@aleutian/verification 0.0.0 → 0.7.0

package/package.json

@@ -1,12 +1,103 @@
-{  
+{
   "name": "@aleutian/verification",
-  "version": "0.0.0",
-  "description": "Placeholder for Aleutian AI verification SDK. Real SDK lands later.",
+  "version": "0.7.0",
+  "description": "Aleutian AI verification SDK: offline V3 SAR chain entry verification (ML-DSA-65 / FIPS 204), anchor verification, webhook signature verification",
+  "author": "Aleutian AI <jinterlante@aleutian.ai>",
   "license": "Apache-2.0",
+  "keywords": [
+    "aleutian",
+    "verification",
+    "audit",
+    "chain",
+    "anchor",
+    "webhook",
+    "cryptography",
+    "post-quantum",
+    "ml-dsa",
+    "fips204",
+    "sar",
+    "dsar",
+    "gdpr",
+    "v3",
+    "ed25519",
+    "hmac"
+  ],
   "repository": {
     "type": "git",
-    "url": "https://github.com/aleutian-ai/verification-js.git"
+    "url": "git+https://github.com/aleutian-ai/verification-js.git"
   },
   "homepage": "https://aleutian.ai",
-  "keywords": ["aleutian", "verification", "audit", "placeholder"]
+  "bugs": {
+    "url": "https://github.com/aleutian-ai/verification-js/issues"
+  },
+  "type": "module",
+  "main": "./dist/index.cjs",
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "bin": {
+    "aleutian-verify": "dist/cli/aleutian-verify.js"
+  },
+  "exports": {
+    ".": {
+      "browser": {
+        "types": "./dist/browser/index.d.ts",
+        "default": "./dist/browser/index.js"
+      },
+      "import": {
+        "types": "./dist/index.d.ts",
+        "default": "./dist/index.js"
+      },
+      "require": {
+        "types": "./dist/index.d.cts",
+        "default": "./dist/index.cjs"
+      }
+    },
+    "./browser": {
+      "types": "./dist/browser/index.d.ts",
+      "default": "./dist/browser/index.js"
+    }
+  },
+  "files": [
+    "dist",
+    "testdata",
+    "LICENSE",
+    "README.md",
+    "CHANGELOG.md"
+  ],
+  "engines": {
+    "node": ">=19.0.0"
+  },
+  "scripts": {
+    "build": "tsup",
+    "test": "vitest run",
+    "test:browser": "playwright test",
+    "test:watch": "vitest",
+    "test:coverage": "vitest run --coverage",
+    "lint": "eslint src/ test/ --ext .ts",
+    "lint:fix": "eslint src/ test/ --ext .ts --fix",
+    "format": "prettier --write \"src/**/*.ts\" \"test/**/*.ts\"",
+    "format:check": "prettier --check \"src/**/*.ts\" \"test/**/*.ts\"",
+    "typecheck": "tsc --noEmit",
+    "clean": "rm -rf dist coverage",
+    "prepublishOnly": "npm run build && npm run test"
+  },
+  "dependencies": {
+    "@noble/hashes": "^1.5.0",
+    "@noble/post-quantum": "^0.5.4",
+    "tweetnacl": "^1.0.3"
+  },
+  "devDependencies": {
+    "@playwright/test": "^1.60.0",
+    "@types/node": "^20.11.0",
+    "@typescript-eslint/eslint-plugin": "^6.19.0",
+    "@typescript-eslint/parser": "^6.19.0",
+    "@vitest/coverage-v8": "^1.2.0",
+    "eslint": "^8.56.0",
+    "eslint-config-prettier": "^9.1.0",
+    "happy-dom": "^20.9.0",
+    "prettier": "^3.2.0",
+    "tsup": "^8.0.0",
+    "typescript": "^5.3.0",
+    "vitest": "^1.2.0"
+  }
 }

package/testdata/v3_golden_capture_request.json

@@ -0,0 +1,85 @@
+{
+  "$schema_comment": "Cross-language golden vectors for the capture.request.v3 leaf. Each vector's input uses language-neutral snake_case field names; expected_canonical_bytes_hex is the length-prefixed TLV encoding (a 4-field header followed by a 15-field alphabetical body) and expected_content_hash_sha512_hex is SHA-512 of domain_prefix_v3 || canonical_bytes. An implementation in any language should re-encode each input and assert byte-for-byte equality with both. NOTE: the header's first field is serialized in the position it was defined in, under its original name 'company_id'; it is now called 'subject' and the ORDER deliberately did not follow the rename, because these are positional values and moving one would change every content hash ever computed.",
