@agent-custody/receipts 0.5.9 → 0.6.0

package/dist/gateway.js

@@ -57,24 +57,16 @@ function extractValue(result) {
         return text.text;
     }
 }
-export async function createGateway(cfg, options = {}) {
+export async function createGatewayHost(cfg, options = {}) {
     const gatewayKey = loadPrivateKey(cfg.identity.keyFile);
     const trusted = cfg.trustedPrincipalKeys.map(loadPublicKey);
-    const grantEnvelope = JSON.parse(readFileSync(cfg.grantFile, "utf8"));
-    const grant = verifyDelegation(grantEnvelope, trusted);
-    if (!grant.ok)
-        throw new Error(`delegation grant rejected: ${grant.error}`);
-    if (!delegationValidAt(grant.delegation, new Date().toISOString()))
-        throw new Error("delegation grant is outside its validity window");
-    const delegation = grant.delegation;
-    const principalKeyid = grant.keyid;
     const policyText = readFileSync(cfg.policyFile, "utf8");
     const pDigest = policyDigest(policyText);
     const issuer = createIssuer(gatewayKey, cfg.receiptsDir, options.log ?? openLog(cfg, gatewayKey), { exporter: options.exporter ?? openExporter(cfg) });
     const precommit = new Set(cfg.precommit);
     const consequential = (tool) => precommit.has("*") || precommit.has(tool);
-    // One gateway, one grant, one session, and as many upstreams as the agent's job needs. Each tool name belongs to
-    // exactly one upstream, decided at startup, so a receipt's tool is unambiguous and consumed facts flow across them.
+    // One host, as many upstreams as the agents' jobs need. Each tool name belongs to exactly one upstream, decided at
+    // startup, so a receipt's tool is unambiguous and consumed facts flow across them.
     const upstreamConfigs = cfg.upstreams ? cfg.upstreams.map((u) => ({ name: u.name, cfg: u })) : [{ name: "upstream", cfg: cfg.upstream }];
     const upstreams = new Map();
     const owner = new Map();
@@ -128,124 +120,161 @@ export async function createGateway(cfg, options = {}) {
         }
         return facts;
     }
-    /** Every fact id an upstream has declared it served, in order of first sight. One gateway process is one agent session. */
-    const consumed = [];
-    const noteServedFacts = (result) => {
-        const ids = result._meta?.[FACTS_META_KEY];
-        if (!Array.isArray(ids))
-            return;
-        for (const id of ids)
-            if (typeof id === "string" && !consumed.includes(id))
-                consumed.push(id);
-    };
-    async function handleCall(params) {
-        const tool = params.name;
-        const args = params.arguments ?? {};
-        const receiptId = randomUUID();
-        const timestamp = new Date().toISOString();
-        const modelClaim = params._meta?.[MODEL_META_KEY];
-        // What the agent had been shown before this call; recorded before this call's own result is seen.
-        const consumedNow = [...consumed];
-        const upstreamMeta = { [RECEIPT_META_KEY]: receiptId, [AGENT_META_KEY]: delegation.agent, [PRINCIPAL_META_KEY]: delegation.principal };
-        let facts = {};
-        let policy;
-        let execution;
-        let authorization;
-        if (!delegation.scopes.includes(tool)) {
-            policy = { decision: "deny", reasons: [], errors: [`tool "${tool}" is not in the delegation scopes`], policyDigest: pDigest };
-        }
-        else {
-            try {
-                facts = await gatherFacts(tool, args, upstreamMeta);
-                const factValues = Object.fromEntries(Object.entries(facts).map(([k, f]) => [k, f.value]));
-                policy = evaluate(policyText, {
-                    agentId: delegation.agent,
-                    tool,
-                    context: { args, facts: factValues, grant: { principal: delegation.principal, scopes: delegation.scopes } },
-                });
+    function open(grantEnvelope) {
+        const grant = verifyDelegation(grantEnvelope, trusted);
+        if (!grant.ok)
+            throw new Error(`delegation grant rejected: ${grant.error}`);
+        if (!delegationValidAt(grant.delegation, new Date().toISOString()))
+            throw new Error("delegation grant is outside its validity window");
+        const delegation = grant.delegation;
+        const principalKeyid = grant.keyid;
+        /** Every fact id an upstream has declared it served to this session, in order of first sight. A session is one agent under one grant. */
+        const consumed = [];
+        const noteServedFacts = (result) => {
+            const ids = result._meta?.[FACTS_META_KEY];
+            if (!Array.isArray(ids))
+                return;
+            for (const id of ids)
+                if (typeof id === "string" && !consumed.includes(id))
+                    consumed.push(id);
+        };
+        async function handleCall(params) {
+            const tool = params.name;
+            const args = params.arguments ?? {};
+            const receiptId = randomUUID();
+            const timestamp = new Date().toISOString();
+            const modelClaim = params._meta?.[MODEL_META_KEY];
+            // What the agent had been shown before this call; recorded before this call's own result is seen.
+            const consumedNow = [...consumed];
+            const upstreamMeta = { [RECEIPT_META_KEY]: receiptId, [AGENT_META_KEY]: delegation.agent, [PRINCIPAL_META_KEY]: delegation.principal };
+            let facts = {};
+            let policy;
+            let execution;
+            let authorization;
+            if (!delegation.scopes.includes(tool)) {
+                policy = { decision: "deny", reasons: [], errors: [`tool "${tool}" is not in the delegation scopes`], policyDigest: pDigest };
             }
-            catch (e) {
-                policy = { decision: "deny", reasons: [], errors: [String(e instanceof Error ? e.message : e)], policyDigest: pDigest };
+            else {
+                try {
+                    facts = await gatherFacts(tool, args, upstreamMeta);
+                    const factValues = Object.fromEntries(Object.entries(facts).map(([k, f]) => [k, f.value]));
+                    policy = evaluate(policyText, {
+                        agentId: delegation.agent,
+                        tool,
+                        context: { args, facts: factValues, grant: { principal: delegation.principal, scopes: delegation.scopes } },
+                    });
+                }
+                catch (e) {
+                    policy = { decision: "deny", reasons: [], errors: [String(e instanceof Error ? e.message : e)], policyDigest: pDigest };
+                }
             }
-        }
-        const head = {
-            receiptId,
-            timestamp,
-            issuer: { kind: "gateway", keyid: issuer.keyid, version: GATEWAY_VERSION },
-            principal: { id: delegation.principal, keyid: principalKeyid, provenance: "attested" },
-            agent: { id: delegation.agent, provenance: "attested" },
-            delegation: { envelope: grantEnvelope, provenance: "attested" },
-            tool: { name: tool, provenance: "observed", ...(owner.has(tool) && upstreamConfigs.length > 1 ? { upstream: owner.get(tool) } : {}) },
-            request: { args, argsDigest: digestOf(args), provenance: "claimed" },
-            facts,
-            consumed: { factIds: consumedNow, provenance: "observed" },
-        };
-        if (policy.decision === "allow" && consequential(tool)) {
-            // A consequential call is committed to the log before it goes out, so that evidence of the side effect exists
-            // before the side effect does. If the log will not take the authorization, the call is not forwarded.
-            try {
-                authorization = await issuer.authorize({ ...head, policy: { ...policy, provenance: "observed" } });
+            const head = {
+                receiptId,
+                timestamp,
+                issuer: { kind: "gateway", keyid: issuer.keyid, version: GATEWAY_VERSION },
+                principal: { id: delegation.principal, keyid: principalKeyid, provenance: "attested" },
