Skip to content

Failure cases and limits

Verification has deliberately different outcomes for the required home layer and optional durability layers.

CLI failures

  • attest and status reject malformed or non-32-byte hashes. Network HTTP errors and JSON decoding errors are returned as command errors.
  • status fails for an unknown job. It does not treat an unknown hash as a successful empty response.
  • verify in text mode prints INVALID and exits non-zero when local threshold verification fails. With --output json, the command instead reports "valid": false and exits successfully, so scripts must inspect that JSON field rather than relying only on the exit status. A confirmed job without a signed object cannot be verified as a signed attestation.
  • verify-proof prints an invalid result and exits non-zero for an invalid home configuration or home threshold signature. Bundle parsing and required input failures also terminate the command.
  • log --verify returns an error when an STH, its signatures, or a consistency path fails. The gateway must have the requested published STH sizes.

Optional-layer results

An invalid or absent batch inclusion proof does not make a valid home threshold signature invalid; it prevents the Batched level. Missing or invalid peer configs make the corresponding cross-anchor unverified and can prevent Federated. External anchors do not affect cryptographic verification in verify_proof_bundle; the result only reports how many records are present.

The text VALID from verify-proof therefore means the required home layer passed. Read Batch, Cross-anchors, External anchors, and Level before claiming a batched or federated result.

Non-verdicts

A relative timestamp such as minutes ago is local display formatting, not a protocol check. A gateway-provided /v1/config is informational and lacks public keys. A fetched /v1/network config is a trust-on-first-use choice unless independently reviewed or pinned. External-anchor presence is not provider validation. In BLS mode, aggregate verification also depends on trusted membership registration with proof-of-possession; the current verifier does not check PoP, and distinct listed IDs alone do not prove distinct witness participation. No Witness result proves content authenticity, ownership, confidentiality, or globally agreed time.