "description": "format 3 time_only capsule with a single file, nota.txt, signed with alg 1 by the test key of format3_signed and sealed with seal_type 2 by a test time-stamping authority before the round time: verdicts F4 and S4, with SEAL_SUBJECT and the token in the record",
-  "spec": "0.14",
+  "spec": "0.15",
   "format": 3,
   "file": "format3_sealed.dkc",
   "sha256": "dde5a072d8783227d28279d06d3d226a1fb967c766da626f889d1c6fd76ac9c7",

testdata/fixtures/format3_security_v2.json

@@ -1,6 +1,6 @@
 {
   "description": "format 3 time_only capsule whose security is of version 2: verdict X",
-  "spec": "0.14",
+  "spec": "0.15",
   "format": 3,
   "file": "format3_security_v2.dkc",
   "sha256": "3d02b39ace010d74604554e378d22fe5ce00cecd998c0f797d657b17620b8912",

testdata/fixtures/format3_signature_unsupported.json

@@ -1,6 +1,6 @@
 {
   "description": "format 3 time_only capsule with an author-signature of alg 4294967295, a random key of 32 bytes and a random signature of 64: verdicts F1 and S0",
-  "spec": "0.14",
+  "spec": "0.15",
   "format": 3,
   "file": "format3_signature_unsupported.dkc",
   "sha256": "e8e3106d8d73bb7b845062e0fe42af21df7d7cd8f63c335cab8dedb3e690df31",

testdata/fixtures/format3_signed.json

@@ -1,6 +1,6 @@
 {
   "description": "format 3 time_only capsule with a single file, nota.txt, signed with alg 1 by a test key whose seed the record gives: verdict F4, and the commitments and the message of the signature",
-  "spec": "0.14",
+  "spec": "0.15",
   "format": 3,
   "file": "format3_signed.dkc",
   "sha256": "3c7d3c9e24c02853a0c7761b93bea1120b27fce396468d8d0f68e53aeb668c5e",

testdata/fixtures/format3_signed_cms.json

@@ -1,6 +1,6 @@
 {
   "description": "format 3 time_only capsule with a single file, nota.txt, signed with alg 2 by two test certificates, an ECDSA P-256 one and an RSA 2048 one, each sealed by a test time-stamping authority before the round time: verdict F6, with the certificates, the commitments, SIGNERS and the result of each signer in the record",
-  "spec": "0.14",
+  "spec": "0.15",
   "format": 3,
   "file": "format3_signed_cms.dkc",
   "sha256": "d658f8d5ac2c5550c07b8f8fd6883b2f6dc02ceafc47d436ea02d8950b2548d2",

testdata/fixtures/format3_single.json

@@ -1,6 +1,6 @@
 {
   "description": "format 3 time_only capsule with a single file, nota.txt, with its mtime",
-  "spec": "0.14",
+  "spec": "0.15",
   "format": 3,
   "file": "format3_single.dkc",
   "sha256": "9f68664af8733255084be9036a100b75d27bd16106bf0acff94ce469dd1d1743",

testdata/fixtures/format3_time_and_key_portable.dkk.json

@@ -1,6 +1,6 @@
 {
   "description": "portable X25519 .dkk of format3_time_and_key_portable.dkc",
-  "spec": "0.14",
+  "spec": "0.15",
   "file": "format3_time_and_key_portable.dkk",
   "sha256": "54cc64d849395234b3e093e47f432b72781ccc13f455c9ef394e3554ab566751",
   "credential_id": "bdb483fba42daf0b409f44d23033f362",

testdata/fixtures/format3_time_and_key_portable.json

@@ -1,6 +1,6 @@
 {
   "description": "format 3 time_and_key capsule with one credential, a portable .dkk, and 15 dummies",
-  "spec": "0.14",
+  "spec": "0.15",
   "format": 3,
   "file": "format3_time_and_key_portable.dkc",
   "sha256": "680d29962e575689a31543df28433dae7737abd9a793e9cae92ef40920d09636",

testdata/fixtures/format3_tree.json

@@ -1,6 +1,6 @@
 {
   "description": "format 3 time_only capsule with five files in three folders, one of them over two STREAM chunks and one without mtime, a comment of two lines and a declared author",
-  "spec": "0.14",
+  "spec": "0.15",
   "format": 3,
   "file": "format3_tree.dkc",
   "sha256": "217f378faaf795f6a9c416b564fb8931bb2e896918aee870120fd14f9a5da7d1",