+                agent: { id: delegation.agent, provenance: "attested" },
+                delegation: { envelope: grantEnvelope, provenance: "attested" },
+                tool: { name: tool, provenance: "observed", ...(owner.has(tool) && upstreamConfigs.length > 1 ? { upstream: owner.get(tool) } : {}) },
+                request: { args, argsDigest: digestOf(args), provenance: "claimed" },
+                facts,
+                consumed: { factIds: consumedNow, provenance: "observed" },
+            };
+            if (policy.decision === "allow" && consequential(tool)) {
+                // A consequential call is committed to the log before it goes out, so that evidence of the side effect exists
+                // before the side effect does. If the log will not take the authorization, the call is not forwarded.
+                try {
+                    authorization = await issuer.authorize({ ...head, policy: { ...policy, provenance: "observed" } });
+                }
+                catch (e) {
+                    execution = { status: "withheld", reason: `the log did not commit the authorization, so the call was not forwarded: ${String(e instanceof Error ? e.message : e)}`, provenance: "observed" };
+                }
             }
-            catch (e) {
-                execution = { status: "withheld", reason: `the log did not commit the authorization, so the call was not forwarded: ${String(e instanceof Error ? e.message : e)}`, provenance: "observed" };
+            if (execution) {
+                // withheld: nothing was forwarded
             }
-        }
-        if (execution) {
-            // withheld: nothing was forwarded
-        }
-        else if (policy.decision === "allow") {
-            try {
-                // The upstream learns which receipt this call is, and who the grant says is calling. An upstream that keeps
-                // state, such as the memory server, cites the receipt as the source of what it stores.
-                const observed = Object.fromEntries(Object.entries(facts).map(([k, f]) => [k, f.value]));
-                const result = await callUpstream(tool, args, { ...upstreamMeta, [OBSERVED_META_KEY]: observed });
-                const evidence = upstreamEvidenceOf(result);
-                execution = { status: result.isError ? "failed" : "executed", result, resultDigest: digestOf(result), provenance: "observed", ...(evidence ? { upstream: evidence } : {}) };
-                noteServedFacts(result);
+            else if (policy.decision === "allow") {
+                try {
+                    // The upstream learns which receipt this call is, and who the grant says is calling. An upstream that keeps
+                    // state, such as the memory server, cites the receipt as the source of what it stores.
+                    const observed = Object.fromEntries(Object.entries(facts).map(([k, f]) => [k, f.value]));
+                    const result = await callUpstream(tool, args, { ...upstreamMeta, [OBSERVED_META_KEY]: observed });
+                    const evidence = upstreamEvidenceOf(result);
+                    execution = { status: result.isError ? "failed" : "executed", result, resultDigest: digestOf(result), provenance: "observed", ...(evidence ? { upstream: evidence } : {}) };
+                    noteServedFacts(result);
+                }
+                catch (e) {
+                    execution = { status: "error", error: String(e instanceof Error ? e.message : e), provenance: "observed" };
+                }
             }
-            catch (e) {
-                execution = { status: "error", error: String(e instanceof Error ? e.message : e), provenance: "observed" };
+            else {
+                execution = { status: "denied", reason: [...policy.reasons, ...policy.errors].join("; ") || "no permit policy matched", provenance: "observed" };
             }
-        }
-        else {
-            execution = { status: "denied", reason: [...policy.reasons, ...policy.errors].join("; ") || "no permit policy matched", provenance: "observed" };
-        }
-        await issuer.issue({
-            ...head,
-            session: { id: null, toolUseId: null, provenance: "claimed" },
-            model: { id: typeof modelClaim === "string" ? modelClaim : null, provenance: "claimed" },
-            policy: { ...policy, provenance: "observed" },
-            ...(authorization ? { authorization } : {}),
-            execution,
-        });
-        const meta = { [RECEIPT_META_KEY]: receiptId };
-        const refuse = (text) => ({ isError: true, content: [{ type: "text", text: `${text} (receipt ${receiptId})` }], _meta: meta });
-        switch (execution.status) {
-            case "denied":
-                return refuse(`Denied by policy: ${execution.reason}`);
-            case "error":
-                return refuse(`Upstream error: ${execution.error}`);
-            case "withheld":
-                return refuse(`Not executed: ${execution.reason}`);
-            default: {
-                const result = execution.result;
-                return { ...result, _meta: { ...result._meta, ...meta } };
+            await issuer.issue({
+                ...head,
+                session: { id: null, toolUseId: null, provenance: "claimed" },
+                model: { id: typeof modelClaim === "string" ? modelClaim : null, provenance: "claimed" },
+                policy: { ...policy, provenance: "observed" },
+                ...(authorization ? { authorization } : {}),
+                execution,
+            });
+            const meta = { [RECEIPT_META_KEY]: receiptId };
+            const refuse = (text) => ({ isError: true, content: [{ type: "text", text: `${text} (receipt ${receiptId})` }], _meta: meta });
+            switch (execution.status) {
+                case "denied":
+                    return refuse(`Denied by policy: ${execution.reason}`);
+                case "error":
+                    return refuse(`Upstream error: ${execution.error}`);
+                case "withheld":
+                    return refuse(`Not executed: ${execution.reason}`);
+                default: {
+                    const result = execution.result;
+                    return { ...result, _meta: { ...result._meta, ...meta } };
+                }
             }
         }
+        return {
+            agentId: delegation.agent,
+            delegation,
+            async listTools() {
+                return advertised.filter((t) => delegation.scopes.includes(t.name));
+            },
+            handleCall,
+            async close() {
+                // a session holds nothing of its own beyond what it consumed; the host owns the upstreams
+            },
+        };
     }
     return {
-        agentId: delegation.agent,
-        delegation,
-        async listTools() {
-            return advertised.filter((t) => delegation.scopes.includes(t.name));
-        },
-        handleCall,
+        keyid: issuer.keyid,
+        open,
         async close() {
             for (const c of upstreams.values())
                 await c.close();
         },
     };
 }
+/** One gateway for the grant the config names: what `agent-custody gateway` serves over stdio. Closing it closes the host. */
+export async function createGateway(cfg, options = {}) {
+    if (!cfg.grantFile)
+        throw new Error("config needs grantFile for a single-grant gateway; over HTTP each connection presents its own grant");
+    const host = await createGatewayHost(cfg, options);
+    let session;
+    try {
+        session = host.open(JSON.parse(readFileSync(cfg.grantFile, "utf8")));
+    }
+    catch (e) {
+        await host.close();
+        throw e;
+    }
+    return {
+        ...session,
+        async close() {
+            await session.close();
+            await host.close();
+        },
+    };
+}
 /** Exposes the gateway as an MCP server over stdio. Everything diagnostic must go to stderr. */
 export async function serveStdio(gw) {
     const server = new Server({ name: "agent-custody-gateway", version: GATEWAY_VERSION }, { capabilities: { tools: {} } });

