# Root of trust — The Collective Master Library v3.2.0

> **Scope note for the Agent Kit.** This kit is not the delivery. It carries no
> `CHECKSUMS.sha256`, no `VERIFY.sh` and no `notices/` or `discoveries/`
> directories, so none of the delivery-local commands or paths below can be run
> from inside it. The kit's own bytes are covered one level up, by
> `SET-CHECKSUMS.sha256` and its detached minisign signature in The Complete
> Master Library Set — verify it there:
>
> ```bash
> sha256sum -c SET-CHECKSUMS.sha256
> minisign -Vm SET-CHECKSUMS.sha256 -p CMPSBL-MINISIGN.pub
> ```
>
> Everything below describes the full delivery, which you receive on purchase.
> Read it as the published position of that archive, not as a procedure for this
> ZIP.

Every number below is computed from the bytes shipped in this delivery. Read
this before you quote a hash, a count, or the word "verified" anywhere.

## The chain

| Link | Value |
| --- | --- |
| Files in the archive | 13,073 |
| Files listed in `CHECKSUMS.sha256` | 13,071 |
| Root hash | `sha256sum CHECKSUMS.sha256` — compare with the value published at cmpsbl.com/canon |
| Detached signature | `CHECKSUMS.sha256.minisig` (minisign) |
| Public key | `CMPSBL-MINISIGN.pub` — `RWTFRujkl2czLUSMr+PjmGNMXqxbujQz60W34yjRbhe48tJRRILRpZcA` |

`CHECKSUMS.sha256` covers every delivered file except itself and its own
detached signature: a checksum list cannot contain its own hash. Those two
files are anchored by the root hash you compute and by the signature.

## Verify it yourself

```bash
./VERIFY.sh                                  # every listed file, sha256
sha256sum CHECKSUMS.sha256                   # the root hash — compare with cmpsbl.com/canon
minisign -Vm CHECKSUMS.sha256 -p CMPSBL-MINISIGN.pub
```

Compare the root hash you compute and the public key with the copies published at
https://shpbl.com. Two sources agreeing is the anchor; one is not.

## What this proves

- **Integrity.** The files you hold are the files that were built and signed.
  Nothing was added, dropped, or edited in transit.
- **Provenance of the build.** The signature binds this file list to the
  holder of the CMPSBL minisign secret key (Kenneth E. Sweet Jr.).
- **Reproducibility of the archive.** The archive is built with a pinned build epoch and a fixed exclude list, so the same tree produces a byte-identical zip.

## What this does not prove

- **Not a security audit.** Checksums say nothing about whether the code is
  safe, correct, or fit for your purpose. Read `VERIFICATION.md` for the exact
  scope of what is claimed and what is `Not claimed`.
- **Not a fitness or compliance certificate.** No third party has certified
  this delivery for any regulatory regime.
- **Not a guarantee about your copy of the key.** If you fetch
  `CMPSBL-MINISIGN.pub` from the same place you fetched the archive, you have
  verified consistency, not authenticity. Anchor the key out of band.

## If verification fails

Stop. Do not integrate. A single mismatch means the archive is not the signed
delivery. Re-download from https://shpbl.com and re-run `./VERIFY.sh`.
If it still fails, report the mismatching path and your root hash to
hello@cmpsbl.com — do not patch around it.

Created & published by Kenneth E. Sweet Jr. · https://cmpsbl.com