testdata/fixtures/format3_unsigned.json

@@ -1,6 +1,6 @@
 {
   "description": "format 3 time_only capsule with a single file, nota.txt, as format3_signed, without a signature: the area of 32 KiB of spec v0.11 holds the empty security, and P is the one of format3_signed",
-  "spec": "0.14",
+  "spec": "0.15",
   "format": 3,
   "file": "format3_unsigned.dkc",
   "sha256": "317ab722ae3812a25ddd78b4c98c586363e5587c8d3634c881ce7c421af19168",

testdata/fixtures/time_and_key_portable.dkk.json

@@ -1,6 +1,6 @@
 {
   "description": "portable X25519 .dkk of time_and_key_portable.dkc",
-  "spec": "0.14",
+  "spec": "0.15",
   "file": "time_and_key_portable.dkk",
   "sha256": "e528fa2c832c91119f0684bb9d6fb3c4c2d0d55183482890e7c4fe92f668426a",
   "credential_id": "3955e944a3c60cfa1fd6485e9693c77d",

testdata/fixtures/time_and_key_portable.json

@@ -1,6 +1,6 @@
 {
   "description": "time_and_key capsule whose only recipient is a portable .dkk",
-  "spec": "0.14",
+  "spec": "0.15",
   "format": 1,
   "file": "time_and_key_portable.dkc",
   "sha256": "2e97878078bae6358037a9c264f379a3cbe839f767d69836b0343f35657b2972",

testdata/fixtures/time_and_key_portable_extension.dkk.json

@@ -1,6 +1,6 @@
 {
   "description": "portable X25519 .dkk of time_and_key_portable.dkc with a noncritical extension: the credential of time_and_key_portable.dkk re-issued with org.example.delivery",
-  "spec": "0.14",
+  "spec": "0.15",
   "file": "time_and_key_portable_extension.dkk",
   "sha256": "0bf463a7c65627b7dda2234d728df89ec5b835816a2a37b91497d8fecc5ea548",
   "credential_id": "3955e944a3c60cfa1fd6485e9693c77d",

testdata/fixtures/time_and_key_recipients.dkk.json

@@ -1,6 +1,6 @@
 {
   "description": "portable X25519 .dkk of time_and_key_recipients.dkc",
-  "spec": "0.14",
+  "spec": "0.15",
   "file": "time_and_key_recipients.dkk",
   "sha256": "19f6c47150c3194712d454f43c7392b7344e6b4e7b074d83e9ca5f563a8e072f",
   "credential_id": "b89292aedf6d05d584cec9a871ce8735",

testdata/fixtures/time_and_key_recipients.json

@@ -1,6 +1,6 @@
 {
   "description": "time_and_key capsule for two known X25519 recipients and a portable .dkk",
-  "spec": "0.14",
+  "spec": "0.15",
   "format": 1,
   "file": "time_and_key_recipients.dkc",
   "sha256": "69ac110380f5d768b5b6afaa157a50ed17d8ceccfbd4604ffa5b6da38539b635",

testdata/fixtures/time_only.json

@@ -1,6 +1,6 @@
 {
   "description": "time_only capsule, two STREAM chunks, no extensions",
-  "spec": "0.14",
+  "spec": "0.15",
   "format": 1,
   "file": "time_only.dkc",
   "sha256": "99e915810d595f1092700b728f5e5081d78efe83f5343e76325b1bcc2c33ccf2",

testdata/fixtures/time_only_extensions.json

@@ -1,6 +1,6 @@
 {
   "description": "time_only capsule with a noncritical PUBLIC_HEADER extension and a noncritical CONTROL_CBOR extension",
-  "spec": "0.14",
+  "spec": "0.15",
   "format": 1,
   "file": "time_only_extensions.dkc",
   "sha256": "0446c9b73e267adcb24e5cc89afba2544a386ec9a050016e06517a4a57aa2085",

testdata/vectors/cbor.json

@@ -1,5 +1,5 @@
 {
-  "spec": "0.14",
+  "spec": "0.15",
   "description": "CBOR profile of spec §58 and the schemas of spec/datekeys.cddl, generated by the reference implementation. accept and reject are walked as one data item of the profile with the limits of walk; schemas are decoded with the decoder of their schema. See testdata/README.md.",
   "walk": {
     "max_depth": 3,