package/dist/index.d.ts

@@ -4,6 +4,8 @@ export type { GatewayOptions } from "./gateway.ts";
 export { buildRequest, restUpstream } from "./rest.ts";
 export { openExporter, otlpExporter, spanFor } from "./otel.ts";
 export { hecEvent, splunkExporter } from "./splunk.ts";
+export { GRANT_HEADER, grantHeader, parseGrantHeader, serveHttp } from "./gateway-http.ts";
+export type { HttpGatewayOptions, RunningHttpGateway } from "./gateway-http.ts";
 export { exportLog, formatExport } from "./log-export.ts";
 export type { ExportOptions, ExportResult } from "./log-export.ts";
 export { fileBackend, importLogFile, PostgresLog, PostgresTenancy, RateLimiter } from "./log-store.ts";

package/dist/index.js

@@ -3,6 +3,7 @@ export { AUTHORIZATION_PREDICATE_TYPE, buildAuthorizationStatement } from "./rec
 export { buildRequest, restUpstream } from "./rest.js";
 export { openExporter, otlpExporter, spanFor } from "./otel.js";
 export { hecEvent, splunkExporter } from "./splunk.js";
+export { GRANT_HEADER, grantHeader, parseGrantHeader, serveHttp } from "./gateway-http.js";
 export { exportLog, formatExport } from "./log-export.js";
 export { fileBackend, importLogFile, PostgresLog, PostgresTenancy, RateLimiter } from "./log-store.js";
 export { connectSigner, fetchLogKeys, localSigner, serveSigner, signerHandler } from "./signer.js";

