Verifier and policy

Assumes: 02 for the CLI; you have a hike object from 03.

1. The split. "Section 13 produces the object. Section 14 measures it. Section 15 is the admission service." (SPEC §2). The verifier writes a measurement record and makes no judgement (reference/README.md). Accept, refuse and revoke are one relying party's decisions, not pass/fail (services/admission-gate/README.md).
2. What verify reads. Each index read is a single lookup; the verifier never scans across many heights (SPEC header; Rule A4, §14). The checkpoint measurement reads GET {index}/index/{beacon_height} (admission-gate deploy/gate.toml). Comparing a plant (the Bitcoin output that timestamps waypoints) uses root, txid, vout, block_hash, block_height, never tree_size (§14.3). anchored is recorded only when the inclusion height is in the window, the header is stored, and the plant matches (SPEC header, §14.5).
3. Index options, all opt-in. The hosted index is https://index.groundinglab.io. To run your own: pcoc-index (default bind 127.0.0.1:38081; GET /index, /index/{h}, /index/since), filled by Bari or by pcoc-index rebuild --source esplora / --source rpc from a pruned node, which checks header links (services/index/README.md). Anyone can skip the service and read Bitcoin (services/index/README.md).
4. Running it. CLI profiles test/live (Rust reference, beat 5), or embed hike::verify (Rust reference, beat 7). Section 14.6 concurrency doesn't affect the record (SPEC header).
5. Conformance. Compare record on each vector (SPEC §16.1; spec/conformance/v2.0/README.md). Vectors: kat-small, anchor-window, anchor-w16-i17, earlier-run-b, bind-threads, test-3leg (a mock anchor, not a real PCOC).
6. The record. One JSON object, with the keys in the order SPEC §14 lists (profile … analysis). No null; tokens are strings; RFC 8785 for verify_record_sha256; one trailing newline. An earlier-version kind gives version earlier version (Rule A5), a measurement, not a failure. The fast record (§15.3) omits checkpoints.legs.result, six_leg and six_leg_runs. Token glossary (§14.1–14.7):
   • shape: match or mismatch, with shape_item from a closed list of 14.
   • anchors: anchored only when in window, header stored and plant match; otherwise not anchored.
   • six_leg: six match/mismatch results; not defined under six legs.
   • N: checkpoints in stages a…b−1 (A4.7).
   • S: T(P_b) − T(I_{a−1}), in seconds (A4.8).
   • delta_h: height_P_b − height_I_a_minus_1, index-confirmed heights only (A4.8).
   • Shared tokens: not defined, not read, n/a, not fetched by design.
7. Writing a policy. Part B, §15. Inputs §15.1, outputs and states §15.2: outcomes provisional, accept, refuse, revoke, held; states received, provisional, accepted, refused, revoked, held. held is a not-read or retry, not a negative. A negative after any grant is revoke. Two-phase async §15.3; named parameters §15.4; candidate profiles §15.5. Only the leg-rate floors, B9, provisional_action_cap 0, the 2026-10-07 re-verify rule and the §15.1 wire are locked (SPEC §15 opening).
8. Example gl-admit-v1. These numbers are one relying party's chosen settings, groundinglab's Gate policy, not part of the measurement: the record (beat 5) is the same whatever a policy sets. min_leg_rate 0.25 leg/s and min_waypoints 6 of 18. leg_rate_floor strict 7/20, default 1/4, lenient 1/8 applies to resumed provisionals. Changing any number means a new id, and startup refuses a changed number under the same id (policy-bind.json). Another relying party may pick other values under its own policy_id. GET /v1/policy shows the Gate's (services/admission-gate/README.md; deploy/gate.toml; src/http.rs).
9. What not to infer. Log entries are groundinglab's decisions; another party may decide differently. A verify record shows no cost figure; cost is not the verifier's concern. Catch rates and economic security aren't established (STATUS.md). Next: to present an accepted object to a site, see the sign-in wire (Sign-in wire).

Checked against pcoc aaa8946. Raw markdown.