fix(certified-variables): update to certificate-verification 4 and fix broken examples

[marc0olo]

The certified-variables skill is brought up to date with @dfinity/certificate-verification 4.0.0, which peers @icp-sdk/core ^6, and with the current Rust and Motoko libraries. Every code block was compiled, deployed to a local network (icp-cli 1.5.0) and exercised end to end, and several were broken on main.

Broken on main, now fixed:

• Frontend verification did not type-check against certificate-verification 4 / core 6. The parameters are now Uint8Array, not ArrayBuffer. lookup_path returns a LookupResult, not bytes, so the old if (!leafData) check never fired. The new code switches on Found/Absent and rejects Unknown. Treating Unknown as absent would let a replica hide a real value behind a witness for a different key (new pitfall 9).
• The Motoko CertTree example did not compile. let ct = CertTree.Ops(...) fails with M0131 in a persistent actor and needs transient. The deprecated postupgrade hook is dropped.
• The Rust example failed icp deploy. It lacked ic_cdk::export_candid!(), so the Rust recipe failed with get_candid_pointer.
• Every icp canister call … get was wrong. icp-cli sends an update call unless --query is passed, so the Rust getter trapped and the Motoko getters returned certificate = null.
• The upgrade pitfall was wrong. Certified data survives upgrades (abstract-behavior.md:2690-2693, confirmed locally). What is lost is a heap tree, so Rust must rebuild it and re-set the hash, while Motoko's CertTree.Store needs nothing.
• The HTTP certification snippet was incomplete. It had no http_request handler, no witness header, and no IC-CertificateExpression header in the certified response. The last one makes ic-http-certification 4 return CertificateExpressionHeaderMissing. It is replaced by a complete minimal canister, moved to references/http-certification.md.

Updated:

• Rust: ic-cdk 0.20, ic-certification 4 (same RbTree API as ic-certified-map, and what the official examples use), ic-http-certification 4.
• New no-witness frontend path (Certificate.create + certified_data) for the single-value Motoko example, linking motoko/cert-var.
• Root key guidance now follows the ic_env cookie, or icp network status --json in Node, with the same serving-network caveat as fix(icp-cli): drop false claim that createActor ignores { agent } #405.
• Certified assets point to the static-site skill instead.

Verification (local network)

Check	Result
Rust KV (ic-certification 4 / ic-cdk 0.20), Motoko CertTree	present → value; missing → proof of absence; tampered value → throws; other key's witness → Unknown, throws
Motoko single value, verifySingleValue	value verified; tampered value throws
HTTP canister through the local gateway	200 hello. A variant serving an uncertified body is rejected with backend_response_verification; certifying without IC-CertificateExpression returns CertificateExpressionHeaderMissing
Upgrade without re-setting	Motoko single value still verifies; Rust verifies with a proof of absence after post_upgrade

Eval results (new file, all cases with baseline)

• Case 1, "Adversarial: certified getter traps when called from icp-cli": WITH 3/3 | WITHOUT 3/3. This is a regression guard for the --query pitfall.
• Case 2, "Frontend witness verification with certificate-verification 4": WITH 4/4 | WITHOUT 3/4. The baseline returns null regardless of lookup status.
• Case 3, "Adversarial: certified queries fail after a Rust canister upgrade": WITH 3/3, 3/3 | WITHOUT 1/3, 2/3. The baseline claims certified data is reset on upgrade.
• Triggers: should-trigger 3/3, should-not-trigger 2/2.

Refs #406 (its certified-variables row: the rootKey type fix is done here).

[github-actions]

Skill Validation Report

Validating skill: /home/runner/work/icskills/icskills/skills/certified-variables

Structure

• Pass: SKILL.md found
• Pass: all files in references/ are referenced

Frontmatter

• Pass: name: "certified-variables" (valid)
• Pass: description: (570 chars)
• Pass: license: "Apache-2.0"
• Pass: compatibility: (16 chars)
• Pass: metadata: (2 entries)

Tokens

• Warning: SKILL.md body is 5136 tokens (spec recommends < 5000)

Markdown

• Pass: no unclosed code fences found

Tokens

File	Tokens
SKILL.md body	5,136
references/http-certification.md	848
Total	5,984

Content Analysis

Metric	Value
Word count	2,783
Code block ratio	0.49
Imperative ratio	0.09
Information density	0.29
Instruction specificity	0.89
Sections	12
List items	34
Code blocks	9

References Content Analysis

Metric	Value
Word count	319
Code block ratio	0.64
Imperative ratio	0.00
Information density	0.32
Instruction specificity	1.00
Sections	0
List items	0
Code blocks	2

Contamination Analysis

Metric	Value
Contamination level	medium
Contamination score	0.42
Primary language category	javascript
Scope breadth	5

• Warning: Language mismatch: config, shell, systems (3 categories differ from primary)

References Contamination Analysis

Metric	Value
Contamination level	low
Contamination score	0.11
Primary language category	config
Scope breadth	3

• Warning: Language mismatch: systems (1 category differ from primary)

Result: 1 warning

Project Checks

✓ Project checks passed for 1 skills (0 warnings)