Signed history can still be false, incomplete, stale, or unsafe.
Makoto makes exact claims attributable and tamper-evident. It does not turn every signed claim into truth. The receiver must evaluate distinct failure modes instead of treating “signature valid” as a universal pass.
| Threat | Attack | Makoto control | Residual risk |
|---|---|---|---|
| False origin claim | An authorized collector signs the wrong source URI or misleading collection metadata. | Attribution, authorization policy, exact source-artifact digest, and optional organization profile. | The source claim may still be dishonest; external observation or audit is required. |
| Artifact mutation | Data changes after its statement or handoff is signed. | Receiver hashes the bytes it actually received and matches the signed subject digest. | A malicious producer can sign already-bad bytes. |
| Metadata mutation | An intermediary edits a transformation, profile binding, or subject digest. | DSSE authenticates the exact statement payload bytes. | Valid signatures do not establish signer authorization. |
| Graph rewiring | A transformation is pointed at a different predecessor or artifact. | Each input binds predecessor statement digest, predecessor subject, and input artifact digest. | A fully re-signed alternate graph may be internally valid under a compromised authorized key. |
| Branch omission | A producer removes an inconvenient but valid branch from the presented graph. | A signed handoff commits to exact roots, heads, statements, profiles, and final artifacts. | The receiver still needs an independent expectation to know which handoff should exist. |
| Replay or rollback | An older valid handoff is presented as current. | Expected head or manifest, nonce, age policy, artifact tuple, or external transparency anchor. | Without an independent anchor, old valid evidence can look complete. |
| Signer abuse | A known key signs a claim outside its role. | Receiver-owned policy authorizes keys per source, operation, profile, and handoff role. | Policy and key revocation must be maintained outside the bundle. |
| Profile substitution | A familiar schema URI resolves to weaker bytes or omits transitive references. | Signed profile references pin the root and closure digests; receivers resolve offline from an authenticated catalog. | Policy must require the right profile for the right subject. |
| Resource exhaustion | A bundle, graph, JSON document, regex, or schema closure is crafted to exhaust the verifier. | Strict resource bounds, closed path grammar, bounded pattern vocabulary, and fail-closed diagnostics. | Implementations must apply limits before expensive work and test adversarial inputs. |
| Content hazard | Invisible Unicode, malicious formulas, PII, or poison data remains byte-for-byte intact. | Organizational profiles can constrain structured artifact content and required analysis metadata. | Integrity does not equal safety, quality, privacy, or compliance. |
The data supply-chain threat catalogue
Data pipelines face threats that software build pipelines do not: readings that were never taken, rows that changed after sign-off, lineage that skips the step that mattered, and content that passes every integrity check because it was bad when it was signed. The catalogue below names nine of them. Each entry lists the attack, the verifier check and diagnostic codes that answer it, the track level or verified property that addresses it (following the core failure-mode coverage matrix), what remains outside Makoto, and the casebook demo that runs it against real fixtures when one exists.
D1 · Source impersonation
An attacker claims data originates from a trusted source when it does not: fake sensor readings, forged API responses, spoofed device identifiers.
| Verifier control | Origin statements are signed over exact source bytes. Receiver policy authorizes origin claims per key and per sourceKinds (and optionally exact sourceUris), so a key trusted for one source cannot vouch for another. |
|---|---|
| Diagnostics | E_SIGNATURE_INVALID, E_SIGNER_UNAUTHORIZED, E_ARTIFACT_DIGEST |
| Residual risk | An authorized collector or platform can still lie. Makoto cannot establish physical truth, that a signer told the truth, or that the source was correct. |
| Level / property | Origin L1 supplies the attributable claim; Origin L2 authenticates the capture platform; MAKOTO_AUTHORIZED evaluates receiver authority, which requires an origin rule for the key and source. |
| Runnable proof | Case 06 denies an origin claim that no origin rule authorizes. |
D2 · Data tampering
Unauthorized modification of data in transit or at rest: a man-in-the-middle rewrite, storage compromise, or an injected row after sign-off.
