Attestations

An attestation statement is mount, cited, or used.

Statement	Meaning
`mount`	The record references members.
`cited`	The record names sources.
`used`	A composed query or a KAR evaluation ran.

used does not mean SATISFIED. It does not mean a claim is true or false. SATISFIED still means only that the declared KAR evidence requirements were met.

The content root has no signer and no clock. An optional Ed25519 envelope covers that root. One signer, no delegation. Core verifies with SubtleCrypto. The CLI signs. Core does not generate keys and does not call Date.now().

Examplets

import { createCompositionAttestation, verifyCompositionAttestation } from '@knolo/core/composition';

createCompositionAttestation recomputes compositionRoot before it writes attestationRoot. A stored root that does not match the body is COMPOSITION_ROOT_MISMATCH.

When a signature names keyringRoot, that value must equal authorityKeyringRootV1 of the supplied keyring. The matching key must satisfy notBefore <= now, now < notAfter, and now < revokedAt. A key outside that window is ATTESTATION_KEY_MISMATCH. The caller supplies now.

Terminalsh

knolo attest create --composition composition/composition.json --subject composition --statement cited --out composition/attestation.json
knolo attest verify composition/attestation.json --content-only

knolo verify-attestation is the same check as knolo attest verify. Both recompute compositionRoot when --composition is set. A bad signature exits 1 even when the content root matches. --content-only checks the content root and ignores the envelope.

Hub attested: true is a listing flag. It is not an attestation root.