kairos-chain 3.46.0 → 3.47.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 372dd921a298d45c97b957ae724a253bb22da73b5bb211025fe894eab5de4ff7
-  data.tar.gz: f15e37a2caeef2d4d08b92f49608aa52307b1a93124a1742d3f40c10ae145bf8
+  metadata.gz: e43541279a3d104b85372574c94f6fdf2d96188fb7de83d5a4d84c3f470634d7
+  data.tar.gz: 21b58d11561dd6d4177a7aa3d3832bdfe4fbde80ff2da2af198662d655a6fc81
 SHA512:
-  metadata.gz: c9fc60d9acee8dcb8b7a2bfb43021d3c8b129cb94471fe8488092683ade4755665faa72860fb8c1bed77d254e977226c3d8cd85bec4dfe95eea2d0dc12352190
-  data.tar.gz: e5769c4b23ce1daef9704423f41e097d8969f5b86442ab1592beab4e3dc7623a3a79e30aba51d7ca2d5621e55fd635db740b5489761995bc2b9b33de8eb0b80e
+  metadata.gz: 41bc6c95594567c2e80ed006ea2bd21e7926361bf3cfb14fdf5a6b0a4aac17b9dca3f65faf17be1a4e86b16ce3fb9285af121d747fcdeac66eca58857d4af0bd
+  data.tar.gz: 77a5ac53384830598e90b408b4c737eb8549c219dfdeb47c38feb5939c46829c2b53dc9744da1a9914033521ff1fdf126f8d941989fe62857316863a75790e5f

data/CHANGELOG.md

@@ -4,6 +4,47 @@ All notable changes to the `kairos-chain` gem will be documented in this file.
 
 This project follows [Semantic Versioning](https://semver.org/).
 
+## [3.47.0] - 2026-07-22
+
+### Synoptis — selective disclosure sdp-1 (AUD-L4 slice 1)
+
+Implements AUD-L4 design v0.3 (SDP-1..5, FROZEN, review-converged) slice 1
+in the synoptis SkillSet. All additive: sdp-1 builds on khab-1/map-1/rpr-1
+exactly as each prior slice built on its predecessors; no pre-existing file
+changed.
+
+- `conventions/sdp-1.md`: content-addressed selective-disclosure convention —
+  hash-based salted field-level disclosure (content-blinding: field values
+  hidden, record digest / field names / count public; the ZK membership
+  family is disclosed as out of scope for a later convention). Field
+  commitments (one salted digest per field, total coverage, `sdp-1/field`
+  domain separation), convention-determined disclosure profile (closed
+  schema; predicate + opened set + currency, `format` always opened),
+  presentation (closed schema per shape), three predicates
+  (typed-existence / claimed-verdict / conforming-verdict with foreignness,
+  anterior-tolerance assessment, and sibling-aware tolerance-target
+  coherence inside the checked predicate), extent-bounded currency scan
+  (issuer rule, residues disclosed unconditionally), computational
+  hiding/soundness base stated (no trusted setup).
+- `selective_disclosure.rb`: build/parse/verify for field commitments,
+  profile, presentation (refuse-not-coerce, canonical-serialization
+  equality everywhere); signature verification from the record DIGEST alone
+  via the unchanged map-1 §1.1 attestation signature — blinded verdicts
+  without record content; conforming-verdict refuses (never degrades) when
+  operator credential or rpr-1 §2.1 assessment material is missing;
+  currency scan with unestablished-vs-unretracted discipline.
+- `bin/sdp_verify.rb`: offline verifier (commit / binding / presentation /
+  profile / currency / convention), exit-code discipline (0/1/2), strict
+  intake (delete_suffix, canonical numerals).
+- `test/test_sdp_disclosure.rb`: 61 design-constraint assertions
+  (SDP-1..5), including crafted-record shape refusal, verdict-vocabulary
+  closure, sibling-target coherence (rpr-1 §2.1 pooling agreement),
+  hiding of withheld values across artifacts and error paths, and
+  khab/map/rpr non-interference (37/75/76/88 regression green).
+
+Implementation review: 3 rounds, R3 4/6 APPROVE + executable-probe
+personas 2/2, zero remaining P0/P1 (dispositions in docs/drafts/).
+
 ## [3.46.0] - 2026-07-22
 
