Verify a Global Passport

Verification is layered. Do not collapse signature validity, protocol conformance and real-world truth into a single green check.

1. Parse/schema: identify the exact schema/profile versions and reject malformed required fields.
2. Canonicalization: reconstruct the canonical payload bytes required by the protocol.
3. Signature: verify the issuer/signing method and confirm it was active for the record.
4. Authority: verify that the signer had authority for this action/scope.
5. Rights: validate referenced rights, restrictions, expiry/revocation and delegation scope.
6. Evidence: verify evidence hashes/objects and distinguish evidence integrity from the truth of the claim.
7. Provenance: verify source/derivation links and historical continuity.
8. Profiles: resolve exact profile/mapping versions and apply fail-closed constraints.
9. Domain conformance: run package-specific fixtures/rules if applicable.

Result language

Prefer precise outcomes such as signature valid, protocol-conformant, right active, evidence hash matches, or profile conformance failed. Avoid saying “verified true” for external claims unless separate evidence supports that conclusion.

Historical versions

v3.4.1 passports remain historical evidence and may remain verifiable, but v3.4.1 is superseded and unsupported for current deployment. Do not silently reinterpret its signed records as though they were issued under v3.4.2.