# Verifier and policy
Assumes: 02 for the CLI; you have a hike object from 03.

| Vector | What it proves |
|---|---|
| `kat-small` | Producer byte-equality on the small known-answer object |
| `test-3leg` | Verifier shape and plant reads on a three-leg mock object |
| `anchor-window` / `anchor-w16-i17` | Anchor window and W_16 / I_17 edge cases |
| `bind-threads` | Bind-thread count does not change the record |
| `sign-in-origins.json` | Origin byte-match: the gate's configured origin accepted; near-misses refuse |

1. The split. "Section 13 produces the object. Section 14 measures it. Section 15 is the admission service." (SPEC §2). The verifier writes a measurement record and makes no judgement ([reference/README.md](https://github.com/groundinglab/pcoc/blob/aaa8946d241bf22a3004b71cf082267c757221a2/reference/README.md)). Accept, refuse and revoke are one relying party's decisions, not pass/fail ([services/admission-gate/README.md](https://github.com/groundinglab/pcoc/blob/aaa8946d241bf22a3004b71cf082267c757221a2/services/admission-gate/README.md)).
2. What verify reads. Each index read is a single lookup; the verifier never scans across many heights (SPEC header; Rule A4, §14). The checkpoint measurement reads GET {index}/index/{beacon_height} (admission-gate [deploy/gate.toml](https://github.com/groundinglab/pcoc/blob/aaa8946d241bf22a3004b71cf082267c757221a2/services/admission-gate/deploy/gate.toml)). Comparing a plant (the Bitcoin output that timestamps waypoints) uses root, txid, vout, block_hash, block_height, never tree_size (§14.3). `anchored` is recorded only when the inclusion height is in the window, the header is stored, and the plant matches (SPEC header, §14.5).
3. Index options, all opt-in. The hosted index is https://index.groundinglab.io. To run your own: `pcoc-index` (default bind 127.0.0.1:38081; GET /index, /index/{h}, /index/since), filled by Bari or by `pcoc-index rebuild --source esplora` / `--source rpc` from a pruned node, which checks header links ([services/index/README.md](https://github.com/groundinglab/pcoc/blob/aaa8946d241bf22a3004b71cf082267c757221a2/services/index/README.md)). Anyone can skip the service and read Bitcoin ([services/index/README.md](https://github.com/groundinglab/pcoc/blob/aaa8946d241bf22a3004b71cf082267c757221a2/services/index/README.md)).
4. Running it. CLI profiles test/live ([Rust reference](reference-rust.md), beat 5), or embed `hike::verify` ([Rust reference](reference-rust.md), beat 7). Section 14.6 concurrency doesn't affect the record (SPEC header).
5. Conformance. Compare `record` on each vector (SPEC §16.1; [spec/conformance/v2.0/README.md](https://github.com/groundinglab/pcoc/blob/aaa8946d241bf22a3004b71cf082267c757221a2/spec/conformance/v2.0/README.md)). Vectors: kat-small, anchor-window, anchor-w16-i17, earlier-run-b, bind-threads, test-3leg (a mock anchor, not a real PCOC).
6. The record. One JSON object, with the keys in the order SPEC §14 lists (profile … analysis). No null; tokens are strings; RFC 8785 for verify_record_sha256; one trailing newline. An earlier-version kind gives `version` `earlier version` (Rule A5), a measurement, not a failure. The fast record (§15.3) omits checkpoints.legs.result, six_leg and six_leg_runs.
   Token glossary (§14.1–14.7):
   - shape: `match` or `mismatch`, with `shape_item` from a closed list of 14.
   - anchors: `anchored` only when in window, header stored and plant `match`; otherwise `not anchored`.
   - six_leg: six `match`/`mismatch` results; `not defined` under six legs.
   - N: checkpoints in stages a…b−1 (A4.7).
   - S: T(P_b) − T(I_{a−1}), in seconds (A4.8).
   - delta_h: height_P_b − height_I_a_minus_1, index-confirmed heights only (A4.8).
   - Shared tokens: `not defined`, `not read`, `n/a`, `not fetched by design`.
7. Writing a policy. Part B, §15. Inputs §15.1, outputs and states §15.2: outcomes provisional, accept, refuse, revoke, held; states received, provisional, accepted, refused, revoked, held. `held` is a not-read or retry, not a negative. A negative after any grant is revoke. Two-phase async §15.3; named parameters §15.4; candidate profiles §15.5. Only the leg-rate floors, B9, provisional_action_cap 0, the 2026-10-07 re-verify rule and the §15.1 wire are locked (SPEC §15 opening).
8. Example gl-admit-v1. These numbers are one relying party's chosen settings, groundinglab's Gate policy, not part of the measurement: the record (beat 5) is the same whatever a policy sets. min_leg_rate 0.25 leg/s and min_waypoints 6 of 18. leg_rate_floor strict 7/20, default 1/4, lenient 1/8 applies to resumed provisionals. Changing any number means a new id, and startup refuses a changed number under the same id (policy-bind.json). Another relying party may pick other values under its own policy_id. GET /v1/policy shows the Gate's ([services/admission-gate/README.md](https://github.com/groundinglab/pcoc/blob/aaa8946d241bf22a3004b71cf082267c757221a2/services/admission-gate/README.md); [deploy/gate.toml](https://github.com/groundinglab/pcoc/blob/aaa8946d241bf22a3004b71cf082267c757221a2/services/admission-gate/deploy/gate.toml); [src/http.rs](https://github.com/groundinglab/pcoc/blob/aaa8946d241bf22a3004b71cf082267c757221a2/services/admission-gate/src/http.rs)).
9. What not to infer. Log entries are groundinglab's decisions; another party may decide differently. A verify record shows no cost figure; cost is not the verifier's concern. Catch rates and economic security aren't established ([STATUS.md](https://github.com/groundinglab/pcoc/blob/aaa8946d241bf22a3004b71cf082267c757221a2/STATUS.md)).
Next: to present an accepted object to a site, see the sign-in wire ([Sign-in wire](sign-in-wire.md)).