@agent-custody/receipts 0.1.7 → 0.1.8

package/README.md

@@ -256,6 +256,7 @@ The design is two producers feeding one verifier. The SDK is the top of the funn
 - SDK core: policy decision, record, and a generic `wrap(tool, fn)` for any framework whose tools are functions.
 - Claude Code command hook for PreToolUse, PostToolUse, and PostToolUseFailure, with blocking on deny.
 - Claude Agent SDK in-process hooks over the same handler.
+- Provider-native deliveries: an upstream wrapping Stripe or GitHub attaches the signed webhook or delivery for the call; a verifier with the shared secret checks the HMAC, the timestamp, and the binding to the result, and reports the execution as attested by shared secret.
 - Logarithmic appends: the Merkle log caches complete subtrees, so issuing a receipt costs the same at the millionth leaf as at the first; measured at 0.15 ms per receipt and about half a millisecond per gateway call including policy, a fact lookup, and the upstream signature.
 - Retention on the log: `prune` replaces leaves older than a cutoff with their hashes and removes their bundles, so proofs still verify and the content is gone.
 - Several upstreams under one gateway and one grant, each tool owned by exactly one, with the receipt naming which served the call; consumed facts flow across them.
@@ -273,10 +274,9 @@ The design is two producers feeding one verifier. The SDK is the top of the funn
 **Next, in the order it pays off**
 
 1. OpenTelemetry export: emit each receipt as a span with the receipt id and issuer kind as attributes, so existing collectors and dashboards carry them without a new pipeline.
-2. Provider-native upstream signatures (Stripe webhook signatures, GitHub delivery signatures) as adapters onto the upstream attestation field. [Issue #7](https://github.com/ch4r10t33r/agent-custody/issues/7).
-3. An HTTP transport for the gateway, with the grant presented per connection, for a shared deployment rather than one process per agent session.
-4. Delegation chains for sub-agents.
-5. Receiver-attested receipts for agent-to-agent calls.
-6. A TEE-hosted signer, then SD-JWT redaction, then ZK proofs of policy compliance. Not before.
+2. An HTTP transport for the gateway, with the grant presented per connection, for a shared deployment rather than one process per agent session.
+3. Delegation chains for sub-agents.
+4. Receiver-attested receipts for agent-to-agent calls.
+5. A TEE-hosted signer, then SD-JWT redaction, then ZK proofs of policy compliance. Not before.
 
 A Python SDK follows the same shape once the TypeScript adapters have settled.

package/dist/cli.js

@@ -12,6 +12,13 @@ import { MerkleLog } from "./log.js";
 import { createSdkIssuer } from "./sdk/index.js";
 import { handleHookEvent } from "./sdk/claude.js";
 import { auditExtends, formatReport, verifyBundle } from "./verify.js";
+/** A shared secret from an environment variable; never from the command line, where it would land in shell history. */
+function secretFrom(envName) {
+    const v = process.env[envName];
+    if (!v)
+        throw new Error(`environment variable ${envName} is not set`);
+    return v;
+}
 const USAGE = `agent-custody <command>
 
   keygen  --dir <dir> --name <name>
@@ -22,7 +29,7 @@ const USAGE = `agent-custody <command>
   prune   --log <log.jsonl> --before <ISO instant> [--receipts <dir>]
           retention on the receipt log: replaces older leaves with their hashes, so proofs still verify and the content is gone
   log     --file <log.jsonl> --key <log.key> [--port 8787] [--host 127.0.0.1] [--token-env <NAME>]   reference log server
-  verify  <bundle.json> --issuer-key <pub> [--principal-key <pub>] [--log-key <pub>] [--upstream-key <pub>] [--log <log.jsonl>] [--json]
+  verify  <bundle.json> --issuer-key <pub> [--principal-key <pub>] [--log-key <pub>] [--upstream-key <pub>] [--stripe-secret-env NAME] [--github-secret-env NAME] [--log <log.jsonl>] [--json]
   audit   --older <bundle.json> --newer <bundle.json> (--log <log.jsonl> | --log-url <url>) --issuer-key <pub> [--log-key <pub>] [--json]
           checks that the newer receipt's log extends the older one's: nothing between them was rewritten
 `;
@@ -133,6 +140,8 @@ async function main(argv) {
                     "principal-key": { type: "string", multiple: true },
                     "log-key": { type: "string", multiple: true },
                     "upstream-key": { type: "string", multiple: true },
+                    "stripe-secret-env": { type: "string" },
+                    "github-secret-env": { type: "string" },
                     log: { type: "string" },
                     json: { type: "boolean", default: false },
                 },
@@ -147,6 +156,7 @@ async function main(argv) {
                 principalKeys: (values["principal-key"] ?? []).map(loadPublicKey),
                 ...(values["log-key"] ? { logKeys: values["log-key"].map(loadPublicKey) } : {}),
                 ...(values["upstream-key"] ? { upstreamKeys: values["upstream-key"].map(loadPublicKey) } : {}),
+                ...(values["stripe-secret-env"] || values["github-secret-env"] ? { providerSecrets: { ...(values["stripe-secret-env"] ? { stripe: secretFrom(values["stripe-secret-env"]) } : {}), ...(values["github-secret-env"] ? { github: secretFrom(values["github-secret-env"]) } : {}) } } : {}),
                 ...(values.log ? { logFile: values.log } : {}),
             });
             console.log(values.json ? JSON.stringify(result, null, 2) : formatReport(result));

