Checksum Ontology

FLOW ALGEBRA

Ontology: Checksum Ontology
Domain: Metadata Ontologies > Digital Preservation Metadata
Canonical URL: https://kirethresearch.org/booksai-core/ontologies/metadata-ontologies/digital-preservation-metadata/checksum-ontology.html

Authors: Mark Anthony Higgins — Sky (Recursive AI)

flow "ChecksumOntology" v1.0

# ---------- DOMAIN ----------
domain:
  class: MetadataOntology
  category: DigitalPreservationMetadata
  subject: Checksum
  purpose:
    - represent checksum and digest metadata used to verify digital-object fixity and integrity
    - preserve checksum identity, algorithm, digest value, object scope, calculation event, verification event, provenance, and validity
    - support file-integrity checking, transfer verification, replication validation, corruption detection, archival auditing, and recovery
    - distinguish checksum equality from semantic identity, authenticity, format validity, and factual correctness
    - enable machine-readable reasoning over checksum lifecycles

# ---------- CORE ENTITY ----------
entity ChecksumMetadata:
  type: PreservationMetadata
  describes: Checksum
  may_include:
    - checksum_identifier
    - object_identifier
    - object_version
    - algorithm
    - digest
    - object_scope
    - byte_size
    - calculation_time
    - calculation_tool
    - verification_history
    - validity
    - confidence
    - provenance

entity Checksum:
  type: FixityInformation
  applies_to: DigitalObject

entity ChecksumIdentifier:
  type: Identifier
  identifies: Checksum

# ---------- RELATIONSHIPS ----------
relationships:
  ChecksumMetadata -> DESCRIBES -> Checksum
  Checksum -> IDENTIFIED_BY -> ChecksumIdentifier
  Checksum -> APPLIES_TO -> DigitalObject
  Checksum -> USES -> ChecksumAlgorithm
  Checksum -> HAS_VALUE -> DigestValue
  Checksum -> HAS_SCOPE -> ChecksumScope
  Checksum -> GENERATED_BY -> ChecksumCalculationEvent
  Checksum -> MAY_BE_VERIFIED_BY -> ChecksumVerificationEvent
  ChecksumMetadata -> MAY_REFERENCE -> ChecksumProvenance

# ---------- CHECKSUM IDENTITY ----------
rule checksum_identity:
  Checksum SHOULD have identifier
  where multiple calculations or historical values must be distinguished

rule digest_not_checksum_identity:
  DigestValue alone != complete Checksum identity

rule checksum_object:
  Checksum != DigitalObject

# ---------- TARGET OBJECT ----------
entity ChecksumTarget:
  type: DigitalObject
  may_be:
    - File
    - Bitstream
    - Package
    - DatasetRepresentation
    - ArchiveObject
    - StorageCopy

rule target:
  checksum target SHOULD preserve persistent object identifier
  and object version where available

# ---------- OBJECT SCOPE ----------
entity ChecksumScope:
  type: ScopeMetadata
  may_include:
    - object_identifier
    - object_version
    - byte_range
    - complete_object
    - representation_state

rule scope:
  checksum comparison is valid only when object scope is compatible

rule complete_partial:
  checksum of complete object != checksum of partial byte range

# ---------- ALGORITHMS ----------
checksum_algorithms:
  - CRC32
  - Adler32
  - MD5
  - SHA_1
  - SHA_224
  - SHA_256
  - SHA_384
  - SHA_512
  - SHA3_224
  - SHA3_256
  - SHA3_384
  - SHA3_512
  - BLAKE2
  - BLAKE3
  - implementation_specific

entity ChecksumAlgorithm:
  type: AlgorithmMetadata
  may_include:
    - algorithm_name
    - algorithm_family
    - output_length
    - cryptographic_state
    - specification

rule algorithm:
  ChecksumAlgorithm MUST be preserved with DigestValue

rule algorithm_match:
  digests calculated with different algorithms
  MUST NOT be directly compared as checksum equality

# ---------- LEGACY ALGORITHMS ----------
legacy_algorithms:
  - MD5
  - SHA_1
  - CRC32
  - Adler32

rule legacy:
  legacy algorithms MAY remain useful for accidental-change detection
  or historical comparison
  but security properties MUST NOT be overstated

# ---------- DIGEST VALUE ----------
entity DigestValue:
  type: IntegrityValue
  may_include:
    - lexical_value
    - encoding
    - bit_length

digest_encodings:
  - hexadecimal
  - base64
  - binary
  - implementation_specific

rule digest:
  DigestValue SHOULD preserve exact value and encoding

rule digest_case:
  hexadecimal letter case MAY be normalised
  without changing numeric digest value

