- JSON is stored with sorted keys and two-space indentation; hashes use JCS-style encoding:
json.dumps(payload, separators=(',', ':'), sort_keys=True). payload_hash fields in examples and exports are computed from the canonical payload bytes and formatted as sha256:<hex>.- Schema negotiation stays on the
zastava.*@v1.x line; breaking changes bump the major version.
- Payload types:
application/vnd.stellaops.zastava.schema+json;name=observer_event;version=1application/vnd.stellaops.zastava.schema+json;name=webhook_admission;version=1
- Ed25519 public key (base64url, no padding):
mpIEbYRL1q5yhN6wBRvkZ_0xXz3QUJPueJJ8sn__GGc. - Signatures are emitted as
<file>.dsse with DSSEv1 pre-auth encoding over the raw file bytes. - Regenerate signatures with
docs/modules/zastava/kit/verify.sh prerequisites (Python + cryptography) and the private key held offline.
- Example payloads:
schemas/examples/*.json. - Signed exports:
exports/observer_events.ndjson(.dsse) and exports/webhook_admissions.ndjson(.dsse). - Kit verification aggregates all signatures via
kit/verify.sh.