package/dist/gateway.js

@@ -12,7 +12,7 @@ import { digestOf, loadPrivateKey, loadPublicKey } from "./crypto.js";
 import { delegationValidAt, verifyDelegation } from "./delegation.js";
 import { createIssuer } from "./issue.js";
 import { openLog } from "./log-sink.js";
-import { upstreamSignatureOf } from "./upstream.js";
+import { upstreamEvidenceOf } from "./upstream.js";
 import { evaluate, policyDigest } from "./policy.js";
 export const GATEWAY_VERSION = "0.1.0";
 export const RECEIPT_META_KEY = "agent-custody/receipt";
@@ -164,8 +164,8 @@ export async function createGateway(cfg) {
                 // state, such as the memory server, cites the receipt as the source of what it stores.
                 const observed = Object.fromEntries(Object.entries(facts).map(([k, f]) => [k, f.value]));
                 const result = await callUpstream(tool, args, { ...upstreamMeta, [OBSERVED_META_KEY]: observed });
-                const upstreamSig = upstreamSignatureOf(result);
-                execution = { status: result.isError ? "failed" : "executed", result, resultDigest: digestOf(result), provenance: "observed", ...(upstreamSig ? { upstream: { envelope: upstreamSig } } : {}) };
+                const evidence = upstreamEvidenceOf(result);
+                execution = { status: result.isError ? "failed" : "executed", result, resultDigest: digestOf(result), provenance: "observed", ...(evidence ? { upstream: evidence } : {}) };
                 noteServedFacts(result);
             }
             catch (e) {

package/dist/receipt.d.ts

@@ -1,6 +1,7 @@
 import type { Envelope } from "./crypto.ts";
 import type { InclusionProof } from "./log.ts";
 import type { PolicyDecision } from "./policy.ts";
+import type { UpstreamEvidence } from "./upstream.ts";
 export declare const RECEIPT_TYPE = "application/vnd.in-toto+json";
 export declare const RECEIPT_PREDICATE_TYPE = "https://agent-custody.dev/receipt/v0.2";
 export declare const TREEHEAD_TYPE = "application/vnd.agent-custody.treehead+json";
@@ -90,10 +91,8 @@ export interface ReceiptPredicate {
         result: unknown;
         resultDigest: string;
         provenance: Provenance;
-        /** an upstream's own signature over what it returned, bound to this receipt; checked by a verifier holding the upstream's key */
-        upstream?: {
-            envelope: Envelope;
-        };
+        /** an upstream's own signature over what it returned, bound to this receipt and checked with the upstream's key; or a provider's delivery, checked with the provider's shared secret */
+        upstream?: UpstreamEvidence;
     } | {
         status: "denied";
         reason: string;

package/dist/upstream.d.ts

@@ -25,3 +25,40 @@ export type UpstreamCheck = {
 };
 /** For verifiers: the envelope must verify against a trusted upstream key and bind to this receipt, tool, and content. */
 export declare function checkUpstream(envelope: Envelope, keys: PublicKeyRef[], expected: UpstreamAttestation): UpstreamCheck;
+export interface ProviderAttestation {
+    provider: "stripe-webhook" | "github-delivery";
+    /** the delivery body exactly as received; the HMAC is over these bytes */
+    rawBody: string;
+    /** Stripe: the Stripe-Signature header; GitHub: the X-Hub-Signature-256 header */
+    signature: string;
+    /** dot path into the parsed body whose value must appear in the receipt's result, e.g. data.object.id */
+    bind: string;
+    /** GitHub: the X-GitHub-Delivery id, for the record */
+    deliveryId?: string;
+}
+export type UpstreamEvidence = {
+    envelope: Envelope;
+} | ProviderAttestation;
+export declare function isProviderAttestation(v: unknown): v is ProviderAttestation;
+/** For upstreams wrapping a provider: attaches the provider's own delivery for this call. */
+export declare function attachProviderAttestation<R extends CallToolResult>(result: R, attestation: ProviderAttestation): R;
+/** For the gateway: whatever upstream evidence the result carries, a signed envelope or a provider delivery. */
+export declare function upstreamEvidenceOf(result: CallToolResult): UpstreamEvidence | null;
+export interface ProviderSecrets {
+    stripe?: string;
+    github?: string;
+}
+export interface ProviderCheckContext {
+    /** the receipt's timestamp, for Stripe's timestamp tolerance */
+    timestamp: string;
+    /** the receipt's execution result; the bound value must appear in it */
+    result: unknown;
+    /** seconds a Stripe timestamp may differ from the receipt's; default 300 */
+    toleranceSeconds?: number;
+}
+/** Stripe: header `t=<unix>,v1=<hex>`, HMAC-SHA256 over `<t>.<rawBody>`; GitHub: header `sha256=<hex>` over rawBody. */
+export declare function checkProvider(att: ProviderAttestation, secrets: ProviderSecrets, ctx: ProviderCheckContext): UpstreamCheck;
+/** For fake providers and tests: a Stripe-Signature header for a body at a time. */
+export declare function stripeSignature(rawBody: string, secret: string, unixSeconds: number): string;
+/** For fake providers and tests: an X-Hub-Signature-256 header for a body. */
+export declare function githubSignature(rawBody: string, secret: string): string;

