{
  "canonical": {
    "site": "https://meridianverity.com/",
    "site_release_root": "https://meridianverity.com/trust/site-release/demo/",
    "trust_descriptor": "https://meridianverity.com/.well-known/mvg-trust.demo.json"
  },
  "critical_assets": [
    {
      "bytes": 6265,
      "path": "/.well-known/mvg-trust.demo.json",
      "sha256": "17e94be91ff63caedb0741741a712c771338f9e85746b3fbedabeaa6b326719d",
      "sri": "sha256-F+lL6R/2PK7bB0F0GnEsdxM4+ehXRrP77avqprMmcZ0="
    },
    {
      "bytes": 1587,
      "path": "/.well-known/mvg-contact.json",
      "sha256": "d9b657f88a9efa1ae4c4e2ff3e062a8f5c9c44aa3284aa24d2b16733d0ab6713",
      "sri": "sha256-2bZX+Iqe+hrkxOL/PgYqj1ycRKoyhKok0rFnM9CrZxM="
    },
    {
      "bytes": 406,
      "path": "/.well-known/security.txt",
      "sha256": "88d7991649b8906c9b604a5f4f11048186739119c43fbcd72a9af52f5715ff3b",
      "sri": "sha256-iNeZFkm4kGybYEpfTxEEgYZzkRnEP7zXKpr1L1cV/zs="
    },
    {
      "bytes": 5646,
      "path": "/_headers",
      "sha256": "8fe6f1f07698bccd0f1f03df5904f213b475dbb37d084d9316ee59a5ebc8e9a9",
      "sri": "sha256-j+bx8HaYvM0PHwPfWQTyE7R127N9CE2TFu5ZpevI6ak="
    },
    {
      "bytes": 6070,
      "path": "/_redirects",
      "sha256": "6642a56b9e9c6e84668b87f02c9e3baf6849d79b71674f4e0ba30c3a26bdeb9b",
      "sri": "sha256-ZkKla56cboRmi4fwLJ47r2hJ15txZ09OC6MMOia965s="
    },
    {
      "bytes": 1608,
      "path": "/assets/site-integrity/sri-bootstrap.v1.js",
      "sha256": "5089bb6b6d368bbe1cf91932049c41c3b9f5f5ffa0678f1d7a7bdb9bf306204e",
      "sri": "sha256-UIm7a202i74c+RkyBJxBw7n19f+gZ48denvbm/MGIE4="
    },
    {
      "bytes": 1638,
      "path": "/assets/site-integrity/hold-remediation-map.v1.json",
      "sha256": "c6e9300602f646e8695ebc83bef6d99094f63c4f7a2ba1608df4547c0bda0b0b",
      "sri": "sha256-xukwBgL2RuhpXryDvvbZkJT2PE96K6FgjfRUfAvaCws="
    },
    {
      "bytes": 114866,
      "path": "/assets/verify/verify-page.js",
      "sha256": "fbc38d99bf54efe4550c9d01e4759cfef1c1cff95690a9c49914a20ea89c00dc",
      "sri": "sha256-+8ONmb9U7+RVDJ0B5HWc/vHBz/lWkKnEmRSiDqicANw="
    },
    {
      "bytes": 45635,
      "path": "/assets/verify/verify-worker.js",
      "sha256": "aa10962cc2206d882b4ec2273708b48709eab628ed9f04e36121752450dabbe4",
      "sri": "sha256-qhCWLMIgbYgrTsInNwi0hwnqtijtnwTjYSF1JFDau+Q="
    },
    {
      "bytes": 40415,
      "path": "/assets/app.js",
      "sha256": "eed1499d6202ec2224605981a6c50478bd908cf74f04f35bb14ecf7419870a70",
      "sri": "sha256-7tFJnWIC7CIkYFmBpsUEeL2QjPdPBPNbsU7PdBmHCnA="
    },
    {
      "bytes": 55765,
      "path": "/assets/styles.css",
      "sha256": "473838b32640b18d627356fcf1badadd4d2b12d76d8aadbbd3772f90ce170bfe",
      "sri": "sha256-Rzg4syZAsY1ic1b88bra3U0rEtdtiq2703cvkM4XC/4="
    },
    {
      "bytes": 2694,
      "path": "/trust/site-release/demo/pgp.asc",
      "sha256": "8179f5a284b0dd61a93f0b09c9a9b865f17ad6359f01a82e187cdff92fdb2fe6",
      "sri": "sha256-gXn1ooSw3WGpPwsJyam4ZfF61jWfAaguGHzf+S/bL+Y="
    },
    {
      "bytes": 94,
      "path": "/trust/site-release/demo/pgp.fingerprint",
      "sha256": "84fea028df3beeabd85a1c7eedaff64291bde8f0f5a7f554924d32609edd2c28",
      "sri": "sha256-hP6gKN877qvYWhx+7a/2QpG96PD1p/VUkk0yYJ7dLCg="
    }
  ],
  "expires_utc": "2026-03-20T00:00:00Z",
  "integrity": {
    "critical_assets_count": 13,
    "fail_closed": true,
    "notes": [
      "This manifest pins a minimal security-critical set to keep the DEMO rail stable while remaining verifiable.",
      "UI pages are intentionally excluded; UI must never be relied upon as a security boundary."
    ]
  },
  "issued_utc": "2026-02-18T00:00:00Z",
  "notes": [
    "DEMO-SIGNED. Demo keys only; not production trust.",
    "Any mismatch in critical_assets MUST produce HOLD and triggers RECUT REQUIRED."
  ],
  "schema_id": "mvg.site_release_manifest@1",
  "schema_version": "1.0.0",
  "signing": {
    "kind": "OpenPGP detached signature",
    "pinned_fingerprint": "F61CF442F40EA1D3DD2D43E66F8852570DFBABDB",
    "public_key_url": "https://meridianverity.com/trust/site-release/demo/pgp.asc",
    "signature_layout": "<payload>.sig/<FPR>.asc (multi-sig) + <payload>.asc (primary convenience)",
    "threshold": 1
  },
  "site_release_id": "MVG-SITE-DEMO-20260218.1",
  "trust_mode": "DEMO",
  "version": "v50.10"
}