testdata/vectors/dk1.json

@@ -1,5 +1,5 @@
 {
-  "spec": "0.14",
+  "spec": "0.15",
   "description": "Canonical dk1_ strings and rejected encodings (spec §18, §19, §66), generated by the reference implementation.",
   "vectors": [
     {

testdata/vectors/ed25519_strict.json

@@ -1,5 +1,5 @@
 {
-  "spec": "0.14",
+  "spec": "0.15",
   "description": "Ed25519 signatures and the result of the strict profile of the author signature (spec v0.11, §29.9), after the cases of «Taming the many EdDSAs»; stdlib is the result of crypto/ed25519 of Go, for the record. Generated by the reference implementation. See testdata/README.md.",
   "vectors": [
     {

testdata/vectors/head_schema.json

@@ -1,5 +1,5 @@
 {
-  "spec": "0.14",
+  "spec": "0.15",
   "description": "HEAD_CBOR of format 3 (spec §29.4 to §29.6) and the result of decoding it with no extension known, generated by the reference implementation: layer 2 (type tag and version), layer 3 (the CDDL with R1 and R8), then layer 4 in key order (spec §69.1). See testdata/README.md.",
   "heads": [
     {

testdata/vectors/inspect_differential.json

@@ -1,5 +1,5 @@
 {
-  "spec": "0.14",
+  "spec": "0.15",
   "description": "Differential corpus of the pre-unlock checks (spec §63 steps 1 to 8): deterministic mutations of the official .dkc fixtures with the verdict of the reference implementation. See testdata/README.md.",
   "format": "Each mutation is bases[base].file (in testdata/fixtures) with its edits applied. An edit is [at, delete, insert]: the delete bytes at offset at of the base are replaced by the bytes of the hex string insert. The edits of one mutation refer to offsets of the unmodified base, are sorted by offset and do not overlap. result is the verdict of steps 1 to 8 of spec §63 (capsule.Inspect, the Quicknet profile pinned, no extension known, no network, no secret): ok, or the normative error code, with step the step that failed. kind names the generator of the mutation and is informative.",
   "seed": 20260925,

testdata/vectors/locator.json

@@ -1,6 +1,6 @@
 {
   "description": "The extension datekeys.capsule of a .dkk and what it points to (spec v0.12, 44.1): an envelope of age with its header apart from its rest, the rest hidden in a host file, the locator sealed with tlock for round 1000, and the data of the extension. On the same envelope, what a reader rejects and what it uses (64): addresses, a locator with rejected and usable addresses, resources of the rest, data of the extension and plaintexts of the locator. Frozen. See testdata/README.md.",
-  "spec": "0.14",
+  "spec": "0.15",
   "round": 1000,
   "datekey": "dk1_eyJ2ZXJzaW9uIjoxLCJuZXR3b3JrIjoiZGF0ZWtleXM6cXVpY2tuZXQ6djEiLCJyb3VuZCI6MTAwMH0",
   "note": "Cartas del viaje a Lisboa",

testdata/vectors/note.json

@@ -1,5 +1,5 @@
 {
-  "spec": "0.14",
+  "spec": "0.15",
   "description": "The data of the public note, datekeys.note version 1 in the noncritical array of PUBLIC_HEADER (spec §24.1): the text in UTF-8, from 1 to 1024 bytes, that meets the rules of the declared author of §29.6. See testdata/README.md.",
   "notes": [
     {

testdata/vectors/padding.json

@@ -1,5 +1,5 @@
 {
-  "spec": "0.14",
+  "spec": "0.15",
   "description": "Padding rules of the payload of a format 2 capsule (spec §29.1): for each content length L, P with code 1 (bloque256) and code 2 (reforzado), and the length of PAYLOAD_AGE for each. e, s and last_bits are informative. Generated by the reference implementation. See testdata/README.md.",
   "l_max": 8936830510563328,
   "vectors": [

testdata/vectors/path_fold.json

@@ -1,5 +1,5 @@
 {
-  "spec": "0.14",
+  "spec": "0.15",
   "description": "The key of R7 (spec §29.5) of segments, with the Unicode 18.0.0 tables of §29.5.1, generated by the reference implementation: nfd is NFD(segment) and key is NFD(fold(NFD(s'))), s' the segment without ZWNJ, ZWJ, VS15 and VS16. See testdata/README.md.",
   "unicode_version": "18.0.0",
   "tables_digest": "07cf5d54aea1cd13a3ecef14a06976cc49a3cdad755cf9bc10395178b93aeb07",

