{
  "identifier": "studiomeyer-ard-publisher",
  "version": "1",
  "publisher": "https://studiomeyer.io",
  "documentation": "https://studiomeyer.io/en/docs/developer/agents#resource-trust",
  "scope": "Publisher identity and integrity of each ARD resource descriptor. This is a StudioMeyer verification profile, not an ARD default scheme or an independent compliance attestation. Resource contents fetched from a descriptor URL are not covered by this signature.",
  "verificationMethods": {
    "https-origin": {
      "steps": [
        "Fetch the catalog directly from https://studiomeyer.io/.well-known/ard.json using authenticated HTTPS; do not follow a redirect to another origin.",
        "Require trustManifest.identity to equal https://studiomeyer.io and the identifier publisher segment to equal studiomeyer.io.",
        "An unsigned entry proves only publication at this HTTPS origin. Do not infer a signature or third-party attestation."
      ]
    },
    "detached-jws-es256-jcs": {
      "signatureField": "trustManifest.signature",
      "serialization": "RFC 7515 Appendix F detached compact JWS: BASE64URL(protected)..BASE64URL(signature)",
      "canonicalization": "RFC 8785 JCS over the complete entry, removing only trustManifest.signature. All other fields, including trustManifest.identity and trustSchema, remain signed.",
      "jwks": "https://studiomeyer.io/.well-known/jwks.json",
      "requiredProtectedHeader": {"alg": "ES256", "typ": "JOSE", "jku": "https://studiomeyer.io/.well-known/jwks.json"},
      "steps": [
        "First validate the https-origin publisher binding and require this exact trustSchema identifier, version and governance URI.",
        "Require exactly three compact-JWS segments, with an empty middle segment and a nonempty protected header and signature.",
        "Require alg ES256, typ JOSE, the pinned jku above, a kid, and no unsupported critical or unencoded-payload parameters.",
        "Fetch keys only from the pinned publisher JWKS using authenticated HTTPS without cross-origin redirects; never fetch an arbitrary URL supplied by an entry.",
        "Select the EC P-256 signing key whose kid matches the protected header. Reconstruct the signing input as BASE64URL(protected) + '.' + BASE64URL(UTF8(JCS(unsigned entry))).",
        "Verify ES256 using the 64-byte IEEE P1363 R||S signature. Reject changed fields, mismatched identity, unknown keys, unsupported profiles or invalid signatures."
      ]
    }
  }
}