ProofedMesh/db/trust/migrations/0005_verification_decisions.down.sql

DROP INDEX IF EXISTS idx_verification_decisions_approval;
DROP INDEX IF EXISTS idx_verification_decisions_sink_created;
DROP TABLE IF EXISTS verification_decisions;
verification-service: Phase-1 two-stage chain verifier (approval -> transform) (DEV-612) Adds services/verification-service exposing POST /api/v1/verify/chain for sink:dummy-sink. The handler runs the six hard-coded chain checks described in DEV-612 and reserves decision_id in a new `verification_decisions` table so a replayed sink delivery is refused without recomputing signatures. - DSSE signature verification against configurable approval + transform signer key_ids, loaded from VERIFICATION_SIGNER_KEYS (pem/hex/b64/b64u) - RFC 6962 inclusion-proof verifier (shared leaf/node hashing with services/transparency-log/pkg/backend) - Content binding: subject.digest.sha256 must match predicate.content_hash (approval) and request.payload_hash (transform) - Hard-coded coverage of allowed_transformations / allowed_sinks / expires_at predicates (OPA deferred to Phase 2 per the subtask) - Replay guard via new db/trust/migrations/0005_verification_decisions (in-memory store ships; Postgres skeleton mirrors sibling pattern) - Dockerfile mirrors signing-service pattern (distroless static + nonroot) - README documents endpoint, reason-code taxonomy, required predicate fields, and the Phase-2 non-scope Tests: happy path + 7 negatives (bad signature, missing inclusion proof, hash drift, sink not allowed, expired, replay, operation not allowed). Co-Authored-By: Paperclip <noreply@paperclip.ing> 2026-10-25 20:35:35 +00:00			`DROP INDEX IF EXISTS idx_verification_decisions_approval;`
			`DROP INDEX IF EXISTS idx_verification_decisions_sink_created;`
			`DROP TABLE IF EXISTS verification_decisions;`