Verification pipeline

VerificationPipeline::new(registry, config) combines a plugin registry and VerificationConfig. verify(did) first consults the cache; verify_force_refresh(did) invalidates that entry and performs a fresh verification.

This page describes the published aegis-verify@0.2.0 pipeline. It is not a universal human-root requirement for the current TypeScript verifier, which accepts explicitly authorized self roots as well as owned identities. Use current verification for SDK 0.7.2.

Published pipeline

1. Resolve the OAS document through registered plugins under a timeout.
2. Validate document structure.
3. Verify its Ed25519/JCS document proof.
4. Check revocation status.
5. Verify lineage toward the root using resolved documents.
6. Check human-root liveness.
7. Compute the verified conformance level and retain warnings.
8. Cache and return the result.

Configure timeout, maximum depth, cache TTL, resolver trust, revocation and liveness providers explicitly. Cached identity results require appropriate invalidation when authority changes. A basic identity pipeline result is not a substitute for the application's privileged-authority policy.

Failure handling

Resolution failures, invalid signatures and timeouts can return VerificationError. Other conditions may be reflected in result fields/warnings according to configuration. Inspect the typed result and required policy; do not equate the mere presence of a returned object with permission to execute.

See pipeline signatures and options, core types, and conformance.