package/dist/verify.js

@@ -1,6 +1,6 @@
 // Independent verification of a receipt bundle. Needs only public keys, and optionally a copy of the log.
 import { canonicalize, digestOf, dsseVerifiers, dsseVerify } from "./crypto.js";
-import { delegationValidAt, verifyDelegation } from "./delegation.js";
+import { decodeDelegation, delegationValidAt, describeChain, verifyDelegation } from "./delegation.js";
 import { leafHash, MerkleLog, verifyConsistency, verifyInclusion } from "./log.js";
 import { checkProvider, checkUpstream, contentDigest, isProviderAttestation } from "./upstream.js";
 import { AUTHORIZATION_PREDICATE_TYPE, RECEIPT_PREDICATE_TYPE, RECEIPT_TYPE, TREEHEAD_TYPE } from "./receipt.js";
@@ -31,6 +31,11 @@ export function verifyBundle(bundle, opts) {
     if (p.delegation) {
         const del = verifyDelegation(p.delegation.envelope, opts.principalKeys);
         add("delegation signature (principal key)", del.ok, del.ok ? `signed by ${short(del.keyid)}` : del.error);
+        // A chained grant: every link signed by the key its parent names, scopes and windows nested, one principal
+        // throughout. The line appears only when the grant embeds a parent, and fails with the link that broke.
+        const chained = decodeDelegation(p.delegation.envelope)?.parent !== undefined;
+        if (chained)
+            add("delegation chain to the principal", del.ok, del.ok ? `${describeChain(del.chain)} (${del.chain.length - 1} delegation(s))` : del.error);
         if (del.ok) {
             const d = del.delegation;
             const principalKeyid = p.principal.provenance === "attested" ? p.principal.keyid : null;

package/docs/tutorials.md

@@ -29,6 +29,7 @@ Suggested reading order is the numbering. Output lands in `examples-out/`, which
 | 17 | a REST API as an upstream | [17-rest-upstream.ts](../examples/17-rest-upstream.ts) | a stand-in payments API described as two tools, the token from the environment, a refund allowed on the gateway's own lookup and one denied before reaching the API, the receipt verified | `src/rest.ts`, `src/gateway.ts` |
 | 18 | OpenTelemetry export | [18-opentelemetry.ts](../examples/18-opentelemetry.ts) | a stand-in OTLP collector, `otel` in the config, one span per receipt with the receipt id as trace id, the collector going away and the next receipt still issued | `src/otel.ts`, `src/issue.ts` |
 | 19 | Splunk export | [19-splunk.ts](../examples/19-splunk.ts) | a stand-in HTTP Event Collector, `splunk` in the config with the token from the environment, one event per receipt with the receipt id and log position as fields, the collector going away and the next receipt still issued | `src/splunk.ts`, `src/otel.ts` |
+| 20 | one gateway for many agents, over HTTP | [20-http-gateway.ts](../examples/20-http-gateway.ts) | a gateway host served over Streamable HTTP, two agents connecting with their own grants and seeing their own tools, receipts naming the right agent, a refusal by grant, and a stranger's grant getting no session | `src/gateway-http.ts`, `src/gateway.ts` |
 
 ## How policies are defined, in one paragraph
 

package/docs/usage.md

@@ -42,6 +42,8 @@ node src/cli.ts grant \
 
 The gateway refuses to start if the grant is outside its validity window, and every receipt records the grant so a verifier can re-check it.
 