testdata/vectors/paths.json

@@ -1,5 +1,5 @@
 {
-  "spec": "0.14",
+  "spec": "0.15",
   "description": "Paths of a format 3 head (spec §29.5) with the Unicode 18.0.0 and best-fit tables of §29.5.1, generated by the reference implementation. paths: one path and the rules of one entry, R2 to R6c and R10; trees: the paths of a head, of 0 bytes each, and the result of decoding it. See testdata/README.md.",
   "unicode_version": "18.0.0",
   "tables_digest": "07cf5d54aea1cd13a3ecef14a06976cc49a3cdad755cf9bc10395178b93aeb07",

testdata/vectors/profile_quicknet.json

@@ -1,5 +1,5 @@
 {
-  "spec": "0.14",
+  "spec": "0.15",
   "description": "Quicknet Provider Profile V1: exact Deterministic CBOR and profile_hash (spec §11, §12, §75 item 2), generated by the reference implementation.",
   "profile_id": "datekeys:quicknet:v1",
   "provider": "drand",

testdata/vectors/quicknet_rounds.json

@@ -1,5 +1,5 @@
 {
-  "spec": "0.14",
+  "spec": "0.15",
   "profile": "datekeys:quicknet:v1",
   "description": "Quicknet date to round resolution (spec §15, §16, §65), generated by the reference implementation.",
   "vectors": [

testdata/vectors/resolved_ip.json

@@ -1,5 +1,5 @@
 {
-  "spec": "0.14",
+  "spec": "0.15",
   "description": "The IP address that the name of an https address of a locator resolves to, and whether a reader may connect (spec v0.13, 44.1): a public address, or an address of NAT64 (RFC 6052) of 64:ff9b::/96 or of the NAT64 prefix of the network, whose IPv4 address inside is public. See testdata/README.md.",
   "cases": [
     {

testdata/vectors/security.json

@@ -1,5 +1,5 @@
 {
-  "spec": "0.14",
+  "spec": "0.15",
   "description": "SECURITY_CBOR of format 3, exactly its SECURITY_LEN bytes, the verdicts of the signature and of the seal in the context of the file, and their lines (spec §29.3, §29.7, §29.9). See testdata/README.md.",
   "context": {
     "control_commit": "0101010101010101010101010101010101010101010101010101010101010101",

testdata/vectors/security_cms.json

@@ -1,6 +1,6 @@
 {
   "description": "SECURITY_CBOR with an author signature of alg 2 or a time seal of seal_type 2, the context of its capsule, and the verdicts, the result of each signer and the lines of spec v0.12 29.7, 29.10 and 29.11. Certificates and tokens are made once with test keys and the file is frozen. See testdata/README.md.",
-  "spec": "0.14",
+  "spec": "0.15",
   "cases": [
     {
       "name": "alg 2: two signers, each sealed before the round time: F6",

testdata/vectors/tlock_ibe.json

@@ -1,5 +1,5 @@
 {
-  "spec": "0.14",
+  "spec": "0.15",
   "description": "H2 of the IBE-CCA of tlock (spec §63 step 11): SHA-256 of \"IBE-H2\" and the 576 bytes of an element of GT, c1 before c0 at every level of the tower and each coordinate of Fp in 48 bytes big-endian (the order of kilic/bls12-381), truncated to 16 bytes. Generated by the reference implementation with drand/kyber-bls12381, the pairing of tlock.",
   "vectors": [
     {

