VSO updates VAP references and research status; signature fix is on main only

Bounded signature-verification correction — VAP #68

Both implementations explicitly reject small-order public keys and signature R points, noncanonical point encodings and scalars at or above the subgroup order before backend verification. The observed acceptance required the caller to substitute role trust keys; retaining the original trusted keys rejected the altered pack. Backend behavior differed by runtime. This is a local experimental input policy, not full prime-subgroup validation or a new VAP normative requirement. The recorded suite has 41 test methods (32 existing and 9 additional security methods); parameterized inputs are not a separate additive total. The 11 original vector/manifest files remain unchanged.

VAP documentation and change-process proposals — #66, #67, #69

Session/token validity is separated from permission intervals and revocation evidence. Source-monitoring notes distinguish reported proposals from adopted rules. Updated scope notes distinguish evidence verification from preventive control; LAP remains an external, unregistered proposal. Change-process and CHANGE-002 candidate inventories are unadopted drafts: formal identifiers, decisions and missing normative text/vectors remain unresolved. The IETF next-draft crosswalk is a proposal, not a submission or a published new revision. No public-review clock or committee approval is asserted.

VCP, SDK and historical reference records

VCP #30/#31 repair digest metadata and clarify bounded errata and ERASURE wording; they do not replace existing signed data or establish full VAP conformance. SDK #16/#17 distinguish development-document revisions from the existing release and reference an unadopted three-valued verification proposal. CAP and reference-implementation notes separate historical assessments from current source checks. Repository navigation, installation extras and CI maintenance have their own bounded scopes.

Explorer and public explanations

Explorer GUI #28 and API #30 distinguish reported metadata from verified anchors, precision and certification. The public GUI was already updated by site #216. This announcement does not reissue the Explorer or convert fixture endpoints into a native VCP v1.2 verifier. Existing product, operator, LAP relationship and incident-source corrections remain available; the PPC public-comment announcement remains a separate record.

Merged source records

Historical evidence and distribution boundaries

Earlier announcements, including the Explorer record at 159 tests, remain unchanged. Website reference updates do not modify normative requirements, implementations, signed data, fixed distributions or K3. Open Draft PRs are excluded from merged outcomes.

2026-11-08 · VAP / VSO