+**Sub-agents.** A grant that names the agent's own public key (`--agent-key agent.pub`, carried as `agentKey`) lets that agent delegate: `agent-custody delegate --key agent.key --parent grant.json --agent refunder --scopes stripe.refund --out refunder.json` signs a narrower grant for the sub-agent with the parent grant embedded. The chain may go three delegations deep. A verifier walks it back to the principal: every link must be signed by the key its parent names, every scope must be one the parent holds, every window must sit inside the parent's, and the principal never changes; the gateway applies the same rule before opening a session, and the receipt names the sub-agent as the agent and the principal as the principal, with the whole chain inside, so `verify` reports `delegation chain to the principal: user_456 → planner → refunder`. Nothing about the tools changes: the sub-agent sees the scopes its own grant names and no more.
+
 **3. Write a policy.** A Cedar file. Default is deny. See [policies.md](policies.md).
 
 ```cedar
@@ -123,6 +125,10 @@ node src/cli.ts gateway --config ./gateway.json
 
 You will not normally run this by hand. The agent host spawns it, as below.
 
+## One gateway for many agents, over HTTP
+
+`agent-custody gateway --config gateway.json --http --port 8790` serves the same gateway as an MCP server over Streamable HTTP at `/mcp`, and every connection presents its own grant: the delegation envelope, base64url-encoded, as `Authorization: Bearer <value>` or `X-Agent-Custody-Grant` on the initialize request. The gateway verifies it against `trustedPrincipalKeys` and its validity window, and opens a session for exactly that grant; a grant signed by a stranger, an expired one, or none at all gets 403 with the reason and no session (403 rather than 401, because MCP clients treat 401 as an OAuth challenge and hide the body). Sessions share the key, the policy, the upstreams, the log, and the fact lookups; each has its own tools (the scopes its grant names), its own receipts (its own principal and agent, attested), and its own consumed facts. `grantFile` in the config is then optional and ignored. A session ends when the client terminates it or after `--idle-minutes` (default 30) without a request; `GET /health` reports the live count and the gateway's key id. The transport is plain HTTP: bind to loopback, a private network, or put TLS in front. From JavaScript, `grantHeader(envelope)` builds the header value; from any language it is `base64url(JSON.stringify(envelope))`. Tutorial 20 runs two agents against one gateway.
+
 ## Wiring it into an agent host
 
 The gateway is an ordinary MCP server, so any host that can launch a stdio MCP server can use it. Point the host at the gateway instead of at the upstream server.

package/docs/verification.md

@@ -70,6 +70,7 @@ execution       observed    executed
 | gateway receipt carries a delegation | gateway receipts always embed the signed grant they enforced | an SDK receipt relabelled as gateway |
 | gateway receipt carries a policy decision | gateway receipts always record the Cedar decision | same |
 | delegation signature (principal key) | the embedded grant was signed by a key you trust as a principal | a grant the principal never issued |
+| delegation chain to the principal | only when the grant embeds a parent: every link is signed by the key its parent names, holds no scope its parent lacks, sits inside its parent's window, and names the same principal, up to three delegations deep | a sub-agent given more than its delegator had, a link signed by the wrong key, a chain that never reaches a trusted principal |
 | delegation binds principal and agent | the grant names the same principal and agent the receipt names, and the principal keyid matches | a valid grant for someone else, spliced in |
 | delegation valid at receipt time | the receipt's timestamp is inside the grant's window | expired or not-yet-valid authority |
 | executed tool within delegated scope | if the tool ran, the grant covered it. Denied calls pass this check by construction | a gateway that forwarded out of scope |
