README.md

@@ -12,14 +12,20 @@ It registers one provider, `signature`, for the `signed-webdav` scheme.
 
 ## Connecting
 
-| Field | Meaning |
+![The connection form](https://git.capsulizers.com/commons/memona-plugin-signature/raw/branch/main/images/connection-form.png)
-| --- | --- |
+
-| Server address | The folder's address, for example `https://dav.example.com/files/` |
+| Field | Key | Meaning |
-| Username | Optional account name for HTTP basic authentication |
+| --- | --- | --- |
-| Password | Optional password, stored as a secret |
+| Server address | `url` | The folder's address, for example `https://dav.example.com/files/` |
-| Signer name | The ENS name that signs, for example `laptop.alice.eth` |
+| Username | `username` | Optional account name for HTTP basic authentication |
-| Signing key | The private key of the address the name resolves to, stored as a secret |
+| Password | `password` | Optional password, stored as a secret |
-| Sepolia RPC address | The endpoint used to check signers against ENS, by default `https://ethereum-sepolia-rpc.publicnode.com` |
+| Signer name | `ensName` | The ENS name that signs, for example `laptop.alice.eth` |
+| Signing key | `privateKey` | The private key of the address that owns the name, stored as a secret |
+| Sepolia RPC address | `rpcUrl` | The endpoint used to check signers against ENS, by default `https://ethereum-sepolia-rpc.publicnode.com` |
+| Trusted parent name | `trustedParent` | Optional. Only signers that are this name or one of its subnames count, for example `team.eth` |
+
+The connection's allowed hosts must include the RPC address's host as well as
+the server's, or every check reads as Sepolia unreachable.
 
 Listing, reading, writing, creating directories, renaming and deleting behave
 as in the WebDAV plugin: reads and writes stream in pieces of at most 1 MiB,
@@ -36,15 +42,44 @@ and the body's SHA-256, made with the configured key; other frontmatter and the
 body stay byte for byte. A key that is not 32 bytes of hex refuses the
 connection, and a `.md` file that is not UTF-8 refuses the save.
 
+![A note saved in Memona, signed and verified](https://git.capsulizers.com/commons/memona-plugin-signature/raw/branch/main/images/after-save.png)
+
 ## Verifying
 
-Reading a `.md` file of up to 40 KiB checks its signature against ENSv2 on
+Reading a `.md` file checks its signature against ENSv2 on Sepolia and adds an
-Sepolia through the RPC address and adds an `ens-verification` line to the
+`ens-verification` line to the frontmatter Memona receives, which Memona shows
-frontmatter Memona receives, which Memona shows as a badge; a larger one up to
+as a badge. The owner of the signer name comes from the Universal Resolver's
-1 MiB is marked as not checked. Both limits keep hashing and key recovery
+`findOwner`, so a name its parent revoked stops counting at once.
-inside the instruction budget Memona gives each call. The line never
+
-reaches the server: a save drops it before signing, and one stored on the
+| Badge | Meaning |
-server is replaced. Verdicts are reused for 30 seconds per signed body.
+| --- | --- |
+| `Verified: bob.team.eth` | The name's current owner signed this exact body |
+| `Tampered: signed as bob.team.eth` | The body changed after signing, or another key signed it |
+| `Unauthorized: bob.team.eth is not registered` | The signature holds, but no one owns the name now: it was revoked or never granted |
+| `Unauthorized: bob.team.eth is not a member of team.eth` | The signer is outside the trusted parent name |
+| `Unsigned` | The file has no `signer` and `signature` |
+| `Not checked: Sepolia unreachable` | The RPC address did not answer, so nothing was decided |
+| `Not checked: file too large` | The file is over 40 KiB, too large to hash within one call |
+
+| Verified | Tampered |
+| --- | --- |
+| ![Verified](https://git.capsulizers.com/commons/memona-plugin-signature/raw/branch/main/images/verified.png) | ![Tampered](https://git.capsulizers.com/commons/memona-plugin-signature/raw/branch/main/images/tampered.png) |
+
+| Unauthorized | Unsigned |
+| --- | --- |
+| ![Unauthorized](https://git.capsulizers.com/commons/memona-plugin-signature/raw/branch/main/images/unauthorized.png) | ![Unsigned](https://git.capsulizers.com/commons/memona-plugin-signature/raw/branch/main/images/unsigned.png) |
+
+The line never reaches the server: a save drops it before signing, and one
+stored on the server is replaced, so a file cannot claim its own verdict.
+Verdicts are reused for 30 seconds per signed body, a failed lookup included,
+so an editor rereading a file does not flood the RPC. Stat, list and saves
+keep reporting the stored size and the server's etag, so `If-Match` works as
+before.
+
+Memona gives each call into a plugin a fixed instruction budget, which is where
+the size limits come from: checking hashes the body and recovers a key, so it
+covers files up to 40 KiB; a file up to 1 MiB is marked not checked, and a
+larger one streams through without a badge.
 
 ## Building
 

manifest.json

@@ -44,7 +44,7 @@
         {
           "key": "privateKey",
           "label": "Signing key",
-          "description": "The private key of the address this name resolves to",
+          "description": "The private key of the address that owns this name",
           "kind": "password",
           "required": true
         },