# ADR-0002: MARS v1 publisher-signing profile erratum

- **Status:** Accepted
- **Date:** 2026-08-28
- **Decision owners:** MARS protocol and registry maintainers

## Context

The original v1 text described publisher signatures as covering every top-level
entry field except `signature`. `mars-server` verifies that incoming form and
then assigns or updates `sequence`, `updatedAt`, `lifecycleStatus`,
`verifiableAttestations`, and `shardAssignment`. The stored entry therefore no
longer verifies against the signature that the registry accepted. Future anchor
status projections have the same ownership problem.

Publisher identity, payload, and bond claims must remain publisher-authored and
tamper-evident. Registry projections must be independently mutable without
requiring the publisher to re-sign third-party or operational state.

## Decision

`mars-protocol::canonical_signing_bytes` is the sole implementation of
`MARS-PUBLISHER-SIGNING-V1`. Before RFC 8785 JCS serialization it removes only
these explicit top-level fields:

- `signature`
- `sequence`
- `updatedAt`
- `lifecycleStatus`
- `verifiableAttestations`
- `shardAssignment`
- reserved anchor projections: `anchorProjection`, `anchorState`,
  `anchorTxHash`, `anchorBlockHeight`, and `anchorProof`

No prefix, recursive, or extension-field exclusion is permitted. In particular,
`publisherDid`, `itemData`, `itemDataHash`, `bondReference`, and every unlisted
field remain signed. A field with one of the reserved names nested inside
publisher-authored data also remains signed.

The protocol version remains `1.0.0`. This is a pre-production v1 erratum that
repairs an internally inconsistent signing rule before production compatibility
is declared; it is not a dual-verification profile.

## Compatibility and Reggie migration

The canonical bytes change even though the JSON wire shape and
`marsVersion` do not. A signature produced by the pre-erratum rule does not
verify under `MARS-PUBLISHER-SIGNING-V1`, and the registry must not silently
fall back to the defective profile.

Before Reggie cuts over writes or imports historical entries:

1. its signer and verifier must consume the exact exclusion list and JCS bytes
   demonstrated by
   `mars-protocol/test-vectors/publisher-signing-profile-v1.json`;
2. every historical pre-erratum entry selected for migration must be
   re-published and re-signed by its publisher before cutover; entries that
   cannot be re-signed must be rejected or quarantined rather than admitted
   through a dual-verification path, and changing registry projections cannot
   repair a legacy signature; and
3. migration validation must verify the final stored representation, not only
   the pre-insert request.

## Consequences

- Stored entries remain publisher-verifiable after registry sequence,
  lifecycle, attestation, shard, and anchor projection changes.
- The deterministic private-key seed in the cross-language fixture is public
  test-only material and must never be used by a real publisher.
- Registry-managed fields require their own registry/audit integrity controls;
  they are not authenticated by the publisher signature.
- Sigil, Mints, and OATS adapters remain deferred. Reserving anchor projection
  names does not activate an anchor authority or change the staged rollout in
  ADR-0001.