 ### Synoptis — reproduction endorsement rpr-1 (AUD-L3 slice 1)

data/lib/kairos_mcp/version.rb

@@ -1,4 +1,4 @@
 module KairosMcp
-  VERSION = "3.46.0"
+  VERSION = "3.47.0"
   CHANGELOG_URL = "https://github.com/masaomi/KairosChain_2026/blob/main/CHANGELOG.md"
 end

data/templates/skillsets/synoptis/bin/sdp_verify.rb

@@ -0,0 +1,174 @@
+#!/usr/bin/env ruby
+# frozen_string_literal: true
+
+# sdp_verify — offline verifier for sdp-1 selective-disclosure artifacts
+# (SDP-1..5, aud_l4_selective_disclosure_design v0.3).
+#
+# Verifies with EXACTLY the disclosed trust base: the artifacts named on the
+# command line plus the shipped sdp-1, rpr-1, and map-1 convention
+# definitions. No registry, no network, no producer cooperation. (Authentic
+# chain/log views are the caller's inputs; their integrity is the
+# khab-1/map-1 surfaces' business.)
+#
+# Usage:
+#   sdp_verify.rb commit  <record.json> [salts.json]
+#       builds the sdp-1 field-commitments auxiliary for a canonical record;
+#       prints the auxiliary record and (fresh or supplied) salts as JSON.
+#   sdp_verify.rb binding <aux.json> <record.json> <salts.json>
+#       checks the SDP-2 binding: every field digest and the record digest
+#       recompute from record + salts.
+#   sdp_verify.rb presentation <presentation.json> [operator_credential.json] [assessment.json]
+#       verifies a presentation. conforming-verdict REQUIRES both extras;
+#       assessment.json = {"targets":[...record strings...],
+#                          "declarations":[{"tolerance":"...","position":N}...],
+#                          "endorsement_position":N}.
+#   sdp_verify.rb profile <presentation.json>
+#       prints the disclosure profile and what it does/does not show.
+#   sdp_verify.rb currency <entries.json> <carrier_entry_hash> <extent>
+#       runs the sdp-1 §5 retraction scan over a supplied entry view.
+#   sdp_verify.rb convention
+#       prints the shipped sdp-1 convention digest.
+#
+# Exit status: 0 = VERIFIED/REPORT, 1 = REJECTED, 2 = usage / unresolvable.
+
+require 'json'
+require 'digest'
+require_relative '../lib/synoptis/anchoring/entry'
+require_relative '../lib/synoptis/anchoring/chain_credential'
+require_relative '../lib/synoptis/anchoring/reproduction'
+require_relative '../lib/synoptis/anchoring/selective_disclosure'
+
+SD = Synoptis::Anchoring::SelectiveDisclosure
+CRED = Synoptis::Anchoring::ChainCredential
+
+def die(msg)
+  warn "sdp_verify: #{msg}"
+  exit 2
+end
+
+def reject(msg)
+  puts "REJECTED: #{msg}"
+  exit 1
+end
+
+# Read a record artifact: at most one trailing newline is tolerated (file
+# convenience); any other surrounding bytes stay in the string and fail the
+# canonical check downstream (refuse-not-coerce). delete_suffix, not chomp:
+# chomp also swallows CRLF, which would coerce a non-canonical artifact.
+def read_file(path)
+  File.read(path).delete_suffix("\n")
+rescue SystemCallError => e
+  die "cannot read #{path}: #{e.message}"
+end
+
+def load_json(path, label)
+  parsed = JSON.parse(File.read(path))
+  die "#{path}: #{label} must be a JSON object or array, got #{parsed.class}" unless parsed.is_a?(Hash) || parsed.is_a?(Array)
+  parsed
+rescue JSON::ParserError, SystemCallError => e
+  die "cannot read #{path}: #{e.message}"
+end
+
+def load_json_hash(path, label)
+  parsed = load_json(path, label)
+  die "#{path}: #{label} must be a JSON object, got #{parsed.class}" unless parsed.is_a?(Hash)
+  parsed
+end
+
+# Canonical base-10 numerals only: leading zeros are refused, not
+# reinterpreted (a non-canonical numeral is a malformed input, exit 2).
+def strict_int(value, label)
+  die "#{label} must be a canonical base-10 integer, got #{value.inspect}" unless value.is_a?(String) && value.match?(/\A(0|[1-9]\d*)\z/)
+  Integer(value, 10)
+end
+
+HEX64 = /\A[a-f0-9]{64}\z/
+
+mode = ARGV.shift
+
+case mode
+when 'commit'