package/dist/upstream.js

@@ -1,3 +1,8 @@
+// Attested execution. An upstream that holds a key can sign what it returned, bound to the receipt the gateway is
+// issuing, so the receipt's execution is no longer only what the gateway observed but what the upstream itself vouches
+// for. The upstream puts a DSSE envelope on its result's _meta; the gateway embeds it; a verifier who trusts the
+// upstream's key checks it. Provider-native formats, such as Stripe's webhook signatures, are adapters on top of this.
+import { createHmac, timingSafeEqual } from "node:crypto";
 import { digestOf, dsseSign, dsseVerify } from "./crypto.js";
 export const UPSTREAM_SIG_META_KEY = "agent-custody/upstream-signature";
 export const UPSTREAM_TYPE = "application/vnd.agent-custody.upstream+json";
@@ -30,3 +35,66 @@ export function checkUpstream(envelope, keys, expected) {
         return { ok: false, error: "signed content differs from the result in the receipt" };
     return { ok: true, keyid: v.keyid };
 }
+export function isProviderAttestation(v) {
+    const p = v;
+    return !!p && (p.provider === "stripe-webhook" || p.provider === "github-delivery") && typeof p.rawBody === "string" && typeof p.signature === "string" && typeof p.bind === "string";
+}
+/** For upstreams wrapping a provider: attaches the provider's own delivery for this call. */
+export function attachProviderAttestation(result, attestation) {
+    return { ...result, _meta: { ...result._meta, [UPSTREAM_SIG_META_KEY]: attestation } };
+}
+/** For the gateway: whatever upstream evidence the result carries, a signed envelope or a provider delivery. */
+export function upstreamEvidenceOf(result) {
+    const v = result._meta?.[UPSTREAM_SIG_META_KEY];
+    if (isProviderAttestation(v))
+        return v;
+    const env = upstreamSignatureOf(result);
+    return env ? { envelope: env } : null;
+}
+const pathValue = (body, path) => path.split(".").reduce((v, k) => (v && typeof v === "object" ? v[k] : undefined), body);
+/** Stripe: header `t=<unix>,v1=<hex>`, HMAC-SHA256 over `<t>.<rawBody>`; GitHub: header `sha256=<hex>` over rawBody. */
+export function checkProvider(att, secrets, ctx) {
+    const secret = att.provider === "stripe-webhook" ? secrets.stripe : secrets.github;
+    if (!secret)
+        return { ok: false, error: `no ${att.provider === "stripe-webhook" ? "Stripe" : "GitHub"} secret given` };
+    const hmac = (data) => createHmac("sha256", secret).update(data).digest("hex");
+    const equal = (a, b) => a.length === b.length && timingSafeEqual(Buffer.from(a), Buffer.from(b));
+    if (att.provider === "stripe-webhook") {
+        const parts = Object.fromEntries(att.signature.split(",").map((kv) => kv.split("=")));
+        const t = parts.t;
+        const v1 = parts.v1;
+        if (!t || !v1)
+            return { ok: false, error: "Stripe-Signature header lacks t or v1" };
+        if (!equal(hmac(`${t}.${att.rawBody}`), v1))
+            return { ok: false, error: "Stripe signature does not verify with this secret" };
+        const skew = Math.abs(Number(t) * 1000 - Date.parse(ctx.timestamp)) / 1000;
+        if (!(skew <= (ctx.toleranceSeconds ?? 300)))
+            return { ok: false, error: `Stripe timestamp is ${Math.round(skew)}s from the receipt, beyond tolerance` };
+    }
+    else {
+        const hex = att.signature.startsWith("sha256=") ? att.signature.slice(7) : "";
+        if (!hex || !equal(hmac(att.rawBody), hex))
+            return { ok: false, error: "GitHub signature does not verify with this secret" };
+    }
+    let body;
+    try {
+        body = JSON.parse(att.rawBody);
+    }
+    catch {
+        return { ok: false, error: "delivery body is not JSON" };
+    }
+    const bound = pathValue(body, att.bind);
+    if (bound === undefined || bound === null || bound === "")
+        return { ok: false, error: `delivery has no value at ${att.bind}` };
+    if (!JSON.stringify(ctx.result).includes(JSON.stringify(bound).replace(/^"|"$/g, "")))
+        return { ok: false, error: `delivery's ${att.bind} (${String(bound)}) does not appear in the receipt's result` };
+    return { ok: true, keyid: `shared secret (${att.provider}, bound on ${att.bind})` };
+}
+/** For fake providers and tests: a Stripe-Signature header for a body at a time. */
+export function stripeSignature(rawBody, secret, unixSeconds) {
+    return `t=${unixSeconds},v1=${createHmac("sha256", secret).update(`${unixSeconds}.${rawBody}`).digest("hex")}`;
+}
+/** For fake providers and tests: an X-Hub-Signature-256 header for a body. */
+export function githubSignature(rawBody, secret) {
+    return `sha256=${createHmac("sha256", secret).update(rawBody).digest("hex")}`;
+}