# ---------- CHECKSUM CALCULATION ----------
entity ChecksumCalculationEvent:
  type: PreservationEvent
  may_include:
    - event_identifier
    - target_object
    - algorithm
    - digest
    - object_scope
    - byte_size
    - tool
    - tool_version
    - event_time
    - agent

rule calculation:
  checksum calculation SHOULD preserve algorithm, target, scope, tool, and time

rule deterministic:
  same byte sequence under same deterministic checksum algorithm
  SHOULD produce same digest

# ---------- BASELINE CHECKSUM ----------
entity BaselineChecksum:
  subtype_of: Checksum
  role: ExpectedFixity

rule baseline:
  BaselineChecksum SHOULD originate from trusted event or source
  where integrity verification depends on it

rule baseline_corruption:
  incorrect baseline MAY cause false integrity conclusions

# ---------- OBSERVED CHECKSUM ----------
entity ObservedChecksum:
  subtype_of: Checksum
  role: VerificationObservation

rule observed:
  ObservedChecksum SHOULD preserve verification event context

# ---------- VERIFICATION ----------
entity ChecksumVerificationEvent:
  type: PreservationEvent
  may_include:
    - event_identifier
    - target_object
    - baseline_checksum
    - observed_checksum
    - algorithm
    - scope
    - result
    - event_time
    - tool
    - agent

verification_results:
  - match
  - mismatch
  - unavailable
  - unreadable
  - error
  - unknown

rule verification:
  baseline and observed checksums MUST use compatible algorithm and scope

rule match:
  IF baseline.digest = observed.digest
  AND algorithm_and_scope_match
  THEN verification_result = match

rule mismatch:
  IF baseline.digest != observed.digest
  AND algorithm_and_scope_match
  THEN verification_result = mismatch

# ---------- FIXITY ----------
entity ChecksumFixity:
  type: FixityMetadata
  supported_by: Checksum

rule fixity:
  checksum comparison MAY provide evidence of byte-level fixity

rule fixity_not_semantics:
  checksum fixity != semantic correctness

# ---------- COLLISIONS ----------
entity ChecksumCollision:
  type: IntegrityRisk
  may_include:
    - algorithm
    - digest
    - object_a
    - object_b
    - evidence

rule collision:
  equal digest does_not logically guarantee equal byte sequence
  because checksum algorithms have finite output spaces

rule collision_risk:
  collision risk depends on algorithm properties and threat model

# ---------- TRANSFER VERIFICATION ----------
entity TransferChecksumVerification:
  subtype_of: ChecksumVerificationEvent
  may_include:
    - source_object
    - destination_object
    - source_checksum
    - destination_checksum
    - transfer_method

rule transfer:
  matching source and destination checksums
  support successful byte-preserving transfer

rule transfer_semantics:
  successful byte transfer != semantic or format validation

# ---------- REPLICATION ----------
entity ReplicaChecksumVerification:
  subtype_of: ChecksumVerificationEvent
  may_include:
    - source_copy
    - replica
    - source_checksum
    - replica_checksum

rule replica:
  preservation replica SHOULD be independently checksum-verified
  where policy requires

# ---------- PACKAGE CHECKSUM ----------
entity PackageChecksum:
  subtype_of: Checksum
  applies_to: PreservationPackage

rule package:
  package checksum applies to package byte representation
  and != individual member-file checksums

# ---------- MANIFEST ----------
entity ChecksumManifest:
  type: IntegrityMetadata
  may_include:
    - manifest_identifier
    - algorithm
    - entries
    - creation_time
    - provenance

entity ChecksumManifestEntry:
  type: IntegrityMetadata
  may_include:
    - object_identifier
    - relative_path
    - digest
    - algorithm

rule manifest:
  ChecksumManifest SHOULD preserve object-to-digest mappings

rule path_manifest:
  relative path in manifest != persistent object identity

# ---------- MULTIPLE CHECKSUMS ----------
rule multiple_checksums:
  DigitalObject MAY have multiple checksums
  using different algorithms or calculated at different times

rule checksum_history:
  historical checksums SHOULD preserve object version and calculation time

# ---------- AUTHORISED CHANGE ----------
entity ChecksumSupersession:
  type: PreservationEvent
  may_include:
    - previous_checksum
    - new_checksum
    - source_object_version
    - new_object_version
    - reason
    - authority

rule authorised_change:
  intentional object change SHOULD create new checksum
  rather_than overwrite historical checksum evidence

