@aikdna/kdna-core 0.15.2 → 0.15.4

package/CHANGELOG.md

@@ -1,5 +1,33 @@
 # Changelog
 
+## v0.15.4 (2026-06-28)
+
+Audit follow-ups (2026-06-28 round-trip verification). This release
+keeps the canonicalisation paths in sync across producers (studio-cli
+`manifestForSigning`, kdna-cli `publish.js#manifestForSigning`,
+kdna-studio-core `buildPayload`, kdna-core's own verifier) so a
+signature generated by one tool is accepted by every other.
+
+- **manifestForSignature now recursively strips `authoring.content_digest`.**
+  Prior version only stripped the top-level content_digest. The digest
+  builder (`manifestForDigest`) has always stripped the nested field
+  too, so a manifest that contained an `authoring` block with a
+  `content_digest` would hash differently for signing vs. digest and
+  report a false-positive verification failure.
+- **asset-reader canonicalisation is now the single source of truth**
+  for the list of fields the signing payload excludes. Documented
+  in `docs/CANONICALIZATION.md`.
+
+## v0.15.3 (2026-06-27)
+- Fix (PC-2, real): `renderPromptItem` now actually ships the
+  boundary card branch. The previous v0.15.2 release (ee20c5e)
+  bumped package.json and added a CHANGELOG entry but did NOT
+  include the source change to `src/v1/index.js`. This release
+  re-bundles the fix that landed in 46047fb (PC-1/PC-4 cleanup).
+  Verified end-to-end: `kdna-studio card add boundary` with
+  non-empty `scope` + `out_of_scope` → `kdna load` now prints
+  `in scope: X; out of scope: Y` instead of the UUID `id`.
+
 ## v0.15.2 (2026-06-27)
 - Fix (PC-2): `renderPromptItem` now renders boundary cards as
   `in scope: X; out of scope: Y; exceptions: ...` instead of

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aikdna/kdna-core",
-  "version": "0.15.2",
+  "version": "0.15.4",
   "description": "KDNA Core library for validating, planning, and loading local .kdna judgment assets.",
   "engines": {
     "node": ">=18.0.0"

package/src/asset-reader.js

@@ -204,6 +204,14 @@ function buildContentDigest(asset) {
 }
 
 function manifestForSignature(manifest, { stripDigestFields = true } = {}) {
+  // Mirrors manifestForDigest above. The two must agree on every field
+  // they strip, or the signing and digest paths will hash different
+  // representations of the same manifest and verifiers will report a
+  // mismatch on otherwise-valid assets.
+  //
+  // Bug: prior version omitted the `authoring.content_digest` strip
+  // that manifestForDigest performs, so the signing payload included
+  // a digest field that the digest payload did not.
   const copy = { ...(manifest || {}) };
   delete copy.signature;
   delete copy._source;
@@ -211,6 +219,11 @@ function manifestForSignature(manifest, { stripDigestFields = true } = {}) {
     delete copy.asset_digest;
     delete copy.container_sha256;
     delete copy.content_digest;
+    if (copy.authoring && typeof copy.authoring === 'object') {
+      const auth = { ...copy.authoring };
+      delete auth.content_digest;
+      copy.authoring = auth;
+    }
   }
   return copy;
 }

package/src/v1/index.js

@@ -1509,6 +1509,30 @@ function renderPromptItem(item) {
     if (item.failure_risk) parts.push(`failure risk: ${item.failure_risk}`);
     return parts.join(' — ');
   }
+  // Boundary card: kdna-studio writes { id, scope, out_of_scope,
+  // acceptable_exceptions }. Render the scope/out-of-scope rule
+  // instead of falling through to the UUID `id` (which was the
+  // v0.15.0 behavior and made boundaries unreadable in
+  // `kdna load --as=prompt`).
+  if (
+    item.type === 'boundary' ||
+    (item.scope !== undefined && item.out_of_scope !== undefined)
+  ) {
+    const parts = [];
+    if (item.scope) parts.push(`in scope: ${sanitizePrompt(item.scope)}`);
+    if (item.out_of_scope) parts.push(`out of scope: ${sanitizePrompt(item.out_of_scope)}`);
+    if (Array.isArray(item.acceptable_exceptions) && item.acceptable_exceptions.length) {
+      parts.push(`exceptions: ${item.acceptable_exceptions.map(sanitizePrompt).join('; ')}`);
+    }
+    if (parts.length === 0) {
+      // Boundary card with empty scope/out_of_scope: surface as
+      // "(boundary card with empty scope)" instead of falling through
+      // to the UUID `id`. The author should fill in scope/out_of_scope
+      // before publishing.
+      return '(boundary card with empty scope)';
+    }
+    return parts.join('; ');
+  }
   if (item.boundary && item.one_sentence) return `${item.one_sentence}: ${item.boundary}`;
   if (item.stance) return item.stance;
   if (item.statement) return item.statement;
@@ -1521,8 +1545,16 @@ function renderPromptItem(item) {
   if (item.one_sentence) return item.one_sentence;
   if (item.essence) return item.essence;
   if (item.question) return item.question;
-  if (item.id) return item.id;
-  return JSON.stringify(item);
+  // Last-resort fall-through. Returning the id (e.g. "bo_xxxx-...") makes
+  // the output unreadable; prefer a note that the card is unrecognized.
+  return `(unrendered card: ${item.type || 'unknown'})`;
+}
+
+function sanitizePrompt(s) {
+  if (s === undefined || s === null) return '';
+  if (typeof s === 'string') return s;
+  if (Array.isArray(s)) return s.map(sanitizePrompt).join('; ');
+  return String(s);
 }
 
 function loadAuthorized(inputPath, opts = {}) {