Specification

OSAP v0.1 is an experimental draft, not a standard. It specifies signed attestations, discovery, verification, and user-selected trust-bundle interpretation. It does not determine whether content is true or appoint a global trust authority.

Start with the specification overview, then read the chapters in this order:

1. Overview — scope, status, roles, roadmap, and open issues.
2. Terminology — terms used throughout the specification.
3. Data Model — documents, fields, and verification results.
4. Envelope — structure, identifiers, canonicalization, and signing.
5. Claims — attestation and claim types.
6. Identity — issuer identity, metadata, keys, and compromise handling.
7. Discovery — local and network discovery mechanisms.
8. Verification — the verification algorithm and result semantics.
9. Trust Bundles — signed trust policies and evaluation.
10. Temporal Trust — historical and current trust status.
11. Transparency Logs — an optional chronology extension.
12. Privacy — offline operation and network privacy requirements.
13. Security Considerations — implementation requirements and guidance.
14. Threat Model — attacks, protocol behavior, and residual risks.
15. UI Labels — separate, named verification-result labels.
16. Conformance — conformance levels and test-vector requirements.

All chapters are normative except Transparency Logs and Threat Model, which are informative. Individual sections and notes marked informative or non-normative also do not define requirements.

JSON Schemas, structural examples, and signed test vectors accompany the specification. The overview identifies which proposed extensions remain outside v0.1.