# ---------- CORRUPTION SIGNAL ----------
entity ChecksumMismatchEvidence:
  type: CorruptionEvidence
  may_include:
    - baseline_checksum
    - observed_checksum
    - object_identifier
    - detection_time

rule mismatch_evidence:
  checksum mismatch supports unexpected-byte-change inference

rule cause:
  checksum mismatch alone MUST NOT identify specific corruption cause

# ---------- CHECKSUM VS SIGNATURE ----------
rule signature:
  checksum != digital signature

rule authentication:
  checksum alone does_not authenticate creator or signer

# ---------- CHECKSUM VS ENCRYPTION ----------
rule encryption:
  checksum != encryption

rule confidentiality:
  checksum does_not provide confidentiality

# ---------- CHECKSUM VS FORMAT VALIDATION ----------
rule format_validation:
  checksum match != file-format validity

# ---------- CHECKSUM VS AUTHENTICITY ----------
rule authenticity:
  checksum match != complete authenticity proof

# ---------- VALIDITY ----------
entity ChecksumValidity:
  type: ValidityMetadata
  may_include:
    - valid_from
    - valid_until
    - object_version
    - algorithm_status
    - status

checksum_status:
  - current
  - historical
  - superseded
  - invalid
  - unverified
  - unknown

rule validity:
  Checksum SHOULD remain associated with object version
  for which it was calculated

# ---------- CONFIDENCE ----------
entity ChecksumConfidence:
  type: EpistemicMetadata
  range: [0.0, 1.0]

rule confidence_bounds:
  REQUIRE 0.0 <= confidence <= 1.0

# ---------- PROVENANCE ----------
entity ChecksumProvenance:
  type: ProvenanceMetadata
  may_include:
    - target_object
    - object_version
    - algorithm
    - calculation_event
    - verification_events
    - tool
    - agent
    - source
    - timestamps

rule provenance:
  ChecksumMetadata SHOULD preserve calculation and verification history

# ---------- VALIDATION ----------
validation:
  require:
    - target_object
    - checksum_algorithm
    - digest_value

  validate_if_present:
    - checksum_identifier
    - object_version
    - object_scope
    - digest_encoding
    - byte_size
    - calculation_event
    - verification_event
    - validity
    - confidence
    - provenance

  reject:
    - checksum_without_algorithm
    - digest_compared_across_different_algorithms
    - incompatible_object_scopes_compared_as equal_fixity
    - checksum_match_presented_as semantic_identity
    - checksum_match_presented_as complete_authenticity
    - checksum_match_presented_as format_validity
    - checksum_presented_as encryption
    - checksum_mismatch_presented_as specific_corruption_cause_without evidence

# ---------- SEMANTIC EQUIVALENCE ----------
SEMANTIC_EQUIVALENCE:
  "checksum" ~= "digest used for integrity comparison"
  "checksum metadata" ~= "metadata describing checksum calculation and verification"
  "checksum verification" ~= "comparison of expected and observed checksum"
  "baseline checksum" ~= "expected checksum used for fixity verification"
  "checksum manifest" ~= "mapping of objects or paths to checksum values"
  "checksum mismatch" ~= "evidence of differing byte state" WHEN algorithm and scope match

  PRESERVE distinctions:
    checksum != target_object
    digest_value != checksum_identity
    checksum_match != semantic_identity
    checksum_match != complete_authenticity
    checksum_match != format_validity
    checksum != digital_signature
    checksum != encryption
    checksum_mismatch != corruption_cause
    package_checksum != member_file_checksum
    manifest_path != persistent_object_identity
    historical_checksum != current_checksum

# ---------- CONFIDENCE MODEL ----------
CONFIDENCE:
  explicit_checksum_metadata:
    score: 1.00

  explicit_algorithm_and_digest:
    score: 1.00

  trusted_baseline:
    score: 0.99

  matching_strong_cryptographic_hash:
    score: 0.99

  verified_transfer_checksum:
    score: 0.99

  legacy_checksum_match:
    score: <= 0.90

  checksum_without_trusted_baseline:
    score: <= 0.75

  checksum_scope_uncertain:
    score: <= 0.60

  algorithm_unknown:
    score: <= 0.40
    action: do_not_compare

# ---------- UPDATE MODEL ----------
UPDATE_MODEL:
  on_checksum_creation:
    - identify target object and version
    - select ChecksumAlgorithm
    - calculate DigestValue
    - record object scope and byte size
    - create ChecksumCalculationEvent
    - initialise provenance