package/dist/verify.d.ts

@@ -1,4 +1,5 @@
 import { type Envelope, type PublicKeyRef } from "./crypto.ts";
+import { type ProviderSecrets } from "./upstream.ts";
 import { type ReceiptBundle, type ReceiptStatement, type TreeHead } from "./receipt.ts";
 export interface Check {
     name: string;
@@ -13,6 +14,8 @@ export interface VerifyOptions {
     logKeys?: PublicKeyRef[];
     /** keys of upstreams that sign their results; with one given, an execution carrying an upstream signature is checked and becomes attested */
     upstreamKeys?: PublicKeyRef[];
+    /** shared secrets for provider-native deliveries; with the matching one given, an execution carrying a Stripe or GitHub delivery is checked */
+    providerSecrets?: ProviderSecrets;
     /** If given, the root is recomputed from this log file at the receipt's tree size and compared. */
     logFile?: string;
 }

package/dist/verify.js

@@ -2,7 +2,7 @@
 import { canonicalize, digestOf, dsseVerify } from "./crypto.js";
 import { delegationValidAt, verifyDelegation } from "./delegation.js";
 import { leafHash, MerkleLog, verifyConsistency, verifyInclusion } from "./log.js";
-import { checkUpstream, contentDigest } from "./upstream.js";
+import { checkProvider, checkUpstream, contentDigest, isProviderAttestation } from "./upstream.js";
 import { RECEIPT_PREDICATE_TYPE, RECEIPT_TYPE, TREEHEAD_TYPE } from "./receipt.js";
 const short = (s) => s.slice(0, 12);
 export function verifyBundle(bundle, opts) {
@@ -45,10 +45,18 @@ export function verifyBundle(bundle, opts) {
         add("principal is claimed, not attested", p.principal.provenance === "claimed", "no signed delegation in this receipt");
     }
     add("request args digest", digestOf(p.request.args) === p.request.argsDigest && st.subject[0]?.digest.sha256 === p.request.argsDigest);
-    if ((p.execution.status === "executed" || p.execution.status === "failed") && p.execution.upstream && (opts.upstreamKeys?.length ?? 0) > 0) {
+    if ((p.execution.status === "executed" || p.execution.status === "failed") && p.execution.upstream) {
         const result = p.execution.result;
-        const u = checkUpstream(p.execution.upstream.envelope, opts.upstreamKeys, { receiptId: p.receiptId, tool: p.tool.name, contentDigest: contentDigest(result) });
-        add("upstream signature (upstream key)", u.ok, u.ok ? `keyid ${short(u.keyid)}` : u.error);
+        if (isProviderAttestation(p.execution.upstream)) {
+            if (opts.providerSecrets) {
+                const u = checkProvider(p.execution.upstream, opts.providerSecrets, { timestamp: p.timestamp, result });
+                add("upstream signature (provider secret)", u.ok, u.ok ? u.keyid : u.error);
+            }
+        }
+        else if ((opts.upstreamKeys?.length ?? 0) > 0) {
+            const u = checkUpstream(p.execution.upstream.envelope, opts.upstreamKeys, { receiptId: p.receiptId, tool: p.tool.name, contentDigest: contentDigest(result) });
+            add("upstream signature (upstream key)", u.ok, u.ok ? `keyid ${short(u.keyid)}` : u.error);
+        }
     }
     if (p.policy) {
         const consistent = p.policy.decision === "allow" ? p.execution.status !== "denied" : p.execution.status === "denied";
@@ -137,8 +145,11 @@ export function formatReport(r) {
         row("policy", "-", "(none evaluated)");
     if (p.consumed)
         row("consumed", p.consumed.provenance, p.consumed.factIds.length === 0 ? "(no facts shown before this call)" : p.consumed.factIds);
-    const upstreamCheck = r.checks.find((c) => c.name === "upstream signature (upstream key)");
+    const upstreamCheck = r.checks.find((c) => c.name === "upstream signature (upstream key)" || c.name === "upstream signature (provider secret)");
     const hasUpstream = (p.execution.status === "executed" || p.execution.status === "failed") && !!p.execution.upstream;
-    row("execution", upstreamCheck?.ok ? "attested" : p.execution.provenance, `${p.execution.status}${hasUpstream ? (upstreamCheck ? (upstreamCheck.ok ? ` (signed by upstream ${upstreamCheck.detail})` : " (upstream signature FAILED)") : " (carries an upstream signature; pass --upstream-key to check it)") : ""}`);
+    const byProvider = hasUpstream && isProviderAttestation(p.execution.upstream);
+    const attestedAs = upstreamCheck?.ok ? (byProvider ? "attested (shared secret)" : "attested") : p.execution.provenance;
+    const note = !hasUpstream ? "" : upstreamCheck ? (upstreamCheck.ok ? ` (${byProvider ? upstreamCheck.detail : `signed by upstream ${upstreamCheck.detail}`})` : " (upstream signature FAILED)") : byProvider ? " (carries a provider delivery; pass the provider secret to check it)" : " (carries an upstream signature; pass --upstream-key to check it)";
+    row("execution", attestedAs, `${p.execution.status}${note}`);
     return lines.join("\n");
 }

package/docs/verification.md

@@ -171,7 +171,17 @@ The remote log also serves `GET /head`, its current tree head signed with the lo
 
 On a gateway receipt the execution is `observed`: the gateway saw what the upstream returned. An upstream that holds a key can do better and sign its result for the receipt being issued; the gateway embeds the signature, and a verifier given the upstream's public key checks it and reports the execution as `attested` by that key. The check binds the signature to the receipt id, the tool, and the digest of the result content, so a signature cannot be moved between receipts.
 
