Skip to content
Mars® Protocol

§02b Jupiter — Certification & Attestation — Certificate composition and N-hop certificates

Mars® Spec › §02b Jupiter — Certification & Attestation › Certificate composition and N-hop certificates

← The specification registry · Section index · The delta-attestation lifecycle →

4. Certificate composition and N-hop certificates

Certificates may be composed across verification steps. An N-hop certificate is a certificate whose Field 3 certification-path record enumerates a sequence of verification steps, each with its own path identifier and evidence reference, linked across hops.

Atomicity. An N-hop certificate is atomic: partial re-discharge is prohibited. If any link in the chain is withdrawn — any constituent certificate revoked, any constituent witness failing, or any constituent falsifier condition firing — the entire composed certificate is invalidated. There is no partial validity for a composed certificate.

Recursive composition (composite-of-composites). Where a constituent of an N-hop certificate is itself an N-hop composed certificate, the parent certificate must reference the constituent’s full composition chain, not only its terminal certificate. The composition provenance record for the parent carries, per constituent, a recursion indicator and a chain reference: a pointer to the constituent’s own composition provenance record. An independent inspector re-derives the parent’s composed verdict by: (i) verifying the constituent’s terminal certificate via its own full chain, then (ii) using the verified constituent verdict as an input to the parent’s composition step. The parent’s witness carries a cryptographic reference to the constituent’s chain (the content hash of the constituent’s composition provenance record), not an inlined copy. The depth of nesting is unbounded.

Governance variations. The following additional certificate forms are admitted:

  • Federated joint-authority certification — multiple federated authorities each attest; the binding is a federation hash recomputable from constituent bindings; downstream consumer refuses when the federation hash fails or any required constituent binding is withdrawn. In a federated deployment, each authority agent is subject to the AUTHORITY_RECONCILE protocol (§02a §3a.3 AR-gate): peer agents exchange typed PeerFinding messages (AR-gate.1); no agent propagates a peer-supplied finding without local re-verification (AR-gate.2 no-unverified-propagation invariant); divergence between agents — a verdict status difference over the same artifact under the same content hash — triggers a ReconciliationEvent (AR-gate.4) and verdict downgrade to REFER pending resolution (AR-gate.5); resolution produces one of four typed outcomes — ratify_amend, admit_after_review, refuse_with_justification, or escalate (AR-gate.6); partition-recovery is governed by declared handshake and consistency-recovery bounds (AR-gate.7). The federation hash over constituent attestations is computable only after all agents have cleared the AR-gate for this artifact; a federation hash assembled from attestations that were produced without AR-gate compliance is not a conforming federated joint-authority binding
  • Differential certification — two independently-attested certificates for the same target emitted by distinct verifiers; downstream consumer admits only when both produce concordant verdicts. Two certificates are concordant if and only if both carry the same canonical verdict value. A conforming certificate and a conditionally-conforming certificate are not concordant and trigger the conservative-verdict rule.
  • Time-windowed certification — narrow temporal validity windows (per-operational-rotation, per-clinical-shift, per-certification-cycle) with required re-attestation
  • Streaming certification — for incrementally-emitted interpretations, the certificate is a sequence of incremental records each bound to the cumulative content hash of sub-emissions up to that record
  • Sidecar transmission — certificate transmitted out-of-band as a sidecar artifact; admission/refusal decision remains externally observable
  • Zero-knowledge attestation — satisfaction of structural conditions attested by a ZK proof without revealing field values; admission/refusal decision remains externally observable

← The specification registry · Section index · The delta-attestation lifecycle →