Build and test against Ma'atara
PATENT PENDING — Ma'atara Protocol. Reviewed 21 September 2026.
Test the installed packages and destination service independently. Workspace imports do not prove npm exports exist, and mocked WASM tests do not prove the binary loads in your application.
Package checks
Pin the Quickstart versions and retain the lockfile. Toolkit and Veritas are published at 2.2.1, Aegis Pure at 0.2.0 and Encoder at 0.1.0, as checked on 21 September 2026. Private workspace packages are not external dependencies.
Run the local signing example with real WASM in each target runtime. Verify the signature, alter the message and verify rejection. Test errors before using keys or signatures. Load matching glue and binary. Test built browser asset URLs as well as development URLs; Node can use the byte-loading example in Packages.
Authentication checks
Use a synthetic enrolled identity and approved endpoint custody.
| Check | Expected result |
|---|---|
| Current identity, correct purpose/audience and fresh nonce | Authorized if other route policies pass |
| Missing/wrong version-1 purpose | Rejected; requires auth/session |
| Missing/wrong audience | Rejected |
| Reused assertion, including on a read | Rejected as replay |
| Expired assertion or excessive validity window | Rejected |
| Wrong path DID or signing key | Rejected |
| Revoked, wrong-origin or stale-epoch device | Rejected |
| Disabled destination feature | Refused, without compatibility fallback |
Mint a new assertion for every request and retry. Exercise time bounds and endpoint policy without weakening guards to make a test pass.
Record and anchor checks
Validate records with real SDK signature/identity callbacks, then change a signed field and confirm rejection. Check linked authority transitions, missing records and reordered histories. Current Core supports native v4 paths; do not carry forward an assumption that all reads are v3. Reject unsupported profiles instead of relabeling them.
Use SDK anchor helpers on a complete ordered list and retain authenticated height/leaf count. A root alone does not establish exact list length. Test service receipts separately from external transaction inclusion and finality. A local test is not a production publication receipt.
Public discovery
curl https://api.ma-atara.io/health
curl https://api.ma-atara.io/api/version
curl https://api.ma-atara.io/api/capabilities
curl https://api.ma-atara.io/openapi.json
curl https://aegis.ma-atara.io/api/capabilities
curl https://aegis.ma-atara.io/api/anchor/status
Record service/build identity with results. Health establishes liveness, not cryptographic readiness. Source configuration does not prove deployment. Browser tests must include allowed and disallowed origins; curl success is not CORS acceptance. Honor rate limits and Retry-After.
Privacy and experimental boundaries
Exercise SDK-to-wire text mapping without transmitting prose. A fingerprint match does not establish authorship or truth. Encryption failures must not cause plaintext retries. Do not activate experimental messaging, witnesses or gated rotation as a test workaround. Temporary account healing is retired; HTTP 410 is expected. Internal construction recipes are not prerequisites for these SDK integration checks.