How to check this package
=========================

The file that carries the assurance is uofa.jsonld. Everything else in this zip
is a convenience copy of what that file already says.

    unzip <this-file>.zip
    uofa verify uofa.jsonld --pubkey keys/uofa-issuer.pub
    uofa check  uofa.jsonld --pubkey keys/uofa-issuer.pub

`verify` re-computes the content hash and checks the signature. `check` also runs
the structural (SHACL) rules. Neither needs a --pack flag: the package records
which standards profile validated it.

Expect `check` to report SHACL violations, and read them as findings about your
evidence rather than faults in this package. A model card carries no requirement
binding, no dataset binding and no validation results, so those are reported
missing: that gap is what the tool exists to name. The section that speaks to the
package itself is `C1 Integrity`, and that is the one that must pass.

What a valid signature here does and does not mean
--------------------------------------------------

It means: this file has not been modified since the demo produced it.

It does not mean the evidence was reviewed, accepted, or endorsed. The key that
signed it is a DEMONSTRATION issuer key held by the demo itself, not a research
or production key, and not anyone's decision key. The credibility judgment is
still the reader's to make.

About the public key in this zip
--------------------------------

keys/uofa-issuer.pub is included so these commands work offline. A trust anchor shipped
inside the artifact it validates only proves the artifact is self-consistent. To
check it against a source this zip does not control, compare its fingerprint:

    sha256sum keys/uofa-issuer.pub

against the fingerprint published at https://uofa.net and in the project repo.
If they differ, do not trust this package.

Notes
-----

- Package identifiers use the placeholder namespace https://example.org/centrifugal-blood-pump-hemolysis-study. A formally
  issued package would be minted under the issuing organization's own namespace.
- MANIFEST.json lists a SHA-256 for every other file here, including this one's
  siblings, so you can tell whether the convenience copies match. MANIFEST.json
  is NOT itself signed: only uofa.jsonld is.
- contextSha256 in MANIFEST.json is the digest of the JSON-LD @context that was
  inlined into the hash. If `verify` reports a hash mismatch, compare that value
  first: over 98% of the signed bytes are the context, so a differing context is
  by far the most likely cause.