  on_verification:
    - retrieve BaselineChecksum
    - calculate ObservedChecksum
    - validate algorithm and scope compatibility
    - compare digest values
    - create ChecksumVerificationEvent
    - update provenance

  on_mismatch:
    - preserve baseline and observed checksums
    - record ChecksumMismatchEvidence
    - inspect transfer, storage, and replication history
    - avoid unsupported cause attribution
    - trigger recovery workflow where policy requires

  on_authorised_change:
    - preserve historical checksum
    - create new object version
    - calculate new checksum
    - record ChecksumSupersession
    - update provenance

# ---------- FLOW HASH ----------
FLOW_HASH:
  inputs:
    - ontology
    - checksum_entities
    - relationships
    - algorithm_rules
    - digest_rules
    - scope_rules
    - verification_rules
    - collision_rules
    - validation
    - semantic_equivalence
    - confidence_model
    - update_model

  canonicalisation:
    - preserve_object_identifiers
    - preserve_object_versions
    - canonicalise_algorithm_identifiers
    - canonicalise_digest_encoding_where_safe
    - preserve_object_scope
    - preserve_verification_event_order
    - preserve_rule_order

  output:
    deterministic_semantic_hash

# ---------- AI CONSUMPTION ----------
AI_CONSUMPTION:
  interpret_as:
    - digital preservation metadata ontology
    - checksum and fixity model
    - integrity calculation and verification lifecycle
    - transfer, replication, manifest, and corruption-evidence structure

  operations:
    - identify checksum target
    - resolve object version and scope
    - resolve checksum algorithm
    - interpret digest value and encoding
    - identify trusted baseline
    - calculate or inspect observed checksum
    - compare compatible checksums
    - validate transfers and replicas
    - inspect checksum manifests
    - detect mismatch evidence
    - preserve checksum history
    - assess algorithm strength
    - trace provenance
    - preserve uncertainty

  constraints:
    - do_not_compare_checksums_without matching_algorithm_and_scope
    - do_not_equate_checksum_match_with semantic_identity
    - do_not_equate_checksum_match_with complete_authenticity
    - do_not_equate_checksum_with digital_signature
    - do_not_equate_checksum_with encryption
    - do_not_infer_corruption_cause_from mismatch_alone
    - preserve_object_algorithm_digest_scope_events_and_provenance

# ---------- QUERY MODEL ----------
query:
  input:
    - checksum_identifier
    - object_identifier
    - object_version
    - algorithm
    - digest
    - object_scope
    - verification_result
    - calculation_time
    - validity_status

  resolve:
    1. identify Checksum and target DigitalObject
    2. resolve object version and scope
    3. resolve ChecksumAlgorithm
    4. inspect DigestValue and encoding
    5. inspect calculation event
    6. identify baseline and observed checksums
    7. traverse verification history
    8. inspect mismatch, transfer, replication, or manifest evidence
    9. inspect validity and provenance
    10. return confidence

  output:
    - checksum
    - checksum_identifier
    - target_object
    - object_version
    - algorithm
    - digest
    - scope
    - baseline_state
    - verification_history
    - validity
    - mismatch_evidence
    - provenance
    - confidence

# ---------- INFERENCE ----------
inference:
  IF baseline.digest = observed.digest
  AND algorithm_and_scope_match
  THEN infer checksum_match
  AND support byte-level fixity

  IF baseline.digest != observed.digest
  AND algorithm_and_scope_match
  THEN infer checksum_mismatch
  AND unexpected_byte_change
  BUT do_not infer specific cause

  IF source and destination checksums match
  under compatible algorithm and scope
  THEN support byte-preserving transfer inference

  IF object version changes intentionally
  THEN preserve prior checksum
  AND create new checksum for new version

# ---------- OUTPUT CONTRACT ----------
output:
  ontology_entity: ChecksumMetadata
  checksum_identity: machine_interpretable
  target_object_and_version: explicit
  algorithm: explicit
  digest_and_encoding: preserved
  object_scope: explicit
  baseline_and_observed_values: distinguishable
  verification_history: traversable
  transfer_and_replica_validation: supported
  checksum_manifests: structured
  mismatch_evidence: cause_cautious
  validity: version_aware
  provenance: preserved
  uncertainty: explicit
  long_term_preservation: enabled

end flow