testdata/vectors/tlock_steps.json

@@ -1,5 +1,5 @@
 {
-  "spec": "0.14",
+  "spec": "0.15",
   "description": "Steps 10 and 11 of spec §63 for Quicknet, value by value, over published releases. Step 10: M = SHA-256(uint64_be(round)), H(M) the hash to G1 of RFC 9380 with the suite BLS12381G1_XMD:SHA-256_SSWU_RO_ and the DST dst, and e(H(M), public_key) = e(signature, G2). Step 11: a stanza body U || V || W built with the sigma and the file key of the vector; H2 = SHA-256(\"IBE-H2\" || e(signature, U))[:16], sigma = V XOR H2, H4 = SHA-256(\"IBE-H4\" || sigma)[:16], file_key = W XOR H4, and r = H3(sigma, file_key): h3_base = SHA-256(\"IBE-H3\" || sigma || file_key), then for i = 1, 2, ... d = SHA-256(uint16_le(i) || h3_base), its first byte shifted one bit to the right, until it is below the order of the group; r·G2 = U. Generated by the reference implementation and checked against drand, kyber, tlock and agewrap. See testdata/README.md.",
   "profile": "datekeys:quicknet:v1",
   "scheme": "bls-unchained-g1-rfc9380",

testdata/vectors/wordkey.json

@@ -1,5 +1,5 @@
 {
-  "spec": "0.14",
+  "spec": "0.15",
   "description": "The key of words (spec §38.1): the words of a text, after NFD, without U+0300 to U+036F, in simple lower case of Unicode 18.0.0 and split by the spaces of the list; what a writer refuses; and the identity, PBKDF2-HMAC-SHA256 of 600000 rounds, for a chain hash, a round and a capsule_id. See testdata/README.md.",
   "normalize": [
     {

tool/mutation_go_texts.go

@@ -7,13 +7,18 @@
 // tests of datekeys-dart require the same text of the opening, byte for
 // byte, and not only the same code and step. A port of
 // scripts/mutation-go-texts.go of datekeys-ts, over the synced testdata of
-// this repository, that of the branch v0.12 of datekeys-go at c531e93.
+// this repository, that of the branch v0.15 of datekeys-go at 3c3e737.
 //
 // Each case is replayed as internal/testkit replays the corpus
 // (MutationInput.Open), which a program outside the reference cannot
 // import: the Quicknet profile pinned, or no profile for the registry
 // "empty"; a release source that answers every request with the release of
-// the case, or with "testkit: no release" and ERR_RELEASE_UNAVAILABLE; the
+// the case, or with "testkit: no release" and ERR_RELEASE_UNAVAILABLE: for a
+// case whose source is "network", as OpenOptions.Source, which verifies the
+// release and discards it when it breaks a rule of step 10; for one whose
+// source is "supplied", as OpenOptions.Release, which hands over its release
+// object, with the Quicknet chain hash unless the case names another (spec
+// v0.15, §63 step 9.c); the
 // .dkk decoded before, as OpenOptions.AccessKey; the identities of the case;
 // the extensions of the case, known at (id, version) and whose data is valid
 // only when it is valid_data, with the texts of testkit.KnownExtensions; a
@@ -25,7 +30,7 @@
 //
 // Run it in the module of the reference implementation, which it imports,
 // without changing anything there, from the datekeys-go next to this
-// repository, on the branch v0.12 at c531e93:
+// repository, on the branch v0.15 at 3c3e737 (spec v0.15):
 //
 //	cd ../datekeys-go && go run ../datekeys-dart/tool/mutation_go_texts.go \
 //		../datekeys-dart/testdata > ../datekeys-dart/test/vectors/mutation_texts.json
@@ -65,7 +70,9 @@ type corpus struct {
 		Release    *struct {
 			Round     uint64 `json:"round"`
 			Signature string `json:"signature"`
+			ChainHash string `json:"chain_hash"`
 		} `json:"release"`
+		Source     string `json:"source"`
 		Now        string `json:"now"`
 		Registry   string `json:"registry"`
 		Extensions []struct {
@@ -126,16 +133,33 @@ func (k known) ValidateData(e extension.Extension) error {
 	return nil
 }
 
-// source is testkit's singleSource.
+// source is testkit's singleSource: as a network source, Fetch verifies the
+// release and discards it when it breaks a rule of step 10; as a release in
+// hand, Supply hands over its release object, with the chain of the pinned
+// profile unless the release names another.
 type source struct{ release *provider.Release }
 
-func (s source) Fetch(context.Context, *profile.Profile, provider.Condition) (provider.Release, error) {
+func (s source) Fetch(_ context.Context, p *profile.Profile, c provider.Condition) (provider.Release, error) {
 	if s.release == nil {
 		return provider.Release{}, fmt.Errorf("testkit: no release: %w", datekeys.ErrReleaseUnavailable)
 	}
+	if err := provider.Verify(p, c, *s.release); err != nil {
+		return provider.Release{}, fmt.Errorf("testkit: the release is discarded: %v: %w", err, datekeys.ErrReleaseUnavailable)
+	}
 	return *s.release, nil
 }
 