| Verifier control | The receiver hashes the exact bytes it received and compares them with the signed subject digest. Partitioned datasets commit each entry digest and optional size through a dataset manifest. |
|---|---|
| Diagnostics | E_ARTIFACT_DIGEST, E_ARTIFACT_SIZE, E_ARTIFACT_MISSING, E_INPUT_DIGEST |
| Residual risk | A producer can sign bytes that were already bad. A historical artifact that is no longer available is reported not_checked, not verified. |
| Level / property | Origin L1 or Transform L1 plus base verification: artifact-bytes must pass. MAKOTO_GRAPH_COMPLETE supports descendant impact analysis. |
| Runnable proof | Case 01 appends one byte after signing and denies with E_ARTIFACT_DIGEST. |
D3 · Lineage falsification
False records of transformation history: a missing step, a transformation re-pointed at a different predecessor, a fabricated chain, or a cycle.
| Verifier control | Every transformation input binds the predecessor statement digest, predecessor subject name, and input artifact digest. The graph must reach declared origins without cycles, and the signed handoff commits to the exact statement, root, and head sets. |
|---|---|
| Diagnostics | E_PREDECESSOR_MISSING, E_PREDECESSOR_SUBJECT, E_INPUT_DIGEST, E_GRAPH_CYCLE, E_ROOT_INVALID, E_MANIFEST_SET; an edited binding without a new signature fails E_SIGNATURE_INVALID |
| Residual risk | A compromised authorized producer can sign a different, internally consistent graph. Transform L2 and L3 reduce but cannot eliminate that risk. Without a trusted Transform-track assessment, Makoto does not prove a described transformation executed. |
| Level / property | Transform L1; MAKOTO_GRAPH_COMPLETE. graph, roots-and-heads, and completeness-anchor must pass; an edit that breaks a signature already fails signatures. |
| Runnable proof | Case 02 removes the origin statement and rewires the final step. |
D4 · Timestamp manipulation and replay
Temporal metadata is altered to misrepresent when data was collected or handed off: backdated readings, reordered events, or an older valid handoff replayed as current.
| Verifier control | occurredAt and issuedAt are signer-asserted claims, not trusted time. Freshness comes from receiver-held anchors: an expected manifest, head set, or final-artifact set; a consumer nonce; or a maxAgeSeconds bound at a consumer-controlled evaluation time. Key validFrom and validUntil are evaluated against that evaluation time, never the signed event time, so backdating cannot restore authorization. |
|---|---|
| Diagnostics | E_EXPECTED_MANIFEST, E_EXPECTED_HEAD, E_EXPECTED_ARTIFACT, E_HANDOFF_NONCE, E_HANDOFF_STALE, E_FRESHNESS_REQUIRED |
| Residual risk | No timestamp is proven to come from a trusted clock. Transparency logs are out of scope, so rollback resistance is only as strong as the channel that delivered the expected values. |
| Level / property | Base verification; MAKOTO_FRESHNESS_ANCHORED. freshness-anchors must pass with at least one anchor method passing. The same anchors reject 800-day-old records and enforce a three-hour expiry SLO. |
| Runnable proof | No replay denial is checked in yet. Every casebook gate pins the expected manifest and head, which is the anchor this threat requires. |
D5 · Unauthorized attribution
Processing is attributed to a legitimate identity that did not perform it, or a known key signs outside its role: a stolen signing key, a compromised service account, a test key in production.
| Verifier control | Authenticity and authorization are separate checks. A statement must satisfy a receiver rule that lists its key for that predicate type, source, or operation, with a minimum signature threshold. Handoff signers are authorized separately. |
|---|---|
| Diagnostics | E_SIGNER_UNAUTHORIZED |
| Residual risk | A stolen key that the policy still authorizes passes. Revocation and identity lifecycle remain external: revocation is a local policy edit, and public revocation infrastructure is out of scope. |
| Level / property | Origin L2 or Transform L2 identifies the platform; MAKOTO_AUTHORIZED decides authority: authorization-thresholds and authorization must pass. |
| Runnable proof | Case 03 denies a byte-identical claim signed by a known but unauthorized key. |
D6 · Attestation forgery
Attestation documents are edited or substituted so they appear valid: a rewritten operation record with its old signature, an envelope swapped under an unchanged index entry, or a payload crafted to confuse a parser.