-For upstream authors, `signResult(result, key, receiptId, tool)` from `@agent-custody/receipts` does the signing; the receipt id arrives in the call's `_meta["agent-custody/receipt"]`. The memory server in `@agent-custody/state` signs when started with `--key`, and the demo's fake upstream does too. Provider-native signatures, such as Stripe's webhook signatures, are adapters on top of the same field and are not implemented yet.
+For upstream authors, `signResult(result, key, receiptId, tool)` from `@agent-custody/receipts` does the signing; the receipt id arrives in the call's `_meta["agent-custody/receipt"]`. The memory server in `@agent-custody/state` signs when started with `--key`, and the demo's fake upstream does too.
+
+### Provider-native deliveries
+
+Real providers do not sign per receipt. Stripe signs webhooks and GitHub signs deliveries with an HMAC over the raw body under a shared secret, unbound to any receipt. An MCP server wrapping such a provider can attach the delivery that corresponds to the call, with `attachProviderAttestation(result, { provider: "stripe-webhook", rawBody, signature, bind: "data.object.id" })`, and the gateway embeds it as `execution.upstream`. A verifier given the secret recomputes the HMAC, checks Stripe's timestamp against the receipt's within five minutes, and checks that the value at `bind` in the delivery appears in the receipt's result, which is what ties a delivery to this call.
+
+```bash
+STRIPE_WEBHOOK_SECRET=whsec_... node src/cli.ts verify receipts/<id>.json --issuer-key keys/gateway.pub --principal-key keys/principal.pub --stripe-secret-env STRIPE_WEBHOOK_SECRET
+```
+
+The report then says `attested (shared secret)`, deliberately distinct from `attested`: anyone holding the secret could forge a delivery, so this is the provider's word as far as the secret is trusted, not a signature only the provider could make. Without the secret the delivery is carried and not checked, and the report says so. The demo's fake Stripe attaches webhooks when started with `--webhook-secret`; the conformance vectors include a receipt verified with and without the secret.
 
 ## Retention on the log
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-custody/receipts",
-  "version": "0.1.7",
+  "version": "0.1.8",
   "description": "Chain of custody for AI agents: signed, independently verifiable receipts for tool calls. MCP gateway + Cedar policy + Merkle transparency log",
   "license": "Apache-2.0",
   "repository": {

