[moisesja]

Fixes #131

Problem

did:webvh v1.0, Read step 4: "The versionTime of every entry MUST NOT be more than a small, implementation-defined tolerance in the future relative to the resolver's current time. Resolvers SHOULD use a tolerance of no more than 5 minutes. Entries that exceed this tolerance MUST cause resolution to fail."

NetDid only checked that entries were in increasing order, so a log dated days or years in the future resolved even though conforming resolvers must reject it.

Change

• LogChainValidator: every validated entry, genesis included, must satisfy versionTime - now <= 5 min. The check sits next to the per-entry SCID check and runs before hash and proof work.
  • Exactly 5 minutes is accepted.
  • Subtracting the two times can't overflow, even for a year-9999 entry.
  • Failures throw LogChainValidationException.
• DidWebVhMethod: the time comes from the existing Clock seam and is read once per operation. A resolution uses the same reading for the pass up to the requested version and for the pass that checks later entries for a deactivation. Update and Deactivate validate the supplied log against the same rule.
• Tolerance: fixed at 5 minutes and not configurable. Raising it would exceed the spec's SHOULD. Lowering it would only reject logs that other conforming resolvers accept, because NetDid never writes a future versionTime.

Behavior

• Latest resolution: returns invalidDidLog if any entry is more than 5 min ahead of the resolver clock.
• Historical versionId/versionTime resolution: returns an earlier valid entry even when later entries are future-dated, as spec Read step 11.2 requires. A deactivation found only in those future-dated entries is not reported.
• Update/Deactivate:
  • A supplied log whose latest entry is more than 5 min ahead now throws LogChainValidationException; before, it threw ArgumentException.
  • A latest entry up to about 1 s ahead still succeeds after the whole-second wait.
  • Anything between that and 5 min still throws the did:webvh: serialized created/updated truncate fractional versionTimes — DID Core whole-second mandate vs webvh sub-second version identity #127 ArgumentException.
• Operational: writer and resolver clocks must stay synchronized. A resolver whose clock is more than 5 min slow rejects freshly updated DIDs. A writer whose clock is fast publishes entries that correctly clocked resolvers reject.

Evidence

• Tests: 22 new Issue131_* tests. Fail-first: 12 failed on assertions against the pre-fix code; the other 10 are accept-side and control cases. All 9 code mutations I tried were caught (boundary operator, 4/6-min tolerance, removing either check, tail pass on the system clock or reading the clock twice, Update/Deactivate on the system clock).
• net-did-verify:
  • Release build: 0 warnings, 0 errors.
  • WebVh tests: 523 → 545. All other projects unchanged and green, W3C conformance 233/233.
  • All 5 samples exit 0.
• DIF compliance-vector replay: one line differs from the report on main. negative-versiontime-future is now rejected by this rule; before, it was rejected only because the vector's entries are also out of order. Counts are unchanged.
• Adversarial review: two independent agents, one on correctness/spec and one on trust boundary/operations. No Critical, High or Medium findings. Three Low documentation findings were fixed. The deliberate keep (the internal system-clock validator overload) is recorded in tasks/todo20261027-issue131.md.

No NetDidVersion bump; CHANGELOG updated under [Unreleased].

🤖 Generated with Claude Code

[moisesja]

Looks good to merge at a072ba7. No actionable correctness, security, or scalability defect found after reviewing the full diff and an independent adversarial pass. Genesis and later entries enforce the inclusive five-minute bound; historical prefix/tail validation shares one clock observation and cannot assert a future-invalid deactivation. The exception change is documented. Commit messages are clear, and the large line count is mostly tests/docs; production changes stay within two files.

Independently verified: Release build with 0 warnings/errors; 1,845 tests passed, including WebVh 545/545 and W3C 233/233; 7 opt-in EVM tests skipped; all five samples passed. The unchanged did:key sample needed an unsandboxed rerun because Apple cryptography failed inside the sandbox. CI is also green.