@@ -88,7 +89,7 @@ execution       observed    executed
 | log inclusion proof | this exact envelope is a leaf of the tree with that root | receipt never logged, or logged then changed |
 | log file root matches tree head | recomputing the root from your copy of the log at that size gives the same value | your log copy and the issuer's history diverge: deletion, reordering, or edit |
 
-Gateway receipts run seventeen checks, eighteen with a log file, and five more when the tool was committed before it ran (`precommit` in the gateway config). SDK receipts run fewer, because there is no delegation to check, and the report says so on the `principal is claimed` line.
+Gateway receipts run seventeen checks, eighteen with a log file, and five more when the tool was committed before it ran (`precommit` in the gateway config). SDK receipts run fewer, because there is no delegation to check, and the report says so on the `principal is claimed` line. A receipt issued to a sub-agent under a delegation chain runs one more, `delegation chain to the principal`.
 
 ## What a verified receipt lets you conclude
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-custody/receipts",
-  "version": "0.5.9",
+  "version": "0.6.0",
   "description": "Chain of custody for AI agents: signed, independently verifiable receipts for tool calls. MCP gateway + Cedar policy + Merkle transparency log",
   "license": "Apache-2.0",
   "repository": {
@@ -67,7 +67,7 @@
   },
   "devDependencies": {
     "@langchain/core": "^1.2.9",
-    "@openai/agents": "^0.17.0",
+    "@openai/agents": "^0.18.0",
     "@types/node": "^26.4.1",
     "ai": "^7.0.92",
     "tsx": "^4.23.13",

package/vectors/audit.json

@@ -7,26 +7,26 @@
       "description": "The tree head from the first remote receipt and the log's later head, with the proof the log served.",
       "older": {
         "payloadType": "application/vnd.agent-custody.treehead+json",
-        "payload": "eyJsb2ciOiJ2ZWN0b3JzLWxvZyIsInJvb3RIYXNoIjoiODViYjZhMjk1YzYxYmIzMzg5MWYyNTFiNWNiZGQ4NzNjNGVkYTU5OTBkMWE4MzVjNDRjYjZiMDgwNTBhY2U2MiIsInRpbWVzdGFtcCI6IjIwMjYtMDktMDhUMDY6MzA6MDQuNjkzWiIsInRyZWVTaXplIjoxfQ==",
+        "payload": "eyJsb2ciOiJ2ZWN0b3JzLWxvZyIsInJvb3RIYXNoIjoiNjk4ZjdhMDg4ZWQ3ZGMzNDhiZmNkNDBmZDhhZDUxOGQ3YzMxMjc5MTFhMDYzZjgzOTYxOGY5ZTIzNzg3OTkwMCIsInRpbWVzdGFtcCI6IjIwMjYtMDktMjFUMDk6Mjc6MzIuMTE2WiIsInRyZWVTaXplIjoxfQ==",
         "signatures": [
           {
-            "keyid": "74356bcffe957c1c3a3bde6702505f536d4e8bab2aac3b0f36419e846da1a8d5",
-            "sig": "xhkG/l7l3ElnvGnxrFfK2nYUCkRo0ktj0+6ctv6V1qKiXihMYexcOu/qepdqWWN0mWFq2u8/Aqo6kbdoWhiFDQ=="
+            "keyid": "bb208e67e605dc54aad7c6d6d05cbe6e9531f4d6ef70edd50729f82199fcc5d1",
+            "sig": "tgXaLpauD+TMD8l9+qZCk4dVOlp+bhlwzNYQ/LBN3o9cjQSpeUH2Z1Qriog4jHz3HndJ3eSheBmumin04XrPAw=="
           }
         ]
       },
       "newer": {
         "payloadType": "application/vnd.agent-custody.treehead+json",
-        "payload": "eyJsb2ciOiJ2ZWN0b3JzLWxvZyIsInJvb3RIYXNoIjoiODY0N2E0MTczNTIxYzE5Mzg4NTg2Y2U1MzYyNGU3MGZiYWEyMzc0NGRiYjIzNTQ0ZDU2N2Q5NDY0NmE0ZTM3MiIsInRpbWVzdGFtcCI6IjIwMjYtMDktMDhUMDY6MzA6MDQuNjk3WiIsInRyZWVTaXplIjoyfQ==",
+        "payload": "eyJsb2ciOiJ2ZWN0b3JzLWxvZyIsInJvb3RIYXNoIjoiZTk3YzI5MjBmYTM4MGJiNTVhZjI4ODczZGNhNmY4NzM0ZGFiZTNmYjNmYjZlOWEwYmQ5YTgwNTVkNjJkYzRmYyIsInRpbWVzdGFtcCI6IjIwMjYtMDktMjFUMDk6Mjc6MzIuMTIxWiIsInRyZWVTaXplIjoyfQ==",
         "signatures": [
           {
-            "keyid": "74356bcffe957c1c3a3bde6702505f536d4e8bab2aac3b0f36419e846da1a8d5",
-            "sig": "iaweKtCddKNA0R+dkq+0qyzwe8RhZdKgK6y9o21adUCjhMAGlpl+YDe1chzn4NvT7jIZvn+HDdll136TmqcmCQ=="
+            "keyid": "bb208e67e605dc54aad7c6d6d05cbe6e9531f4d6ef70edd50729f82199fcc5d1",
+            "sig": "D1sCDTur/vV9Agzys9RNyRQjC/z4xJU+Ch1rWRksCx8ISP54+EEL9PlDEKZrAigX6hSim1zai42ssgaR+SdGBQ=="
           }
         ]
       },
       "proof": [
-        "f8e988293efa93dd5e5ea2af96b88588f4a1fba5c786848e997aa985c95e2f81"
+        "00be3e432c1d9e0b24bdd55891e75611b4cc4da06736c2805b27bae2c1e39578"
       ],
       "keys": [