| Verifier control | DSSE signatures cover the exact payload bytes. The verifier recomputes every statement digest from decoded payload bytes before trusting the bundle index, and parses JSON strictly. |
|---|---|
| Diagnostics | E_SIGNATURE_INVALID, E_STATEMENT_DIGEST, E_ENVELOPE_MALFORMED, E_PAYLOAD_TYPE, E_JSON_DUPLICATE_KEY, E_JSON_INVALID |
| Residual risk | Key custody is a deployment responsibility. A signer with the key can produce a new, valid forgery, which is why authorization and anchors still matter. |
| Level / property | Origin L2 or Transform L2; base verification: signatures and index-payloads must pass. |
| Runnable proof | Case 04 edits a signed record two ways and denies both. |
D7 · Privacy violation
Sensitive information leaks through attestations, reports, or the data itself: source locators that reveal internal systems, extension fields with personal data, correlation across handoffs, or direct identifiers reintroduced into a public dataset.
| Verifier control | Source locators are optional and extension payloads are organization-controlled. Private profiles are exchanged separately and resolved from the receiver's local catalog with no network retrieval. A required artifact profile can reject identifiers in structured data. |
|---|---|
| Diagnostics | E_PROFILE_INVALID, E_REQUIRED_PROFILE_MISSING, E_ARTIFACT_FORMAT for content; metadata minimization has no diagnostic and is a producer obligation |
| Residual risk | Provenance is not encryption and does not make data confidential. Metadata minimization, retention, legal basis, and report handling remain producer and consumer duties; reports can contain recipient and nonce values and must be handled as sensitive evidence. |
| Level / property | Origin L3 may enforce collection minimization; MAKOTO_SCHEMA_CONFORMANT requires the digest-pinned artifact profile, so required artifact-profiles must pass. |
| Runnable proof | Case 05 denies a validly signed dataset that reintroduced email addresses. See privacy techniques. |
D8 · Stream injection
Malicious events are inserted into high-throughput streams: spoofed events, manipulated sequences, polluted windows.
| Verifier control | The reference implementation covers finite artifacts. A dataset manifest commits to an exact, sorted set of partition digests, and finite newline-delimited JSON can be validated against a profile under strict line and size bounds. |
|---|---|
| Diagnostics | E_DATASET_MANIFEST_INVALID, E_DATASET_MANIFEST_REQUIRED, E_ARTIFACT_DIGEST, E_ARTIFACT_SIZE, E_RESOURCE_LIMIT |
| Residual risk | A production streaming or windowing protocol is not part of the current release. A dataset manifest proves the producer's committed partition set, not that a storage prefix contains no other objects. |
| Level / property | No live-stream level exists. Transform L1 applies only after a finite partition is committed; base verification checks committed partitions, and artifact-bytes covers supplied partition bytes. |
| Runnable proof | None yet. This is an open area for community fixtures. |
D9 · Display-layer obfuscation
Content is materially present in artifact bytes but absent, misleading, or hard to notice in common rendered views: invisible variation selectors encoding hidden instructions, zero-width characters, bidirectional control abuse. This is not tampering or lineage falsification. It is a divergence between what humans review and what machines ingest.
| Verifier control | A render-safety scan travels as an extension of the signed claim, and a digest-pinned receiver profile requires a passing verdict. The reference producer refuses to attach a profile the claim does not satisfy, and a receiver rule with a profile constraint authorizes nothing without it. |
|---|---|
| Diagnostics | E_SIGNER_UNAUTHORIZED when no rule's profile constraint is met; E_PROFILE_INVALID when a present profile fails; E_REQUIRED_PROFILE_MISSING when a required profile is absent |
| Residual risk | The guarantee is only as good as the scanner and the profile. Content validation is normative for JSON artifacts; other formats need adapters. |
| Level / property | Origin L3 can enforce a render-safety control; MAKOTO_SCHEMA_CONFORMANT and MAKOTO_AUTHORIZED. A rule with a render-safety profile constraint must authorize the claim. |
| Runnable proof | Case 06 denies a source file carrying 128 hidden variation selectors. See the invisible Unicode example. |
Threat matrix
Severity is editorial: how much damage a successful attack does before anyone notices. The check column is the report check that fails first. The last two columns name the first useful producer track level and the receiver property that applies; “base” means ordinary verification handles it without a property.