+  die 'usage: sdp_verify.rb commit <record.json> [salts.json]' unless (1..2).cover?(ARGV.size)
+  record = read_file(ARGV[0])
+  salts = ARGV[1] ? load_json_hash(ARGV[1], 'salts') : nil
+  built = begin
+    SD.build_field_commitments(record, salts: salts)
+  rescue SD::DisclosureError => e
+    reject e.message
+  end
+  puts JSON.pretty_generate(built)
+  warn 'NOTE: keep the salts private; each opened salt discloses exactly its field (sdp-1 §6).'
+
+when 'binding'
+  die 'usage: sdp_verify.rb binding <aux.json> <record.json> <salts.json>' unless ARGV.size == 3
+  aux = read_file(ARGV[0])
+  record = read_file(ARGV[1])
+  salts = load_json_hash(ARGV[2], 'salts')
+  ok = begin
+    SD.verify_field_commitments(aux, record, salts)
+  rescue SD::DisclosureError => e
+    reject e.message
+  end
+  reject 'auxiliary is NOT checkably bound to the record (SDP-2: a bound-by-assertion auxiliary is a re-authoring)' unless ok
+  puts "VERIFIED: auxiliary is checkably bound to record #{Digest::SHA256.hexdigest(record)[0, 12]}… (total coverage, SDP-2)"
+
+when 'presentation'
+  die 'usage: sdp_verify.rb presentation <presentation.json> [operator_credential.json] [assessment.json]' unless (1..3).cover?(ARGV.size)
+  pres = read_file(ARGV[0])
+  operator = ARGV[1] ? load_json_hash(ARGV[1], 'operator credential') : nil
+  assessment = ARGV[2] ? load_json_hash(ARGV[2], 'assessment material') : nil
+  report = begin
+    SD.verify_presentation(pres, operator_credential: operator, assessment: assessment)
+  rescue SD::DisclosureError, CRED::CredentialError => e
+    reject e.message
+  end
+  unless report[:valid]
+    puts "REJECTED: presentation does not verify (predicate #{report[:predicate]})"
+    report[:failures].each { |f| puts "  - #{f}" }
+    exit 1
+  end
+  puts "VERIFIED: #{report[:predicate]} over committed record #{report[:record_sha256][0, 12]}…"
+  report[:opened].each { |n, v| puts "  opened #{n} = #{v.inspect}" }
+  report[:notes].each { |n| puts "  NOTE: #{n}" }
+  puts 'NOTE: soundness = sha256 collision resistance + Ed25519, no setup; hiding is computational, content-only (SDP-5, sdp-1 §6).'
+
+when 'profile'
+  die 'usage: sdp_verify.rb profile <presentation.json>' unless ARGV.size == 1
+  pres = read_file(ARGV[0])
+  p = begin
+    SD.parse_presentation!(pres)
+  rescue SD::DisclosureError => e
+    reject e.message
+  end
+  profile = p['profile']
+  puts "profile (meaning fixed by sdp-1 §2, never producer gloss — SDP-4):"
+  puts "  predicate: #{profile['predicate']}"
+  puts "  opened:    #{profile['opened'].join(', ')}"
+  puts "  withheld:  every other field of the referenced record (values only; names and count are public)"
+  puts "  currency:  #{profile['currency']}"
+  puts '  shows:     existence and the opened values of ONE committed record'
+  puts '  never:     non-existence, uniqueness, sibling records, contrary verdicts, producer selection (SDP-3)'
+
+when 'currency'
+  die 'usage: sdp_verify.rb currency <entries.json> <carrier_entry_hash> <extent>' unless ARGV.size == 3
+  entries = load_json(ARGV[0], 'entries')
+  die "#{ARGV[0]}: entries must be a JSON array" unless entries.is_a?(Array)
+  carrier = ARGV[1].to_s
+  die 'carrier_entry_hash must be 64-char lowercase hex' unless carrier.match?(HEX64)
+  extent = strict_int(ARGV[2], 'extent')
+  scan = begin
+    SD.scan_currency(entries: entries, carrier_entry_hash: carrier, extent: extent)
+  rescue SD::DisclosureError => e
+    reject e.message
+  end
+  puts "REPORT: #{scan[:status]} (scanned extent #{scan[:scanned_extent]})"
+  puts "  hits (positions): #{scan[:hits].join(', ')}" if scan[:hits]&.any?
+  puts "  NOTE: #{scan[:note]}"
+  exit(scan[:status] == 'retracted' ? 1 : 0)
+
+when 'convention'
+  puts "sdp-1 convention sha256: #{SD.convention_sha256}"
+
+else
+  die 'usage: sdp_verify.rb commit|binding|presentation|profile|currency|convention …'
+end

