Opening
Open a Wisp
Someone handed a person a file, and that person handed it to you. You know nothing about who made it. Eleven steps handle both the honest case and the hostile one, and the order of them is the security property.
Almost every way this goes wrong is a step done early: reading the payload before consent, building before verifying, or trusting a claim because it was written confidently. The normative text is OPEN-WISP.md.
What a reader does, in order
Before step one, an AI with no prior Wisp knowledge reads this site's machine entry point, reference-kit manifest and publisher directory. It snapshots those public bytes. From step one onward, inspection and unfolding are offline.
Recognise the format from structure, not from the name
A
.wispextension is a convenience. Detection rests on the container shape and on the manifest declaring its schema and protocol version.Preflight the bytes before parsing any entry
Size and count ceilings, one archive and exactly one, path safety, and an entry profile with no encryption, no symlinks and no unread extra fields.
Read the envelope, and nothing else
Before consent a reader may look at four things: the archive listing, the manifest bytes, the signature file, and an allowlisted set of manifest fields. No payload file is opened, quoted, summarised or rendered, including the author's own build proposal.
Verify integrity
Re-canonicalize the manifest and require it to equal the bytes on disk. Check every digest, and check that the inventory and the container agree in both directions.
Classify the signature into exactly one of eight states
Four of them forbid opening. A key bundled inside the container never establishes a publisher.
Choose the projection from the tools you actually hold
Reasoning about writing a file is not writing one.
Ask once
One sentence, five elements, composed by the reader and never worded by the Wisp.
Refuse before changing anything
A conversation-only specialist writes nothing. If the selected projection needs files, its first side effect is one new folder at a path that must not already exist in any form.
Build it yourself
The initial derived instance is generated by the reader from validated declarative input. A carried resource is never run while opening; later use needs independent inspection and fresh approval for that exact effect.
Run the competence tests against the result
And report what passed, what failed, and against which build.
End with compatible, degraded or blocked, in the first sentence
Silent degradation is a conformance failure.
The four states that forbid opening
| State | May open | Publisher established |
|---|---|---|
unsigned | yes | no |
signed-unverified-publisher | yes | no |
signed-trusted | yes | yes |
signed-untrusted-key | yes | no |
invalid | no | no |
unsupported | no | no |
declared-but-missing | no | no |
signed-bundled-anchor | no | no |
The four fatal states are not weaker grades of signed. Each is positive evidence that something happened to the artifact after its author finished with it, or that the artifact is trying to establish its own publisher. A reader refuses, names the state, and does not offer to proceed anyway.
Inspect a container in this browser
This is the one page on this site that uses JavaScript, and it is optional: everything above and below reads without it.
Nowhere. The file you choose is read by this page and never sent
anywhere. There is no upload, no fetch, no beacon and no analytics call in
the inspector's source, and the page declares a content security policy of
connect-src 'none', so a network call added to it later is
blocked by your browser rather than merely absent from the code. You can
also just disconnect from the network and use it.
This page cannot open, unfold or build anything. It has no yes button, because nothing here could act on one.
You have JavaScript turned off, or it failed to start. Nothing else on this site needs it. The reference reader does the same checks and more from a terminal:
python3 -B wisp-kit-v0/wisp.py inspect ./received.wispChoose a .wisp file, or drop one here.
It is read in this browser. It is not uploaded, and it is not modified.
When you choose a file, this area fills with what was actually checked: the archive structure, every entry name, every declared digest recomputed here, the signature state, and the six fidelity layers. If any check fails, you get a refusal with a reason and no consent-shaped question at the end of it.
What the inspector does not do
- It does not unfold. There is no build, no workspace, no file written to your disk.
- It cannot establish a publisher on its own. It classifies the signature
honestly, and the only route to
signed-trustedis a key you paste in because you already had it. - It reports
not-classifiedrather than a verdict when your browser cannot check Ed25519. Not checked is a third answer, and it is never rendered as valid. - It is a port of the checks in the reference reader, not the reference reader. Where the two disagree, the reference is right and this page is the defect. The port is covered by automated vectors and a real-browser smoke test; that does not make it an independent implementation or a security audit.