| ID | Threat | Severity | Attack vector | Failing check | Track level | Receiver property | Proof |
|---|---|---|---|---|---|---|---|
| D1 | Source impersonation | Critical | Spoofed source identifiers, unauthorized collector keys | authorization-thresholds | Origin L1, L2 | MAKOTO_AUTHORIZED | Case 06 |
| D2 | Data tampering | Critical | Man-in-the-middle, storage compromise, injection | artifact-bytes | Origin or Transform L1 | Base; MAKOTO_GRAPH_COMPLETE | Case 01 |
| D3 | Lineage falsification | High | Removed or rewired steps, fabricated chains | graph, signatures | Transform L1 | MAKOTO_GRAPH_COMPLETE | Case 02 |
| D4 | Timestamp manipulation and replay | High | Backdated claims, replayed handoffs | freshness-anchors | None required | MAKOTO_FRESHNESS_ANCHORED | Not yet |
| D5 | Unauthorized attribution | High | Key theft, known key outside its role | authorization-thresholds | Origin or Transform L2 | MAKOTO_AUTHORIZED | Case 03 |
| D6 | Attestation forgery | Critical | Edited payloads, substituted envelopes | signatures, index-payloads | Origin or Transform L2 | Base | Case 04 |
| D7 | Privacy violation | Medium | Metadata over-sharing, reintroduced identifiers | artifact-profiles | Origin L3 | MAKOTO_SCHEMA_CONFORMANT | Case 05 |
| D8 | Stream injection | High | Event spoofing, window manipulation | artifact-bytes for committed partitions | Transform L1, committed partitions only | Base | Not yet |
| D9 | Display-layer obfuscation | High | Invisible Unicode, variation selectors, bidirectional controls | authorization-thresholds | Origin L3 | MAKOTO_SCHEMA_CONFORMANT, MAKOTO_AUTHORIZED | Case 06 |
Beyond D1–D9: the rest of the catalogue
The core coverage matrix also maps the failure modes the site's lineage page, casebook, and public talks describe. Each row names the first useful producer level and receiver property, the deterministic diagnostics, and what stays outside Makoto.
| Failure mode | Level / property | Diagnostics | Residual risk or boundary |
|---|---|---|---|
| Branch omission An inconvenient but valid branch is left out of the presented history. | Transform L1; MAKOTO_GRAPH_COMPLETE | E_MANIFEST_SET; selection mismatches use E_EXPECTED_HEAD or E_EXPECTED_MANIFEST | The producer-declared set can omit an event the receiver never independently expected. |
| Missing or null approval The author is unauthorized or an approver is absent. | Origin L3 or Transform L2; MAKOTO_AUTHORIZED and MAKOTO_SCHEMA_CONFORMANT | E_SIGNER_UNAUTHORIZED, E_PROFILE_INVALID, E_REQUIRED_PROFILE_MISSING | Makoto verifies that approval evidence satisfies policy, not that the approver made a good decision. |
| Profile substitution A familiar schema URI resolves to weaker bytes or omits transitive references. | Base; MAKOTO_SCHEMA_CONFORMANT | E_PROFILE_UNRESOLVED, E_PROFILE_INVALID, E_REQUIRED_PROFILE_MISSING, E_CATALOG_INVALID | Consumer policy must require the intended profile and protect its catalog. |
| Resource exhaustion A hostile bundle, graph, JSON, schema closure, regex, or report size. | Base, independent of track | E_RESOURCE_LIMIT; bounded optional work may warn with W_PROFILE_RESOURCE_LIMIT or W_ARTIFACT_VALIDATION_LIMIT | Limits are implementation security controls, not proof that all denial of service is impossible. |
| Content hazard A poisoned label or biased or wrong data present before signing, including SQL-like payloads, NaN values, or physically impossible readings. | Origin L3 can require declared scans; MAKOTO_SCHEMA_CONFORMANT checks only expressible policy | E_PROFILE_INVALID or E_REQUIRED_PROFILE_MISSING for declared rules | Content correctness, quality, safety, bias, and malicious-but-authorized inputs are out of scope. Passing integrity and schema checks is not a correctness claim. |
| Scientific reproducibility gap The raw version, outlier rule, tool, parameters, or intermediate evidence is missing. | Transform L1 preserves the method trace; MAKOTO_GRAPH_COMPLETE; MAKOTO_REPRODUCED only after an independent repeat | E_PREDECESSOR_MISSING, E_INPUT_DIGEST, E_ARTIFACT_MISSING, E_MANIFEST_SET; a failed repeat emits E_PROPERTY_REPRODUCED | Makoto cannot reconstruct evidence that was never captured or prove instrument calibration. Reproduction can faithfully repeat a wrong method. |