+func (s source) Supply(p *profile.Profile, _ provider.Condition) ([]byte, error) {
+	if s.release == nil {
+		return nil, fmt.Errorf("testkit: no release: %w", datekeys.ErrReleaseUnavailable)
+	}
+	r := *s.release
+	if r.ChainHash == nil {
+		r.ChainHash = p.ChainHash[:]
+	}
+	return provider.EncodeRelease(r)
+}
+
 // discard is testkit's DiscardSink.
 type discard struct{}
 
@@ -201,9 +225,20 @@ func main() {
 		var src source
 		if m.Release != nil {
 			src.release = &provider.Release{Round: m.Release.Round, Signature: must(hex.DecodeString(m.Release.Signature))}
+			if m.Release.ChainHash != "" {
+				src.release.ChainHash = must(hex.DecodeString(m.Release.ChainHash))
+			}
 		}
 		now := must(time.Parse(time.RFC3339Nano, m.Now))
-		o := capsule.OpenOptions{Registry: reg, Source: src, Now: func() time.Time { return now }, Sink: discard{}}
+		o := capsule.OpenOptions{Registry: reg, Now: func() time.Time { return now }, Sink: discard{}}
+		switch m.Source {
+		case "supplied":
+			o.Release = src
+		case "network":
+			o.Source = src
+		default:
+			panic("unknown source " + m.Source)
+		}
 		if m.Extensions != nil {
 			var k known
 			for _, x := range m.Extensions {

tool/release_archive_go_texts.go

@@ -0,0 +1,94 @@
+//go:build ignore
+
+// Writes test/vectors/release_archive_texts.json: the text of the error of
+// provider.Archive of the Go reference (spec v0.15, §50, informative) for
+// lookups in the local release archive of testdata/ and in edited copies of
+// it, or "ok": a round it lacks or does not cover, an archive of another
+// chain or of another length, a header that is not one, of another version,
+// with 0 rounds, not in its shortest form or without a key. Every failure is
+// ERR_RELEASE_UNAVAILABLE; lib/src/release.dart gives the same texts.
+//
+// Run it in the module of the reference implementation, which it imports,
+// without changing anything there, from the datekeys-go next to this
+// repository, on the branch v0.15:
+//
+//	cd ../datekeys-go && go run ../datekeys-dart/tool/release_archive_go_texts.go \
+//		../datekeys-dart/testdata/releases/archive_1000_1004.bin \
+//		../datekeys-dart/testdata/releases/1000.dkr \
+//		> ../datekeys-dart/test/vectors/release_archive_texts.json
+package main
+
+import (
+	"bytes"
+	"encoding/hex"
+	"encoding/json"
+	"fmt"
+	"os"
+
+	"g.activething.com/go/DateKeys/profile"
+	"g.activething.com/go/DateKeys/provider"
+)
+
+func main() {
+	bin, _ := os.ReadFile(os.Args[1])
+	obj, _ := os.ReadFile(os.Args[2])
+	h, _ := provider.EncodeArchiveHeader(profile.Quicknet().ChainHash[:], 1000, 5)
+	if !bytes.Equal(h, bin[:len(h)]) {
+		panic("header")
+	}
+	hl := len(h)
+	edit := func(f func(b []byte) []byte) []byte { return f(bytes.Clone(bin)) }
+	withHeader := func(hdr []byte) []byte { return append(hdr, bin[hl:]...) }
+	type c struct {
+		Name  string `json:"name"`
+		Bytes string `json:"bytes"`
+		Round uint64 `json:"round"`
+		Text  string `json:"text"`
+	}
+	p := profile.Quicknet()
+	var out []c
+	add := func(name string, b []byte, round uint64) {
+		_, err := provider.NewArchive(bytes.NewReader(b), int64(len(b))).Supply(p, provider.Condition{Round: round})
+		t := "ok"
+		if err != nil {
+			t = err.Error()
+		}
+		out = append(out, c{name, hex.EncodeToString(b), round, t})
+	}
+	add("round 999", bin, 999)
+	add("round 1002", bin, 1002)
+	add("round 1005", bin, 1005)
+	add("another chain", edit(func(b []byte) []byte { b[bytes.Index(b, p.ChainHash[:])+31] ^= 1; return b }), 1000)
+	add("a byte missing", bin[:len(bin)-1], 1000)
+	add("a byte more", append(bytes.Clone(bin), 0), 1000)
+	add("empty", nil, 1000)
+	add("a release object", obj, 1000)
+	add("header version 2", edit(func(b []byte) []byte {
+		i := bytes.Index(b, []byte{0x01, 0x01, 0x02})
+		b[i+1] = 2
+		return b
+	}), 1000)
+	cnt0, _ := hex.DecodeString(hex.EncodeToString(h[:len(h)-1]) + "00")
+	add("count 0", withHeader(cnt0), 1000)
+	// The first round, 1000, in four bytes.
+	i := bytes.Index(h, []byte{0x03, 0x19, 0x03, 0xe8})
+	long := append(append(bytes.Clone(h[:i]), 0x03, 0x1a, 0, 0, 0x03, 0xe8), h[i+4:]...)
+	long[0] = h[0]
+	add("first round in four bytes", withHeader(long), 1000)
+	four := bytes.Clone(h[:i])
+	four[0] = 0xa4
+	add("four keys", withHeader(four), 1000)
+	add("only the header", bytes.Clone(h), 1000)
+	// A header of 6 rounds and a sixth entry of zeros.
+	h6, _ := provider.EncodeArchiveHeader(p.ChainHash[:], 1000, 6)
+	add("count 6 and 6 entries", append(append(h6, bin[hl:]...), make([]byte, 48)...), 1005)
+	j, err := json.MarshalIndent(map[string]any{
+		"generator": "tool/release_archive_go_texts.go",
+		"cases":     out,
+	}, "", " ")
+	if err != nil {
+		panic(err)
+	}
+	os.Stdout.Write(append(j, '\n'))
+	fmt.Fprintf(os.Stderr, "%d cases\n", len(out))
+}

