What to do
Re-document the pre-decrypt sender accessor so it stops claiming a property it does not have. Decided in #350; the wording half was chosen precisely because it is non-breaking and can land immediately.
Three sites, all doc comments, no code change:
pg-core/src/client/mod.rs:89 — pub pub_id: Policy, currently /// The verified public identity which was used to sign the header.pg-wasm/src/lib.rs:295 — MemoryUnsealer::public_identity, currently /// Returns the verified public identity of the sender.pg-wasm/src/lib.rs:330 — the streaming unsealer's public_identity, same string.
What they must say instead
The value is verified in one narrow sense — an IBS signature over the header bytes checked out — and is not bound to the ciphertext. #347 added that binding inside the AEAD, so it is only checkable in unseal, and everything readable at header-inspection time keeps the old behaviour permanently. The docs have to say both halves, and name where the bound answer lives:
The sender identity claimed in the header. The header signature over it verifies, but nothing binds it to the ciphertext until unseal returns — a container's header signature can be replaced by any party the PKG will issue a signing key to (#338). For the bound answer, use the public field of the VerificationResult that unseal returns.
Adapt the wording per site; keep the two claims (signature verifies / not bound until unseal) and the pointer to VerificationResult.public in all three.
Also worth a line in Unsealer's own type-level doc, which currently advertises the two-step flow — "First the header is read. This yields information for whom the message is encrypted." — with no hint that step 1's sender is unbound. That doc is why the flow reads as endorsed.
Not a dispatch ticket
No command's pass/fail decides whether this landed — it is prose. #348 says the same about itself and for the same reason; the honest label is wayfinder:task, and a human reads the rendered docs.
Scope
Deliberately only the doc comments. The identifier renames (pub_id → claimed_sender, public_identity() → claimed_sender()) cost a pg-core major and are queued onto #340, which is already cutting one. pg-js's JSDoc and the website copy are the other repo's half and live in postguard-js.
Done when
All three doc comments on main state that the identity is claimed and unbound until unseal, and name VerificationResult.public.
Part of #338, itself part of #247.
What to do
Re-document the pre-decrypt sender accessor so it stops claiming a property it does not have. Decided in #350; the wording half was chosen precisely because it is non-breaking and can land immediately.
Three sites, all doc comments, no code change:
pg-core/src/client/mod.rs:89—pub pub_id: Policy, currently/// The verified public identity which was used to sign the header.pg-wasm/src/lib.rs:295—MemoryUnsealer::public_identity, currently/// Returns the verified public identity of the sender.pg-wasm/src/lib.rs:330— the streaming unsealer'spublic_identity, same string.What they must say instead
The value is verified in one narrow sense — an IBS signature over the header bytes checked out — and is not bound to the ciphertext.
#347added that binding inside the AEAD, so it is only checkable inunseal, and everything readable at header-inspection time keeps the old behaviour permanently. The docs have to say both halves, and name where the bound answer lives:Adapt the wording per site; keep the two claims (signature verifies / not bound until
unseal) and the pointer toVerificationResult.publicin all three.Also worth a line in
Unsealer's own type-level doc, which currently advertises the two-step flow — "First the header is read. This yields information for whom the message is encrypted." — with no hint that step 1's sender is unbound. That doc is why the flow reads as endorsed.Not a dispatch ticket
No command's pass/fail decides whether this landed — it is prose.
#348says the same about itself and for the same reason; the honest label iswayfinder:task, and a human reads the rendered docs.Scope
Deliberately only the doc comments. The identifier renames (
pub_id→claimed_sender,public_identity()→claimed_sender()) cost apg-coremajor and are queued onto #340, which is already cutting one.pg-js's JSDoc and the website copy are the other repo's half and live in postguard-js.Done when
All three doc comments on
mainstate that the identity is claimed and unbound untilunseal, and nameVerificationResult.public.Part of #338, itself part of #247.