| CI job or dataset release treated as proof A green job or valid signature is mistaken for authorized provenance. | Transform L2 requires the hosted platform itself to generate and sign provenance; MAKOTO_AUTHORIZED | E_SIGNER_UNAUTHORIZED; changed bytes use E_ARTIFACT_DIGEST | CI is a trigger, not automatically the attester; compromised platform authority remains a trust risk. |
| Configuration postmortem gap Who, what, and when exist, but exact configuration or affected outputs are not bound. | Transform L1; MAKOTO_GRAPH_COMPLETE | E_INPUT_DIGEST, E_PREDECESSOR_MISSING, E_ARTIFACT_MISSING, E_SIGNATURE_INVALID | Human intent, the wisdom of the change, alerting, and root-cause judgment remain external. |
| Schema drift or missing IDs A source ID, ingestion timestamp, or run ID is missing. | Origin L3 or Transform L1; MAKOTO_SCHEMA_CONFORMANT | E_PROFILE_INVALID, E_REQUIRED_PROFILE_MISSING | A syntactically present ID or timestamp can still be false. These fields remain use-case profiles, not universal core requirements. |
| Wrong chatbot answer The assistant quotes a 365-day policy when the real policy is 30 days. | Origin and Transform tracks preserve provenance; MAKOTO_FRESHNESS_ANCHORED, MAKOTO_AUTHORIZED, and MAKOTO_GRAPH_COMPLETE identify stale or untrusted inputs | Missing lineage: E_PREDECESSOR_MISSING, E_INPUT_DIGEST, E_MANIFEST_SET. Stale or unexpected: E_HANDOFF_STALE, E_EXPECTED_MANIFEST, E_EXPECTED_HEAD, E_EXPECTED_ARTIFACT. Unauthorized: E_SIGNER_UNAUTHORIZED | Makoto cannot decide which policy text is substantively correct or whether the model interpreted it correctly. A downstream correctness evaluator must make that judgment. |
| Inference or post-training lineage breaks from the training anchor Outputs can no longer be traced to the model and data that produced them. | Transform L1; MAKOTO_GRAPH_COMPLETE | E_PREDECESSOR_MISSING, E_PREDECESSOR_SUBJECT, E_INPUT_DIGEST, E_MANIFEST_SET | Runtime nondeterminism and model semantic behavior require separate evidence; sensitive prompts may need privacy-preserving references. |
| Copies lose blast-radius evidence Object storage, warehouse marts, a feature store, backups, vendor SaaS, or an old notebook hold untraced copies. | Transform L1; MAKOTO_GRAPH_COMPLETE | E_PREDECESSOR_MISSING, E_INPUT_DIGEST, E_MANIFEST_SET; a copy never presented to Makoto has no diagnostic | Copies made outside the evidence graph are invisible. Makoto is not a universal discovery system. |
| Deletion or retention policy lost downstream A retention rule does not travel with the copies. | Origin L3 may require a retention or SLO profile; MAKOTO_SCHEMA_CONFORMANT carries it through declared handoffs | E_REQUIRED_PROFILE_MISSING, E_PROFILE_INVALID | Makoto records obligations and custody; it cannot delete unknown copies or prove a storage system honored deletion. |
| The exact bytes that trained a model are unknown A table name or path stands in for the training input. | Origin L1 plus Transform L1; MAKOTO_GRAPH_COMPLETE | E_ARTIFACT_DIGEST, E_ARTIFACT_MISSING, E_INPUT_DIGEST, E_PREDECESSOR_MISSING, E_MANIFEST_SET | A digest identifies bytes, not whether the data was representative, licensed, or correct. |
| Custody or downstream policy is ambiguous Who made, approved, or may use each copy is unclear. | Origin L3 for capture controls and Transform L2 for platform identity; MAKOTO_AUTHORIZED and MAKOTO_SCHEMA_CONFORMANT | E_SIGNER_UNAUTHORIZED, E_PROFILE_INVALID, E_REQUIRED_PROFILE_MISSING | Organizational responsibility and legal accountability are broader than cryptographic identity. |
| A step silently changes the dataset Normalization, filtering, enrichment, redaction, or newline conversion changes bytes. | Transform L1; MAKOTO_GRAPH_COMPLETE; base artifact checks | E_ARTIFACT_DIGEST, E_INPUT_DIGEST, E_MANIFEST_SET | Makoto shows that bytes changed and under which claim; it does not decide whether the change preserved intended meaning. |
The correctness boundary. Makoto will never certify data-content correctness. A downstream process can consume Makoto's exact origin, operation, signer, graph, profile, and artifact identities, run its own tests, review, or evaluation, and bind that result to the same digests in a separate attestation. See handing off to a correctness process.
