K2Fv0.3Gallery

Integrity

For a drag-and-drop check in the browser, use the verify page. Viewer banners come from the published k2f/public/contracts/banners.json.

Viewer banners

Viewers must surface integrity status derived from IntegrityStatus. The banner code is always available via banner() / k2f-open; default UI uses tiered visibility (like PDF viewers):

BannerWhenDefault UI
SIGNEDValid signature and hash chainCompact positive strip
UNSIGNEDSelf-consistent, unsignedHidden (quiet read)
SIGNED_BUT_BROKENSignature file invalid or tamperedProminent warning
BROKEN_INTEGRITYContent, appearance, or font failureProminent warning
UNLOCKEDPackage not compiledCompact draft strip

Embedders may pass banner: "full" for the legacy verbose strip on every state, or banner: "off" / no-banner to hide chrome entirely. Broken states must never be silently treated as signed.

BROKEN_INTEGRITY and SIGNED_BUT_BROKEN must not be treated as signed.

Integrity verification

k2f verify and inspect_package return status codes:

CodeMeaning
VALIDLock matches semantic content, theme, fonts, and the reader's engine identity
UNSIGNEDSelf-consistent unsigned package (hash VALID or ENGINE_MISMATCH)
SIGNEDSelf-consistent package and valid Ed25519 signature
SIGNED_BUT_BROKENSignature present but hash or crypto check failed
UNLOCKEDNo document.K2F.lock
CONTENT_CHANGEDSemantic tree changed since lock
APPEARANCE_CHANGEDTheme, fonts, page config, or unbound engine identity changed since lock
ENGINE_MISMATCHHash chain matches the lock's recorded engine; reader's engine_version / engine_commit_sha differs
FONT_MISSINGRequired embedded fonts absent

Additional package errors: SCHEMA_INVALID, NODE_ID, UNEXPECTED_PATH, UNKNOWN_PAINT_OP, PDF_IS_NOT_A_SOURCE, IMAGE_SIZE, SVG_TEXT.

In-browser check: Verify. Banner rules: Integrity.

Verify codes

From k2f/public/contracts/verify-codes.json.