+  "domain_prefix_v3": "aleutian.chain.entry.v3:",
+  "entry_type": "capture.request.v3",
+  "vectors": [
+    {
+      "$comment": "aleutian-managed custody + pii_inspection + full verdict; every field non-empty incl hyphenated trust_level.",
+      "name": "full_pii_inspection",
+      "input": {
+        "company_id": "comp_01HZX9K2M3N4P5Q6R7S8T9V0WA",
+        "signing_key_id": "capture-leaf-signer-2026-v1",
+        "timestamp_ms": 1751068800000,
+        "capture_method": "fetch_intercept",
+        "content_hash": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+        "dlp": "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
+        "encryption_mode": "aleutian-managed",
+        "model": "gpt-4o-2024-08-06",
+        "pii_action": "flagged",
+        "pii_categories": "cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc",
+        "pii_detected": true,
+        "pii_digest_key_version": "sm:v1",
+        "processing_mode": "pii_inspection",
+        "provider": "openai",
+        "region": "us",
+        "source_type": "extension",
+        "trust_level": "self-reported",
+        "user_id": "dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd"
+      },
+      "expected_canonical_bytes_hex": "0000001f636f6d705f3031485a58394b324d334e34503551365237533854395630574100000012636170747572652e726571756573742e76330000001b636170747572652d6c6561662d7369676e65722d323032362d763100000197b3d574000000000f66657463685f696e7465726365707400000080616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616100000080626262626262626262626262626262626262626262626262626262626262626262626262626262626262626262626262626262626262626262626262626262626262626262626262626262626262626262626262626262626262626262626262626262626262626262626262626262626262626262626262626262626262626200000010616c65757469616e2d6d616e61676564000000116770742d346f2d323032342d30382d303600000007666c6167676564000000806363636363636363636363636363636363636363636363636363636363636363636363636363636363636363636363636363636363636363636363636363636363636363636363636363636363636363636363636363636363636363636363636363636363636363636363636363636363636363636363636363636363636363000000000000000100000005736d3a76310000000e7069695f696e7370656374696f6e000000066f70656e616900000002757300000009657874656e73696f6e0000000d73656c662d7265706f72746564000000806464646464646464646464646464646464646464646464646464646464646464646464646464646464646464646464646464646464646464646464646464646464646464646464646464646464646464646464646464646464646464646464646464646464646464646464646464646464646464646464646464646464646464",
+      "expected_content_hash_sha512_hex": "444491ecb9705c9dc27bbaf21aaad3f0fb1ec25398a2e1086bb7f557919b8e0aa12ac6c95d051cccd1263e00f7728d15a35f2bacb2de0f8896bab73e77951c94"
+    },
+    {
+      "$comment": "zero-knowledge custody + zk processing; compliance surface empty (the enforced zk invariant) + all optional fields 0-length.",
+      "name": "minimal_zk",
+      "input": {
+        "company_id": "comp_01HZX9K2M3N4P5Q6R7S8T9V0WA",
+        "signing_key_id": "capture-leaf-signer-2026-v1",
+        "timestamp_ms": 1751068800000,
+        "capture_method": "",
+        "content_hash": "eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee",
+        "dlp": "",
+        "encryption_mode": "zero-knowledge",
+        "model": "",
