Signed tokens

Sign an encoded payload and verify its tag with constant-time comparison. This stage adds one observable capability to the project; keep every operation from earlier stages working.

Model and contract

The harness reads one JSON request from stdin. Bytes are represented as UTF-8 text or hexadecimal, and all binary output uses lowercase hexadecimal.

Representative input:

{
  "op": "verify",
  "key": "secret",
  "payload": "user=7",
  "tagHex": "f1e5fc74182d5d7550bd0bf416add2187cfeb4e5071b221f3ebd018c5a67ea47"
}

Exact output:

{ "valid": true }

The output ends with a newline. For an invalid request, leave stdout empty, write a diagnostic containing error to stderr, and exit with a non-zero status.

How to approach it

Keep input parsing, core logic, and output serialization separate. First write down the invariants behind “signed tokens”, walk through the example by hand, and exercise boundaries before optimizing. Do not replace the mechanism taught by this stage with a library function that solves it completely.

Pay particular attention to empty inputs, index or length boundaries, and malformed data. The result must be deterministic: preserve the ordering required by the request and emit compact JSON.

Acceptance criteria

• The representative input produces exactly the output shown.
• Invalid input follows the stderr and exit-status contract.
• Capabilities from earlier stages keep working.