package/vectors/audit.json

@@ -7,26 +7,26 @@
       "description": "The tree head from the first remote receipt and the log's later head, with the proof the log served.",
       "older": {
         "payloadType": "application/vnd.agent-custody.treehead+json",
-        "payload": "eyJyb290SGFzaCI6IjY4ODlmODQyNmVkODg4YTVlNzI0Y2YzNThlNmI0Y2E3ZmI3YWVmMTkwODkxOWE5MGYxZjNlNzFjMWU3MmNkODUiLCJ0aW1lc3RhbXAiOiIyMDI2LTA5LTA3VDA4OjM3OjM0LjkyOVoiLCJ0cmVlU2l6ZSI6MX0=",
+        "payload": "eyJyb290SGFzaCI6ImFmYjZhMmJjNThiZmQwNDk4YWNjZTZiYTY1MTAxM2IwY2JiYjlmNTI1MWM1NTI0Nzg3NGY5ZWYzOGM3YjAxMjMiLCJ0aW1lc3RhbXAiOiIyMDI2LTA5LTA3VDEzOjQ4OjQyLjQ0OVoiLCJ0cmVlU2l6ZSI6MX0=",
         "signatures": [
           {
-            "keyid": "48967bd6051d66cebf961f226a6ae4e90dce91ead9ac10c0f9aaa427d40c4c16",
-            "sig": "FL7TL3y1JgXinAkxywmKfoULNe2V8D+JpIcsJWok54rIun70z7bmj78R1VnNe9aADLSGQb0JTYhdaODn9mOnCg=="
+            "keyid": "402c5fa71d8055eadffe3e33d7847e543551d24c002a9adf86286f03eb5e4538",
+            "sig": "ZcTaC2tLzE32o+sIj0qFr9lRWaidilkLf6VkVTt6N3McGnp/lISpE0f+naKlRvvQR70kreVm43mwHeMnLBUPCw=="
           }
         ]
       },
       "newer": {
         "payloadType": "application/vnd.agent-custody.treehead+json",
-        "payload": "eyJyb290SGFzaCI6IjUxY2MyNzIzMzM0NzhmMjYxNDU1MWFmMWM1NjExMzBjOTBlODEwM2JhYmI1NzNkZjY2YjM3ZTVhMDk1YjI0ZWYiLCJ0aW1lc3RhbXAiOiIyMDI2LTA5LTA3VDA4OjM3OjM0LjkzM1oiLCJ0cmVlU2l6ZSI6Mn0=",
+        "payload": "eyJyb290SGFzaCI6IjJlZTc2MmUzYzdlYzdhODE4ODc4MjUwNDhiZGMwZTEyMWFjNDQzM2VjM2FlNjFjYjU5MjM3MWNmYWMxNDVjZmEiLCJ0aW1lc3RhbXAiOiIyMDI2LTA5LTA3VDEzOjQ4OjQyLjQ1M1oiLCJ0cmVlU2l6ZSI6Mn0=",
         "signatures": [
           {
-            "keyid": "48967bd6051d66cebf961f226a6ae4e90dce91ead9ac10c0f9aaa427d40c4c16",
-            "sig": "o/zrDH6/I3VPabSVS4RozKm945Nd+hiwt6JTytpyMavxizlR8ZuGmG6lX56+A0M4wAk/H0qmmHXoLCGuobhdCw=="
+            "keyid": "402c5fa71d8055eadffe3e33d7847e543551d24c002a9adf86286f03eb5e4538",
+            "sig": "++9Ra+7i8vejqY418WnWH4CXA9Rxgb/gDHWrEWgZLYpSPjOdbEXB3XlEArIKaP3+I19eTjK4EQQ07mI2WM3ZCQ=="
           }
         ]
       },
       "proof": [
-        "e74d1e2874003df276b93e2e764da876201bcc1a9efe8752118676eafc4ce5eb"
+        "ae2d0fcc4034cc32db9e07e9f039358baaef3ae6e22533b9c273ee9042a51d5b"
       ],
       "keys": [
         "log"
@@ -41,26 +41,26 @@
       "description": "The same heads the wrong way round.",
       "older": {
         "payloadType": "application/vnd.agent-custody.treehead+json",
-        "payload": "eyJyb290SGFzaCI6IjUxY2MyNzIzMzM0NzhmMjYxNDU1MWFmMWM1NjExMzBjOTBlODEwM2JhYmI1NzNkZjY2YjM3ZTVhMDk1YjI0ZWYiLCJ0aW1lc3RhbXAiOiIyMDI2LTA5LTA3VDA4OjM3OjM0LjkzM1oiLCJ0cmVlU2l6ZSI6Mn0=",
+        "payload": "eyJyb290SGFzaCI6IjJlZTc2MmUzYzdlYzdhODE4ODc4MjUwNDhiZGMwZTEyMWFjNDQzM2VjM2FlNjFjYjU5MjM3MWNmYWMxNDVjZmEiLCJ0aW1lc3RhbXAiOiIyMDI2LTA5LTA3VDEzOjQ4OjQyLjQ1M1oiLCJ0cmVlU2l6ZSI6Mn0=",
         "signatures": [
           {
-            "keyid": "48967bd6051d66cebf961f226a6ae4e90dce91ead9ac10c0f9aaa427d40c4c16",
-            "sig": "o/zrDH6/I3VPabSVS4RozKm945Nd+hiwt6JTytpyMavxizlR8ZuGmG6lX56+A0M4wAk/H0qmmHXoLCGuobhdCw=="
+            "keyid": "402c5fa71d8055eadffe3e33d7847e543551d24c002a9adf86286f03eb5e4538",
+            "sig": "++9Ra+7i8vejqY418WnWH4CXA9Rxgb/gDHWrEWgZLYpSPjOdbEXB3XlEArIKaP3+I19eTjK4EQQ07mI2WM3ZCQ=="
           }
         ]
       },
       "newer": {
         "payloadType": "application/vnd.agent-custody.treehead+json",
-        "payload": "eyJyb290SGFzaCI6IjY4ODlmODQyNmVkODg4YTVlNzI0Y2YzNThlNmI0Y2E3ZmI3YWVmMTkwODkxOWE5MGYxZjNlNzFjMWU3MmNkODUiLCJ0aW1lc3RhbXAiOiIyMDI2LTA5LTA3VDA4OjM3OjM0LjkyOVoiLCJ0cmVlU2l6ZSI6MX0=",
+        "payload": "eyJyb290SGFzaCI6ImFmYjZhMmJjNThiZmQwNDk4YWNjZTZiYTY1MTAxM2IwY2JiYjlmNTI1MWM1NTI0Nzg3NGY5ZWYzOGM3YjAxMjMiLCJ0aW1lc3RhbXAiOiIyMDI2LTA5LTA3VDEzOjQ4OjQyLjQ0OVoiLCJ0cmVlU2l6ZSI6MX0=",
         "signatures": [
           {
-            "keyid": "48967bd6051d66cebf961f226a6ae4e90dce91ead9ac10c0f9aaa427d40c4c16",
-            "sig": "FL7TL3y1JgXinAkxywmKfoULNe2V8D+JpIcsJWok54rIun70z7bmj78R1VnNe9aADLSGQb0JTYhdaODn9mOnCg=="
+            "keyid": "402c5fa71d8055eadffe3e33d7847e543551d24c002a9adf86286f03eb5e4538",
+            "sig": "ZcTaC2tLzE32o+sIj0qFr9lRWaidilkLf6VkVTt6N3McGnp/lISpE0f+naKlRvvQR70kreVm43mwHeMnLBUPCw=="
           }
         ]
       },
       "proof": [
-        "e74d1e2874003df276b93e2e764da876201bcc1a9efe8752118676eafc4ce5eb"
