Module witness 

Witness gossip protocol.

A witness is an independent third party that countersigns tree heads published by the log. Monitors verify that every witness sees the same tree head for the same tree size — if the log presents different heads to different witnesses, the monitor detects the split.

Wire format

A witness signature is over:

"ConfiumWitness/v1" || tree_size_be(8 bytes) || root_hash(32 bytes)

Witness IDs are arbitrary strings. A typical witness uses its domain name (witness.example.com) so monitors can fetch the witness’s published policy separately.

Functions

witness_signing_digest

Convenience: SHA-256 of the signing message. Some witnesses sign the digest; some sign the raw message. The monitor must know which the witness uses (per the witness’s published policy).

witness_signing_message

Build the canonical signing message for a (tree_size, root_hash) pair. Witnesses sign this; monitors verify it.