+        "pii_action": "none",
+        "pii_categories": "",
+        "pii_detected": false,
+        "pii_digest_key_version": "",
+        "processing_mode": "zk",
+        "provider": "",
+        "region": "",
+        "source_type": "",
+        "trust_level": "",
+        "user_id": "ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff"
+      },
+      "expected_canonical_bytes_hex": "0000001f636f6d705f3031485a58394b324d334e34503551365237533854395630574100000012636170747572652e726571756573742e76330000001b636170747572652d6c6561662d7369676e65722d323032362d763100000197b3d5740000000000000000806565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565000000000000000e7a65726f2d6b6e6f776c6564676500000000000000046e6f6e6500000000000000000000000000000000000000027a6b00000000000000000000000000000000000000806666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666",
+      "expected_content_hash_sha512_hex": "1a276c3a214a746c889c1c8e898186d578ba0399529420240e57005c456686375068ac04d1edc441b66faecc7f3bd0634a08a4a1303f2e319f125af9461d9c18"
+    },
+    {
+      "$comment": "inspection authorized but scanner found nothing — empty verdict with processing_mode=pii_inspection (disambiguated from zk by the sealed mode).",
+      "name": "inspected_clean",
+      "input": {
+        "company_id": "comp_01HZX9K2M3N4P5Q6R7S8T9V0WA",
+        "signing_key_id": "capture-leaf-signer-2026-v1",
+        "timestamp_ms": 1751068800000,
+        "capture_method": "fetch_intercept",
+        "content_hash": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+        "dlp": "",
+        "encryption_mode": "aleutian-managed",
+        "model": "gpt-4o-2024-08-06",
+        "pii_action": "none",
+        "pii_categories": "",
+        "pii_detected": false,
+        "pii_digest_key_version": "",
+        "processing_mode": "pii_inspection",
+        "provider": "openai",
+        "region": "us",
+        "source_type": "extension",
+        "trust_level": "self-reported",
+        "user_id": "dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd"
+      },
+      "expected_canonical_bytes_hex": "0000001f636f6d705f3031485a58394b324d334e34503551365237533854395630574100000012636170747572652e726571756573742e76330000001b636170747572652d6c6561662d7369676e65722d323032362d763100000197b3d574000000000f66657463685f696e746572636570740000008061616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161610000000000000010616c65757469616e2d6d616e61676564000000116770742d346f2d323032342d30382d3036000000046e6f6e65000000000000000000000000000000000000000e7069695f696e7370656374696f6e000000066f70656e616900000002757300000009657874656e73696f6e0000000d73656c662d7265706f72746564000000806464646464646464646464646464646464646464646464646464646464646464646464646464646464646464646464646464646464646464646464646464646464646464646464646464646464646464646464646464646464646464646464646464646464646464646464646464646464646464646464646464646464646464",
+      "expected_content_hash_sha512_hex": "40e5c4ce227cf66429f3527aa82d0c0d767e03e767b9cd5c9cb5bc780c41c05043ec6d98bf0a8adc87482261fdedd05770e40a5c1b4dd19a1017e3e8a041e805"
+    }
+  ]
+}

package/testdata/v3_golden_capture_signed.json

@@ -0,0 +1,27 @@
+{
+  "$comment": "chainlinker_modernization_01i signed capture leaf golden vector. Cross-language verify parity (Go/Python/JS). signing_key_id maps to public_key_b64 in a one-entry trust manifest; verify VerifyChainEntryV3(entry, content_hash, signature_b64, manifest) == OK.",
+  "expected_content_hash_hex": "9ca05471cb6d3de9de72f747bff4e7218654082eb4768c0fb835089a03c49a05883217bf5236ba63dfdfb0b48deede08559b4bdfd748d7af46d49ceb9952559e",