+        "ae2d0fcc4034cc32db9e07e9f039358baaef3ae6e22533b9c273ee9042a51d5b"
       ],
       "keys": [
         "log"
@@ -77,26 +77,26 @@
       "description": "Tree heads checked against the app key, which did not sign them.",
       "older": {
         "payloadType": "application/vnd.agent-custody.treehead+json",
-        "payload": "eyJyb290SGFzaCI6IjY4ODlmODQyNmVkODg4YTVlNzI0Y2YzNThlNmI0Y2E3ZmI3YWVmMTkwODkxOWE5MGYxZjNlNzFjMWU3MmNkODUiLCJ0aW1lc3RhbXAiOiIyMDI2LTA5LTA3VDA4OjM3OjM0LjkyOVoiLCJ0cmVlU2l6ZSI6MX0=",
+        "payload": "eyJyb290SGFzaCI6ImFmYjZhMmJjNThiZmQwNDk4YWNjZTZiYTY1MTAxM2IwY2JiYjlmNTI1MWM1NTI0Nzg3NGY5ZWYzOGM3YjAxMjMiLCJ0aW1lc3RhbXAiOiIyMDI2LTA5LTA3VDEzOjQ4OjQyLjQ0OVoiLCJ0cmVlU2l6ZSI6MX0=",
         "signatures": [
           {
-            "keyid": "48967bd6051d66cebf961f226a6ae4e90dce91ead9ac10c0f9aaa427d40c4c16",
-            "sig": "FL7TL3y1JgXinAkxywmKfoULNe2V8D+JpIcsJWok54rIun70z7bmj78R1VnNe9aADLSGQb0JTYhdaODn9mOnCg=="
+            "keyid": "402c5fa71d8055eadffe3e33d7847e543551d24c002a9adf86286f03eb5e4538",
+            "sig": "ZcTaC2tLzE32o+sIj0qFr9lRWaidilkLf6VkVTt6N3McGnp/lISpE0f+naKlRvvQR70kreVm43mwHeMnLBUPCw=="
           }
         ]
       },
       "newer": {
         "payloadType": "application/vnd.agent-custody.treehead+json",
-        "payload": "eyJyb290SGFzaCI6IjUxY2MyNzIzMzM0NzhmMjYxNDU1MWFmMWM1NjExMzBjOTBlODEwM2JhYmI1NzNkZjY2YjM3ZTVhMDk1YjI0ZWYiLCJ0aW1lc3RhbXAiOiIyMDI2LTA5LTA3VDA4OjM3OjM0LjkzM1oiLCJ0cmVlU2l6ZSI6Mn0=",
+        "payload": "eyJyb290SGFzaCI6IjJlZTc2MmUzYzdlYzdhODE4ODc4MjUwNDhiZGMwZTEyMWFjNDQzM2VjM2FlNjFjYjU5MjM3MWNmYWMxNDVjZmEiLCJ0aW1lc3RhbXAiOiIyMDI2LTA5LTA3VDEzOjQ4OjQyLjQ1M1oiLCJ0cmVlU2l6ZSI6Mn0=",
         "signatures": [
           {
-            "keyid": "48967bd6051d66cebf961f226a6ae4e90dce91ead9ac10c0f9aaa427d40c4c16",
-            "sig": "o/zrDH6/I3VPabSVS4RozKm945Nd+hiwt6JTytpyMavxizlR8ZuGmG6lX56+A0M4wAk/H0qmmHXoLCGuobhdCw=="
+            "keyid": "402c5fa71d8055eadffe3e33d7847e543551d24c002a9adf86286f03eb5e4538",
+            "sig": "++9Ra+7i8vejqY418WnWH4CXA9Rxgb/gDHWrEWgZLYpSPjOdbEXB3XlEArIKaP3+I19eTjK4EQQ07mI2WM3ZCQ=="
           }
         ]
       },
       "proof": [
-        "e74d1e2874003df276b93e2e764da876201bcc1a9efe8752118676eafc4ce5eb"
+        "ae2d0fcc4034cc32db9e07e9f039358baaef3ae6e22533b9c273ee9042a51d5b"
       ],
       "keys": [
         "app"
@@ -114,21 +114,21 @@
       "description": "A proof with a hash removed.",
       "older": {
         "payloadType": "application/vnd.agent-custody.treehead+json",
-        "payload": "eyJyb290SGFzaCI6IjY4ODlmODQyNmVkODg4YTVlNzI0Y2YzNThlNmI0Y2E3ZmI3YWVmMTkwODkxOWE5MGYxZjNlNzFjMWU3MmNkODUiLCJ0aW1lc3RhbXAiOiIyMDI2LTA5LTA3VDA4OjM3OjM0LjkyOVoiLCJ0cmVlU2l6ZSI6MX0=",
+        "payload": "eyJyb290SGFzaCI6ImFmYjZhMmJjNThiZmQwNDk4YWNjZTZiYTY1MTAxM2IwY2JiYjlmNTI1MWM1NTI0Nzg3NGY5ZWYzOGM3YjAxMjMiLCJ0aW1lc3RhbXAiOiIyMDI2LTA5LTA3VDEzOjQ4OjQyLjQ0OVoiLCJ0cmVlU2l6ZSI6MX0=",
         "signatures": [
           {
-            "keyid": "48967bd6051d66cebf961f226a6ae4e90dce91ead9ac10c0f9aaa427d40c4c16",
-            "sig": "FL7TL3y1JgXinAkxywmKfoULNe2V8D+JpIcsJWok54rIun70z7bmj78R1VnNe9aADLSGQb0JTYhdaODn9mOnCg=="
+            "keyid": "402c5fa71d8055eadffe3e33d7847e543551d24c002a9adf86286f03eb5e4538",
+            "sig": "ZcTaC2tLzE32o+sIj0qFr9lRWaidilkLf6VkVTt6N3McGnp/lISpE0f+naKlRvvQR70kreVm43mwHeMnLBUPCw=="
           }
         ]
       },
       "newer": {
         "payloadType": "application/vnd.agent-custody.treehead+json",
-        "payload": "eyJyb290SGFzaCI6IjUxY2MyNzIzMzM0NzhmMjYxNDU1MWFmMWM1NjExMzBjOTBlODEwM2JhYmI1NzNkZjY2YjM3ZTVhMDk1YjI0ZWYiLCJ0aW1lc3RhbXAiOiIyMDI2LTA5LTA3VDA4OjM3OjM0LjkzM1oiLCJ0cmVlU2l6ZSI6Mn0=",
+        "payload": "eyJyb290SGFzaCI6IjJlZTc2MmUzYzdlYzdhODE4ODc4MjUwNDhiZGMwZTEyMWFjNDQzM2VjM2FlNjFjYjU5MjM3MWNmYWMxNDVjZmEiLCJ0aW1lc3RhbXAiOiIyMDI2LTA5LTA3VDEzOjQ4OjQyLjQ1M1oiLCJ0cmVlU2l6ZSI6Mn0=",
         "signatures": [
           {
-            "keyid": "48967bd6051d66cebf961f226a6ae4e90dce91ead9ac10c0f9aaa427d40c4c16",
-            "sig": "o/zrDH6/I3VPabSVS4RozKm945Nd+hiwt6JTytpyMavxizlR8ZuGmG6lX56+A0M4wAk/H0qmmHXoLCGuobhdCw=="
+            "keyid": "402c5fa71d8055eadffe3e33d7847e543551d24c002a9adf86286f03eb5e4538",
+            "sig": "++9Ra+7i8vejqY418WnWH4CXA9Rxgb/gDHWrEWgZLYpSPjOdbEXB3XlEArIKaP3+I19eTjK4EQQ07mI2WM3ZCQ=="
           }
         ]
       },