data/templates/skillsets/synoptis/lib/synoptis/anchoring/conventions/sdp-1.md

@@ -0,0 +1,182 @@
+# sdp-1 — KairosChain Selective Disclosure Convention, version 1
+
+Status: committed verification convention (SDP-1..5 of
+aud_l4_selective_disclosure_design v0.3, FROZEN). The SHA-256 over this file's
+raw bytes is the convention integrity digest; every artifact that names
+`sdp-1` commits it as its convention reference. A verifier holding a
+definition whose digest does not match the committed one MUST treat the
+artifact's convention as unresolvable and refuse to verify under it. Any
+change to this convention is a new identifier (`sdp-2`, ...); this file is
+never edited in place.
+sdp-1 builds on khab-1 (record commitments, cumulative commitments, proofs),
+map-1 (credentials, §1.1 attestation signatures, types, retraction), and
+rpr-1 (endorsement records) and modifies none of them: every khab-1/map-1/
+rpr-1 artifact is valid, and verifiable by its own procedure, with or without
+any sdp-1 artifact present (SDP-2).
+
+All record literals below are canonical JSON (keys sorted recursively,
+`JSON.generate` compact form). A record is valid only in its canonical
+serialization with exactly the fields shown — a non-canonical or extra-field
+record is not an sdp-1 artifact and is ignored as noise (map-1 §4 precedent).
+
+## 0. Scope and disclosed narrowness
+
+sdp-1 realizes the mechanism family "hash-based salted field-level selective
+disclosure": it blinds the *values* of fields of a committed canonical-JSON
+record while the record's committed digest, its field *names*, and its field
+*count* stay public. It does NOT blind which committed record an assertion
+concerns: the AUD-L4 *membership* predicate family (showing that some record
+is a member without revealing which) requires a zero-knowledge proving
+system and is deliberately outside sdp-1 — a later convention covers it.
+This narrowness is disclosed, not hidden (rpr-1 bit-identity precedent).
+Because a record's committed digest is revealed, the khab-1 record
+commitment IS that digest (khab-1 §1), so khab-1 inclusion and consistency
+proofs over the referenced record apply unchanged, and the open-level
+selection and currency reads (SDP-3) remain available to the verifier.
+
+## 1. Field commitments (SDP-2 auxiliary, checkably bound)
+
+    {"fields":{"<name>":"<64-hex>",...},"format":"sdp-1/field-commitments",
+     "record_sha256":"<64-hex>"}
+
+`record_sha256` is the SHA-256 of the target record string (= its khab-1
+record commitment). `fields` carries one entry per top-level field of the
+target record — coverage is total, so the auxiliary determines exactly one
+record shape and an omitted field cannot be hidden by omission. Field names
+match `[a-z0-9_]+`. Each field digest is the SHA-256 of the UTF-8 bytes of:
+
+    sdp-1/field|<salt>|<name>|<canonical JSON of the value>
+
+where `<salt>` is 32-char lowercase hex (16 random bytes, fresh per field
+per auxiliary). The `sdp-1/field` domain prefix is role separation (MPR-3
+register): a field digest cannot verify as a record commitment or vice
+versa. The auxiliary is committed as an ordinary internal-chain record
+alongside its target; both records' membership and order are khab-1's
+business, unchanged.
+
+Checkable binding (SDP-2): a holder of the target record and the salts can
+recompute `record_sha256` and every field digest; the auxiliary commits the
+same content the record commits, or the recomputation fails. An auxiliary