Attack surface by pipeline stage
Every stage of a data pipeline is an attack surface. Makoto does not harden the stage; it gives the receiver a verification point that exposes what happened there.
| Stage | Threats | Where the receiver catches it |
|---|---|---|
| Source | D1 impersonation, D9 hidden content | Origin rule authorization and required origin profiles. |
| Transport | D2 tampering, D4 replay | Artifact digests over received bytes; expected manifest, head, nonce, or age bound. |
| Processing | D3 lineage falsification, D5 unauthorized attribution | Predecessor and input bindings; per-operation signer rules. |
| Storage and archive | D6 forgery, D2 tampering at rest | Signature and statement-digest recomputation on every re-verification. |
| Consumer | D7 privacy, D8 injected partitions | Required artifact profiles and dataset-manifest entry checks. |
Trust boundaries stay outside the bundle
- Signing keysPrivate keys and production signing policy are deployment responsibilities. Demo keys are intentionally insecure fixtures.
- AuthorizationThe receiver supplies policy; the producer does not get to declare itself trusted.
- Expected stateFreshness requires an expected head, manifest, nonce, artifact, age, or transparency record learned independently.
- Schema catalogPrivate profiles remain private and are resolved from authenticated local bytes, never ambient network lookup during verification.
Software supply chain versus data supply chain
SLSA addresses software build integrity. Makoto addresses the threats specific to data moving between producers and receivers. They share principles and differ in focus.
SLSA threats (software)
- Compromised source repository
- Modified source after checkout
- Compromised build platform
- Uploaded modified package
- Compromised package registry
- Dependency confusion
- Compromised build dependencies
Makoto threats (data)
- D1 Source impersonation
- D2 Data tampering in transit or at rest
- D3 Lineage falsification
- D4 Timestamp manipulation and replay
- D5 Unauthorized attribution
- D6 Attestation forgery
- D7 Privacy violation
- D8 Stream injection
- D9 Display-layer obfuscation
Shared principles and real differences
- Attestation-based. Both express provenance as verifiable claims about exact artifacts.
- Same envelope. Makoto statements are in-toto Statements carried in DSSE envelopes.
- Tamper-evident. Exact-byte SHA-256 digests make modification detectable.
- Receiver-owned policy. Makoto's receiver decides which keys may make which claims; the bundle never declares itself trusted.
- Tracks and verified properties. Both separate producer tracks with cumulative levels from receiver results carried in a Verification Summary Attestation. Makoto has Origin and Transform tracks, and a denied handoff still shows exactly which check stopped it. See the comparisons.
Defense in depth
- Detection (Origin and Transform L1)Exact-byte digests expose any change to statement payloads and to received artifacts.
- Authentication (L2 platforms)DSSE signatures bind each statement and handoff to a key; at L2 that key belongs to a hosted platform, not a person.
- Authorization (
MAKOTO_AUTHORIZED)Receiver policy limits each key to the sources, operations, profiles, and handoffs it may sign. - Completeness and freshness (
MAKOTO_GRAPH_COMPLETE,MAKOTO_FRESHNESS_ANCHORED)A signed handoff defeats omission; an independent anchor defeats replay. - Content policy (
MAKOTO_SCHEMA_CONFORMANT, Origin L3)Digest-pinned private profiles reject unchanged bytes that were never acceptable, and Origin L3 enforces them at capture. - PrivacyMinimized metadata and separately exchanged profiles limit what evidence discloses.
A threat becomes useful when it has one exact mutation and one expected denial.
The reference demo already covers artifact mutation, signature failure, predecessor removal, rewiring, private-profile violation, and unauthorized signers, and the casebook runs each through a real gate. Replay and stream injection still need fixtures. Add the case it missed.