         "log"
@@ -41,26 +41,26 @@
       "description": "The same heads the wrong way round.",
       "older": {
         "payloadType": "application/vnd.agent-custody.treehead+json",
-        "payload": "eyJsb2ciOiJ2ZWN0b3JzLWxvZyIsInJvb3RIYXNoIjoiODY0N2E0MTczNTIxYzE5Mzg4NTg2Y2U1MzYyNGU3MGZiYWEyMzc0NGRiYjIzNTQ0ZDU2N2Q5NDY0NmE0ZTM3MiIsInRpbWVzdGFtcCI6IjIwMjYtMDktMDhUMDY6MzA6MDQuNjk3WiIsInRyZWVTaXplIjoyfQ==",
+        "payload": "eyJsb2ciOiJ2ZWN0b3JzLWxvZyIsInJvb3RIYXNoIjoiZTk3YzI5MjBmYTM4MGJiNTVhZjI4ODczZGNhNmY4NzM0ZGFiZTNmYjNmYjZlOWEwYmQ5YTgwNTVkNjJkYzRmYyIsInRpbWVzdGFtcCI6IjIwMjYtMDktMjFUMDk6Mjc6MzIuMTIxWiIsInRyZWVTaXplIjoyfQ==",
         "signatures": [
           {
-            "keyid": "74356bcffe957c1c3a3bde6702505f536d4e8bab2aac3b0f36419e846da1a8d5",
-            "sig": "iaweKtCddKNA0R+dkq+0qyzwe8RhZdKgK6y9o21adUCjhMAGlpl+YDe1chzn4NvT7jIZvn+HDdll136TmqcmCQ=="
+            "keyid": "bb208e67e605dc54aad7c6d6d05cbe6e9531f4d6ef70edd50729f82199fcc5d1",
+            "sig": "D1sCDTur/vV9Agzys9RNyRQjC/z4xJU+Ch1rWRksCx8ISP54+EEL9PlDEKZrAigX6hSim1zai42ssgaR+SdGBQ=="
           }
         ]
       },
       "newer": {
         "payloadType": "application/vnd.agent-custody.treehead+json",
-        "payload": "eyJsb2ciOiJ2ZWN0b3JzLWxvZyIsInJvb3RIYXNoIjoiODViYjZhMjk1YzYxYmIzMzg5MWYyNTFiNWNiZGQ4NzNjNGVkYTU5OTBkMWE4MzVjNDRjYjZiMDgwNTBhY2U2MiIsInRpbWVzdGFtcCI6IjIwMjYtMDktMDhUMDY6MzA6MDQuNjkzWiIsInRyZWVTaXplIjoxfQ==",
+        "payload": "eyJsb2ciOiJ2ZWN0b3JzLWxvZyIsInJvb3RIYXNoIjoiNjk4ZjdhMDg4ZWQ3ZGMzNDhiZmNkNDBmZDhhZDUxOGQ3YzMxMjc5MTFhMDYzZjgzOTYxOGY5ZTIzNzg3OTkwMCIsInRpbWVzdGFtcCI6IjIwMjYtMDktMjFUMDk6Mjc6MzIuMTE2WiIsInRyZWVTaXplIjoxfQ==",
         "signatures": [
           {
-            "keyid": "74356bcffe957c1c3a3bde6702505f536d4e8bab2aac3b0f36419e846da1a8d5",
-            "sig": "xhkG/l7l3ElnvGnxrFfK2nYUCkRo0ktj0+6ctv6V1qKiXihMYexcOu/qepdqWWN0mWFq2u8/Aqo6kbdoWhiFDQ=="
+            "keyid": "bb208e67e605dc54aad7c6d6d05cbe6e9531f4d6ef70edd50729f82199fcc5d1",
+            "sig": "tgXaLpauD+TMD8l9+qZCk4dVOlp+bhlwzNYQ/LBN3o9cjQSpeUH2Z1Qriog4jHz3HndJ3eSheBmumin04XrPAw=="
           }
         ]
       },
       "proof": [
-        "f8e988293efa93dd5e5ea2af96b88588f4a1fba5c786848e997aa985c95e2f81"
+        "00be3e432c1d9e0b24bdd55891e75611b4cc4da06736c2805b27bae2c1e39578"
       ],
       "keys": [
         "log"
@@ -77,26 +77,26 @@
       "description": "Tree heads checked against the app key, which did not sign them.",
       "older": {
         "payloadType": "application/vnd.agent-custody.treehead+json",
-        "payload": "eyJsb2ciOiJ2ZWN0b3JzLWxvZyIsInJvb3RIYXNoIjoiODViYjZhMjk1YzYxYmIzMzg5MWYyNTFiNWNiZGQ4NzNjNGVkYTU5OTBkMWE4MzVjNDRjYjZiMDgwNTBhY2U2MiIsInRpbWVzdGFtcCI6IjIwMjYtMDktMDhUMDY6MzA6MDQuNjkzWiIsInRyZWVTaXplIjoxfQ==",
+        "payload": "eyJsb2ciOiJ2ZWN0b3JzLWxvZyIsInJvb3RIYXNoIjoiNjk4ZjdhMDg4ZWQ3ZGMzNDhiZmNkNDBmZDhhZDUxOGQ3YzMxMjc5MTFhMDYzZjgzOTYxOGY5ZTIzNzg3OTkwMCIsInRpbWVzdGFtcCI6IjIwMjYtMDktMjFUMDk6Mjc6MzIuMTE2WiIsInRyZWVTaXplIjoxfQ==",
         "signatures": [
           {
-            "keyid": "74356bcffe957c1c3a3bde6702505f536d4e8bab2aac3b0f36419e846da1a8d5",
-            "sig": "xhkG/l7l3ElnvGnxrFfK2nYUCkRo0ktj0+6ctv6V1qKiXihMYexcOu/qepdqWWN0mWFq2u8/Aqo6kbdoWhiFDQ=="
+            "keyid": "bb208e67e605dc54aad7c6d6d05cbe6e9531f4d6ef70edd50729f82199fcc5d1",
+            "sig": "tgXaLpauD+TMD8l9+qZCk4dVOlp+bhlwzNYQ/LBN3o9cjQSpeUH2Z1Qriog4jHz3HndJ3eSheBmumin04XrPAw=="
           }
         ]
       },
       "newer": {
         "payloadType": "application/vnd.agent-custody.treehead+json",
-        "payload": "eyJsb2ciOiJ2ZWN0b3JzLWxvZyIsInJvb3RIYXNoIjoiODY0N2E0MTczNTIxYzE5Mzg4NTg2Y2U1MzYyNGU3MGZiYWEyMzc0NGRiYjIzNTQ0ZDU2N2Q5NDY0NmE0ZTM3MiIsInRpbWVzdGFtcCI6IjIwMjYtMDktMDhUMDY6MzA6MDQuNjk3WiIsInRyZWVTaXplIjoyfQ==",
+        "payload": "eyJsb2ciOiJ2ZWN0b3JzLWxvZyIsInJvb3RIYXNoIjoiZTk3YzI5MjBmYTM4MGJiNTVhZjI4ODczZGNhNmY4NzM0ZGFiZTNmYjNmYjZlOWEwYmQ5YTgwNTVkNjJkYzRmYyIsInRpbWVzdGFtcCI6IjIwMjYtMDktMjFUMDk6Mjc6MzIuMTIxWiIsInRyZWVTaXplIjoyfQ==",
         "signatures": [
           {
-            "keyid": "74356bcffe957c1c3a3bde6702505f536d4e8bab2aac3b0f36419e846da1a8d5",