+whose digests do not recompute is not a conforming sdp-1 artifact. Residue
+disclosed: binding checkability is available to holders of the record and
+salts (the producer, and anyone the producer opens to); a third party holds
+the binding as committed material whose consistency is attested by the
+recomputations of others — the MPR-4 production/verification asymmetry.
+
+## 2. Disclosure profile (SDP-4, closed schema)
+
+    {"currency":"scan-checkable","format":"sdp-1/profile",
+     "opened":["format","verdict"],"predicate":"claimed-verdict"}
+
+`predicate` is one of `typed-existence` | `claimed-verdict` |
+`conforming-verdict`. `currency` is one of `scan-checkable` |
+`unestablished` (SDP-3: which currency reading the presentation supports is
+declared, never implied). `opened` is the sorted, duplicate-free list of
+opened field names and MUST include `format` (the record's format field is
+always opened, so the closed schema of the referenced record kind is
+readable and coverage is checkable against it). The schema is closed: no
+other fields exist, so a profile cannot carry producer gloss — a profile
+means what this section says a profile of its form means (SDP-4 pinning),
+and a presentation's profile is checked against its actual opened set, so a
+profile that overstates or understates what is opened fails verification
+(statement-determining, SDP-4).
+
+What every sdp-1 profile discloses by construction (SDP-3): the proof shows
+the named predicate over the named committed record and withholds the values
+of every field not listed in `opened`; it shows nothing about other records,
+contrary verdicts, or the producer's selection among presentable records.
+
+## 3. Presentation (offline artifact, never committed)
+
+base fields, always present:
+
+    {"aux_record":"<field-commitments record string>",
+     "format":"sdp-1/presentation",
+     "opened":{"<name>":{"salt":"<32-hex>","value":<JSON value>},...},
+     "profile":{...profile object...}}
+
+additionally, exactly when `profile.predicate` is `claimed-verdict` or
+`conforming-verdict`: `"credential"` (the endorser's map-1 credential
+object) and `"signature"` (128-hex, the map-1 §1.1 attestation signature
+over the referenced endorsement record). Additionally, exactly when
+`profile.currency` is `scan-checkable`: `"carrier_entry_hash"` (64-hex, the
+anchor-log entry that carried the referenced record's attestation — the
+producer's disclosure that makes the retraction scan runnable). The schema
+is closed per shape (rpr-1 per-mode precedent).
+
+`opened` keys must equal `profile.opened` exactly. Each opened field
+verifies by recomputing §1's field digest from `salt`, the name, and the
+canonical JSON of `value` against the auxiliary's committed digest.
+
+## 4. Predicates (SDP-1 bounds)
+
+- `typed-existence`: a committed record of the opened `format` exists with
+  digest `record_sha256`. Membership in an anchored state is shown, when
+  wanted, by a khab-1 inclusion proof over `record_sha256` — unchanged, not
+  part of the presentation.
+- `claimed-verdict`: the opened `format` must be `rpr-1/endorsement` and
+  `verdict` must be opened. The signature verifies under the presented
+  credential over the signing string
+
+      map-1/attestation|<credential digest>|<record_sha256>
+
+  which requires NO record content (map-1 §1.1 commits the payload by
+  digest). The claim is exactly: this credential's holder claimed this
+  verdict in this committed endorsement — the weaker predicate under its
+  own name (SDP-1 face/substance rule). No foreignness, anteriority, or
