Anchored Replay
How a reviewer moves from package-internal replay to issuer continuity using a trust anchor obtained outside the package.
How do I verify a review package against a signer I trust without letting the package authenticate itself?
Anchored replay explains how a reviewer moves from package-local checks to continuity checks against a trust anchor obtained outside the package.
1. Problem this page solves
Bundle verification can prove internal consistency, but that alone does not establish issuer continuity beyond the package itself.
Anchored replay adds an outside continuity point so a reviewer can test whether the package claims still hold when compared to anchor material obtained through a separate path.
2. What you should understand after reading
After this page, you should understand:
- what you can check inside the bundle
- what requires an outside anchor
- how anchored replay extends package-local verification
- what anchored replay still does not prove on its own
3. Mechanism-first anchored replay path
Use this exact order:
- Inspect the bundle artifacts. Identify the proof-bearing files and declared claim layers.
- Validate internal consistency. Check the manifest, signatures, and declared internal links.
- Identify the required anchor point. Determine which continuity claim needs an external anchor, for example signer continuity.
- Obtain the anchor outside the package. Retrieve the reviewer-trusted anchor through a separate custody path.
- Compare package state to anchored state. Replay with the reviewer-supplied anchor and evaluate match or mismatch.
- Determine the continuity outcome. Decide whether continuity is established, untested, or failed.
Inside-package vs outside-anchor scope
| Scope | What you observe | What it can establish |
|---|---|---|
| Bundle-local replay | Package contents, hashes, signatures, chain links | Internal coherence of the packaged claim set |
| Anchored replay | Same package + external trusted anchor | Whether claim continuity holds against a reviewer-pinned trust point |
4. Observed vs inferred
| Layer | Observed material | Inferred claim |
|---|---|---|
| Package observations | Bundle files, digest matches, signature checks, chain references | The package is internally coherent |
| Anchor observations | External key or anchor material and replay result against it | Continuity relative to that anchor |
| Inference boundary | Combination of package + anchor checks | Broader trust conclusions over time or across packages still require policy interpretation |
5. Trust assumptions
Anchored replay depends on a few explicit trust inputs:
- trust in the anchor source authenticity
- trust in the independence of the anchor retrieval path
- trust that replay tooling is evaluating the package-to-anchor comparison correctly
What anchored replay can confirm:
- package-local consistency still holds when checked against the reviewer-supplied anchor
- signer continuity can be established for that anchor scope
What it does not prove on its own:
- legal or organizational identity claims beyond reviewer policy
- timestamp trust or revocation unless those are separately anchored and checked
- completeness of evidence outside the included artifacts
A bundle can prove internal consistency. Anchored replay tests whether that consistency survives comparison to an outside continuity point.
Replay is not magic. It is a bounded comparison between package artifacts and an external anchor.
6. Next-page handoff
Next, read Verification for the deterministic procedure and verdict handling that puts this replay model into practice.