package/vectors/canonical.json

@@ -53,18 +53,18 @@
     }
   ],
   "keyid": {
-    "publicKeyPem": "-----BEGIN PUBLIC KEY-----\nMCowBQYDK2VwAyEADBTs73puK6sTeOys85s6w1yJCBPt+eiQheOIszKqBiU=\n-----END PUBLIC KEY-----\n",
-    "keyid": "9dd265bc328e448488e35ec8ca89cc3b4270bfc6c8a0ba01845bb8867f1c7c60"
+    "publicKeyPem": "-----BEGIN PUBLIC KEY-----\nMCowBQYDK2VwAyEAPkUEkHrnkfYttWXvl/rsSvOqIW8k0HvjQknUWhsI0tI=\n-----END PUBLIC KEY-----\n",
+    "keyid": "b8f05ee956d16bc7e981e1cc6e62739623e3a169d8e14aa43d2c2b32ce956b44"
   },
   "dsse": {
-    "publicKeyPem": "-----BEGIN PUBLIC KEY-----\nMCowBQYDK2VwAyEADBTs73puK6sTeOys85s6w1yJCBPt+eiQheOIszKqBiU=\n-----END PUBLIC KEY-----\n",
+    "publicKeyPem": "-----BEGIN PUBLIC KEY-----\nMCowBQYDK2VwAyEAPkUEkHrnkfYttWXvl/rsSvOqIW8k0HvjQknUWhsI0tI=\n-----END PUBLIC KEY-----\n",
     "envelope": {
       "payloadType": "application/vnd.example+json",
       "payload": "eyJoZWxsbyI6IndvcmxkIn0=",
       "signatures": [
         {
-          "keyid": "9dd265bc328e448488e35ec8ca89cc3b4270bfc6c8a0ba01845bb8867f1c7c60",
-          "sig": "6zlQBbpy7oGNtH2d5gJ5ZmHzrKIjF8gT0XDkjhzafjCWWphFCcyZaVzZumJOjl6hnhzvu73FgHenAjyImMA0Cg=="
+          "keyid": "b8f05ee956d16bc7e981e1cc6e62739623e3a169d8e14aa43d2c2b32ce956b44",
+          "sig": "sSViplEmHbNqomtr8I67F+jIH8JDbmFhGkioDN8nXxpb1yg21/FLP2wqBVHrTMveuCtF4O+EoxO7dlBITeoIBw=="
         }
       ]
     },