+  conformance is asserted.
+- `conforming-verdict`: `claimed-verdict`, and additionally
+  `adjudication_mode`, `target_sha256`, and `tolerance_sha256` are opened
+  (plus `procedure_sha256` exactly when the opened mode is `procedure`),
+  and verification REQUIRES the operator credential (foreignness: endorser
+  credential digest ≠ operator credential digest, rpr-1 §3) and the rpr-1
+  §2.1 declaration-set material (targets, declarations with positions, the
+  endorsement's committed position); the invoked tolerance must assess as
+  conforming, and it must be bound to the endorsement's opened target or to
+  a sibling target sharing its committed computation identification (the
+  rpr-1 §2.1 pooling rule: a sibling menu is one menu; a tolerance bound to
+  an unrelated computation fails), decided from the supplied target records.
+  Where the material is not supplied, or the coherence is undecidable in the
+  supplied view, verification fails — refuse, not degrade (SDP-1 upward
+  bound: the open form's conformance conditions are inside the checked
+  predicate, never alongside it).
+
+## 5. Currency scan (SDP-3)
+
+Given a view of anchor-log entries (each with `entry_hash`,
+`attestation_type`, `depositor`, `position`, and retraction `metadata`), the
+scan reports whether a `retraction` entry from the carrier's own depositor
+(map-1 §3 issuer rule) targets `carrier_entry_hash` at a committed position
+at or before a named extent. The verdict is `retracted` / `unretracted` up
+to that extent, or `unestablished` where the carrier entry — or its
+depositor, without which the issuer rule is undecidable — is not in the
+supplied view. Duplicate views of one committed entry are one entry.
+Same-issuer retractions beyond the extent or without a decidable position,
+and non-issuer entries targeting the carrier (which retract nothing), are
+disclosed as residue lines, never silently dropped. `unretracted` speaks
+only to the scanned view and extent — absence beyond them proves nothing
+(MPR-9 register). A profile declaring `currency: "unestablished"` supports
+no scan and says so on its face.
+
+## 6. Hiding and soundness base (SDP-1/SDP-5)
+
+Hiding is computational and content-only: a withheld value is hidden exactly
+as far as its field's salt is secret and sha256 preimage resistance holds —
+16-byte random salts make guess-and-confirm infeasible even for low-entropy
+values (the MPR-2 caveat is answered by the salt, and returns in full if a
+salt is reused or leaks). What sdp-1 never hides: the record's committed
+digest, field names and count, the profile, the producer's credential where
+presented, and the fact of presentation itself — a presentation's existence,
+timing, and provenance are outside any profile's promise (SDP-1). Soundness
+rests on SHA-256 collision resistance and Ed25519 unforgeability only; there
+is no setup to trust (SDP-5: transparent, stated rather than implied).
+
+## 7. Verification procedure and trust base
+
+All sdp-1 verification needs only: the artifacts named above, this
+definition, the map-1 definition (credentials, signatures, retraction), the
+rpr-1 definition (for verdict predicates), and authentic views of the
+logs/chains the artifacts reference. No registry, no network, no producer
+cooperation for verification — production of presentations, like production
+of proofs, remains the producer's act (MPR-4 asymmetry), and the producer's
+selection among presentable records is invisible by construction (SDP-3).