tool/release_copy.dart

@@ -0,0 +1,56 @@
+// Writes test/vectors/release.g.dart: the text of
+// testdata/vectors/release.json, every file of testdata/releases/ in
+// hexadecimal, and the text of test/vectors/release_archive_texts.json, as
+// Dart constants for test/release_object_test.dart compiled to JavaScript,
+// where no file can be read. test/release_object_vm_test.dart checks that
+// the copy is the files byte for byte. Run it after every sync of testdata/.
+//
+//   dart run tool/release_copy.dart
+
+import 'dart:io';
+
+void main() {
+  final root = File(Platform.script.toFilePath()).parent.parent;
+  String text(String path) {
+    final s = File('${root.path}/$path').readAsStringSync();
+    if (s.contains("'''")) throw StateError('$path holds three quotes');
+    return s;
+  }
+
+  final files =
+      Directory('${root.path}/testdata/releases')
+          .listSync()
+          .whereType<File>()
+          .toList()
+        ..sort((a, b) => a.path.compareTo(b.path));
+  final out = StringBuffer()
+    ..write(
+      '// Generated by tool/release_copy.dart from\n'
+      '// testdata/vectors/release.json, testdata/releases/ and\n'
+      '// test/vectors/release_archive_texts.json, for the tests that also\n'
+      '// run compiled to JavaScript, where no file can be read. Do not edit.\n'
+      '\n'
+      '/// The text of testdata/vectors/release.json.\n'
+      "const releaseJson = r'''\n"
+      "${text('testdata/vectors/release.json')}''';\n"
+      '\n'
+      '/// The files of testdata/releases/, by name, in hexadecimal.\n'
+      'const releaseFiles = {\n',
+    );
+  for (final f in files) {
+    final name = f.uri.pathSegments.last;
+    final hex = [
+      for (final b in f.readAsBytesSync()) b.toRadixString(16).padLeft(2, '0'),
+    ].join();
+    out.write("  '$name': '$hex',\n");
+  }
+  out.write(
+    '};\n'
+    '\n'
+    '/// The text of test/vectors/release_archive_texts.json.\n'
+    "const releaseArchiveTextsJson = r'''\n"
+    "${text('test/vectors/release_archive_texts.json')}''';\n",
+  );
+  File('${root.path}/test/vectors/release.g.dart')
+      .writeAsStringSync(out.toString());
+}