Module verifier 

PIC Verifier (Profile 0.2).

Two roles:

• verify_settled — ordinary verification of a settled PIC Token JWT before any authority is exercised;
• SettlementAuthority — the trusted settlement role (PIC-X is one realization): validates a workload-signed advancement candidate through the complete numbered procedure of the specification and, on success, materializes the next checkpoint and issues the next settled token. issue_settled covers initialization (checkpoint 0).

A valid signature establishes integrity, not semantic validity: the semantic checks run independently and are never skipped because a signature verified.

Structs

SettledIssue

A newly settled continuity state.

SettledState

A verified settled continuity state.

SettlementAuthority

The trusted settlement authority for Profile 0.2 centralized advancement.

SettlementContext

Claims metadata for a settled token.

Functions

issue_settled

Signs a checkpoint into the settled artifact chain: PIC PCA COSE → settled PIC Continuity COSE (transitions = null) → settled PIC Token JWT. This is the initialization path (checkpoint 0, e.g. after an OAuth-to-PIC exchange) and the tail of every settlement.

verify_settled

Verifies a settled PIC Token JWT end to end: realm JWT signature → pic.root exact bytes → realm Continuity signature → transitions = null → exact root.pca bytes → recomputed root.pca_hash → realm PCA signature → materialized authority.