-            "sig": "iaweKtCddKNA0R+dkq+0qyzwe8RhZdKgK6y9o21adUCjhMAGlpl+YDe1chzn4NvT7jIZvn+HDdll136TmqcmCQ=="
+            "keyid": "bb208e67e605dc54aad7c6d6d05cbe6e9531f4d6ef70edd50729f82199fcc5d1",
+            "sig": "D1sCDTur/vV9Agzys9RNyRQjC/z4xJU+Ch1rWRksCx8ISP54+EEL9PlDEKZrAigX6hSim1zai42ssgaR+SdGBQ=="
           }
         ]
       },
       "proof": [
-        "f8e988293efa93dd5e5ea2af96b88588f4a1fba5c786848e997aa985c95e2f81"
+        "00be3e432c1d9e0b24bdd55891e75611b4cc4da06736c2805b27bae2c1e39578"
       ],
       "keys": [
         "app"
@@ -114,21 +114,21 @@
       "description": "A proof with a hash removed.",
       "older": {
         "payloadType": "application/vnd.agent-custody.treehead+json",
-        "payload": "eyJsb2ciOiJ2ZWN0b3JzLWxvZyIsInJvb3RIYXNoIjoiODViYjZhMjk1YzYxYmIzMzg5MWYyNTFiNWNiZGQ4NzNjNGVkYTU5OTBkMWE4MzVjNDRjYjZiMDgwNTBhY2U2MiIsInRpbWVzdGFtcCI6IjIwMjYtMDktMDhUMDY6MzA6MDQuNjkzWiIsInRyZWVTaXplIjoxfQ==",
+        "payload": "eyJsb2ciOiJ2ZWN0b3JzLWxvZyIsInJvb3RIYXNoIjoiNjk4ZjdhMDg4ZWQ3ZGMzNDhiZmNkNDBmZDhhZDUxOGQ3YzMxMjc5MTFhMDYzZjgzOTYxOGY5ZTIzNzg3OTkwMCIsInRpbWVzdGFtcCI6IjIwMjYtMDktMjFUMDk6Mjc6MzIuMTE2WiIsInRyZWVTaXplIjoxfQ==",
         "signatures": [
           {
-            "keyid": "74356bcffe957c1c3a3bde6702505f536d4e8bab2aac3b0f36419e846da1a8d5",
-            "sig": "xhkG/l7l3ElnvGnxrFfK2nYUCkRo0ktj0+6ctv6V1qKiXihMYexcOu/qepdqWWN0mWFq2u8/Aqo6kbdoWhiFDQ=="
+            "keyid": "bb208e67e605dc54aad7c6d6d05cbe6e9531f4d6ef70edd50729f82199fcc5d1",
+            "sig": "tgXaLpauD+TMD8l9+qZCk4dVOlp+bhlwzNYQ/LBN3o9cjQSpeUH2Z1Qriog4jHz3HndJ3eSheBmumin04XrPAw=="
           }
         ]
       },
       "newer": {
         "payloadType": "application/vnd.agent-custody.treehead+json",
-        "payload": "eyJsb2ciOiJ2ZWN0b3JzLWxvZyIsInJvb3RIYXNoIjoiODY0N2E0MTczNTIxYzE5Mzg4NTg2Y2U1MzYyNGU3MGZiYWEyMzc0NGRiYjIzNTQ0ZDU2N2Q5NDY0NmE0ZTM3MiIsInRpbWVzdGFtcCI6IjIwMjYtMDktMDhUMDY6MzA6MDQuNjk3WiIsInRyZWVTaXplIjoyfQ==",
+        "payload": "eyJsb2ciOiJ2ZWN0b3JzLWxvZyIsInJvb3RIYXNoIjoiZTk3YzI5MjBmYTM4MGJiNTVhZjI4ODczZGNhNmY4NzM0ZGFiZTNmYjNmYjZlOWEwYmQ5YTgwNTVkNjJkYzRmYyIsInRpbWVzdGFtcCI6IjIwMjYtMDktMjFUMDk6Mjc6MzIuMTIxWiIsInRyZWVTaXplIjoyfQ==",
         "signatures": [
           {
-            "keyid": "74356bcffe957c1c3a3bde6702505f536d4e8bab2aac3b0f36419e846da1a8d5",
-            "sig": "iaweKtCddKNA0R+dkq+0qyzwe8RhZdKgK6y9o21adUCjhMAGlpl+YDe1chzn4NvT7jIZvn+HDdll136TmqcmCQ=="
+            "keyid": "bb208e67e605dc54aad7c6d6d05cbe6e9531f4d6ef70edd50729f82199fcc5d1",
+            "sig": "D1sCDTur/vV9Agzys9RNyRQjC/z4xJU+Ch1rWRksCx8ISP54+EEL9PlDEKZrAigX6hSim1zai42ssgaR+SdGBQ=="
           }
         ]
       },

package/vectors/canonical.json

@@ -53,18 +53,18 @@
     }
   ],
   "keyid": {
-    "publicKeyPem": "-----BEGIN PUBLIC KEY-----\nMCowBQYDK2VwAyEA0ZCk/vXbGqi5xjdFAok3XGPWbCT9yO2OeGbMF1nvH5w=\n-----END PUBLIC KEY-----\n",
-    "keyid": "3df0af0ec3abda622a30f7a3273fc6ca4eda229404122f02e2cae12923a861ad"
+    "publicKeyPem": "-----BEGIN PUBLIC KEY-----\nMCowBQYDK2VwAyEA9PR1NM7CAYV6ztqdIxlV8EtbwKt/noC1QE1/uu64w8A=\n-----END PUBLIC KEY-----\n",
+    "keyid": "4b54e3508693bbc3e6236cd42834826ba45205a4e4d3b14a645e12e0d4cc0901"
   },
   "dsse": {
-    "publicKeyPem": "-----BEGIN PUBLIC KEY-----\nMCowBQYDK2VwAyEA0ZCk/vXbGqi5xjdFAok3XGPWbCT9yO2OeGbMF1nvH5w=\n-----END PUBLIC KEY-----\n",
+    "publicKeyPem": "-----BEGIN PUBLIC KEY-----\nMCowBQYDK2VwAyEA9PR1NM7CAYV6ztqdIxlV8EtbwKt/noC1QE1/uu64w8A=\n-----END PUBLIC KEY-----\n",
     "envelope": {
       "payloadType": "application/vnd.example+json",
       "payload": "eyJoZWxsbyI6IndvcmxkIn0=",
       "signatures": [
         {
-          "keyid": "3df0af0ec3abda622a30f7a3273fc6ca4eda229404122f02e2cae12923a861ad",
-          "sig": "aGI6lAPRJs17z+UUezv/7iGyZ1rHbjKRWBELgeC4YjLGytQLUZsH+2jwFKhmTasJIyssry1ob+HMt4V20WCzBQ=="
+          "keyid": "4b54e3508693bbc3e6236cd42834826ba45205a4e4d3b14a645e12e0d4cc0901",
+          "sig": "/xY/5ueLIFwQYepoDm4sOGtxO9MntKEbYV86DwPlcosuIbcc92J2SdItEeSQdE54v5N/LTm2iqk6jMCl1rLVAw=="
         }
       ]
     },