+  "input": {
+    "capture_method": "fetch_intercept",
+    "company_id": "comp_01HZX9K2M3N4P5Q6R7S8T9V0WA",
+    "content_hash": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+    "dlp": "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
+    "encryption_mode": "aleutian-managed",
+    "model": "gpt-4o-2024-08-06",
+    "pii_action": "flagged",
+    "pii_categories": "cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc",
+    "pii_detected": true,
+    "pii_digest_key_version": "sm:v1",
+    "processing_mode": "pii_inspection",
+    "provider": "openai",
+    "region": "us",
+    "signing_key_id": "test-signer-2026-v1",
+    "source_type": "extension",
+    "timestamp_ms": 1751068800000,
+    "trust_level": "self-reported",
+    "user_id": "dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd"
+  },
+  "public_key_b64": "sOrXgK8nt/l0UyzYW/P4YBC1cYJsn6uogYOuJ7l0YwkmnTWTxwAaN1W0HT60K3rrFyyze/0hnIfyP9frre7aemAjmskGTCjLgPPNlQgamgKejoizYjGTAXgiVBSJL/llQF91SY+yzBse6yHVLVBgLaHtLuw8Bg/wnzK4DQZ0LuT0mAtBlRTGaAXzcuAh5x/f/+dUptWdEdMuSVipsJ2UCz9yKZvGlIngPdc8uPYPMuT3Eq5GD+qC/pKKCqvSUYF7W3Q2JWq0hsxq0ong7bkXvx4FHzCjkVyHhxQPpW8m8iW+djxXzD9BpKn7tplXcw0I5VkY5lFrC8BAe9ji9ujHpaqcQbF+oBGM7/9/c65hASWaO8vwP97z0Fy73cLMcVg/dULLVpph4xFCinOzFh+q+88ZX0Tlxn3kgXUrBBhIyZtw/EEmF0BSVNGkzxc/Pfc4t2WCg1BZNz4+xetzaxBzRbqP2w/GgIcmuvmPm871LPRnP+/yTxU7wFFGb49CQglRPRQTWamuZTF0ZNKkG/c9nagbkLYLEYGroqKLC2ZZYKolHSTCI1iXr/QQILDx5+gpDYzmB3qt4h5eN2UO9s8nCgRP+E84KSz7JGaxhKyPa4czhKswOt26gMP0Lo2E7bAW+UhmSK29sA+yeRYYaXXM/6QKcRI9eYTpenDI00NjaIacgJvJb1nGwDaAm0BR0WPpeCbpT+NJ1cL2z1VEWdrQzkBNQFKIeJaJexlWIZBmHlFvTyg8ObqQMPV4WF0//cyaKOV2JbaCx4NRUZQL9xNmFHeds0IU6xeTuFRMgRK4bnzHuIOQnUDWJik2xi0AK7ZC0RY5J5XlC4oWA+ARDY0EbooFrx65DLbTCKLT/WueIn8K4vS97jHSfS8MYGms+iGqT6VsHdYEoQaRA/bMgG33KwwxMvzUohOzcuQ8Q2uPsUMrDWSCesq/7u4FzOEqJuFU1svD1++W1uVmJaEK+2UKMZOUufY6C0ZbzllL06rJeHOHO6Gnjyd8AApqCBGSndOX4HmgCtCtRRTR2cq4epCQbcsR9b5DQ2CVm7PNxmnhFE4hZS5GXHejBFp0IbJoc/vUiZHbTUtm+wW8LzD91zCHQMJqHyUlY6t9s04QIqhpwV3A8bUXCc/TTkwdiTJljKCs4OwmIkd2YaAV65REtvRmsfNiyREnEOZtBoHLr8/38XeODkFpBqddUYg/YtTA2xmQ5IezymvlJqWa1KmWoK4nXPlUPSmZ2qbOvDFT9ZZ2Qu+M1QKiJO/qUHrG9Ym4sEtCJjxUs8ch6/GxEsi5H5KGXI8e9pY2S0NTjWOJP1QCkYMoFt1oJ9c32C3dhbZjf1ERYlWUxTH90xbMQflUGzTFEWTSENPZii6ZMCRM66sSrDUuTew1OR/H6d9T3KTVoXO1tb68fyyRzqtgXWComBuVgANRJ51BnmS42xsqcwrGHpvWDaEVIRWrLr7ZGhnV+WXNIWd9ip+42WYHV1py+1THwdqbScasguL5Zgo0wVRUd589cTBGkx6dwNQsqgPvK0RhWsVIYOwV4GjzD3ChUPCekCZhxT3CuJvPSsv5RlKfRCe0MCVmHOoQug8dnAtV/my9migRjCxDViL/VQcOGU4cfX4iiJCFQCUnAwBtITzVGDsiaKOtVEzYpOuOGl3eruTY8oJu5dJtE8hiViMcmjllyI6iSU7yUY77hzkHvBIOpaWmwyN+jvxtGTeDOz7ZDv/VFH/Glc9H+5RJNEv3JcHrJInRw7CApiwSMB3gj94XRvR++4yq4+Sq3KuYyCtZnSP1TUkUOju7Nzbxv4A6PM8EbulaSMbR8I2otBW9HySEKhCv/oxQID8tT6jiKPsomqAbyx3HyvhiKE5iIALKDTBmvSrPn6/BJe0iuQ059/NMp3c5LK0TWHkLimF3OBujhC0soBAUTlijGkCHjmg2wMRGtx4eRTWYiVJdzlEd1Bdiw43p0Ms6Bd6/bcnMNWH4Kn4S/f8dS9AIKAl11kovd1m5WfEQkPAtHyay/Y+dHNGbAKgHeHz/PRBTnGs38eey+Xph5J4jR3OzzgyUm3BOFbs90RpDpQZnMamDcxmzG506TwP4EIw8k7PgwnX+r8URcqYRrs+QXLn44Q2WTQXOjZsQEBGyYcScQLViPyL4p5RbuAjrPPzrpwL5NKqebUgpGouGrQ+dlzYALQTUtslvOx25o50NgtnY+VaZ1DdEPzIl7GWRPy/CyVhbL2nawQL0GVnu7H//W28M1SOPhFgBNwo+F3t4z2s3QuApQQAL/Bmdxip57ZpB4ZzSddwqqQeaUScuxaEPtPM78aDDNbnf97Yxm4DMpTu5ydgNylCr3lp3wAEFFbXuEEL833yZUDLpReDN5XQbc/NZymBvOVQ3BOxtX8L6GBUynXWr1FRSr1Gy61H1EDttr2/qDvsM7Dzi+Gdfkqz9dqPREM3WgJUTs3aU9qaX3i7+8E0BEoqN1IvNkMHiHQoobtYSwhzmb28ohLcb0/iWNigFSx7YJsvMGVvnLRtq7xpTHqRVfdku4ndMPIpJArUyJMIgE6+6nh8frIO1ehw1GTXvVpyDYaTfNNZCOchlUvV18a102Qzei+KpPsE=",
+  "signature_b64": "KuQNpvR3n3C1EiKcOKLKiwhspb9R5GBviM6RqVNSOAICbiIRpfg1lg/Oh3o1/RwkLCKHIXUQ8Dh6ghZzC889rsR/Q82lg7hF+rCXxxonaSsSsfEo35tFu8Sy4wCK7e6XCzV7rzHqHtPFh2ngXhmBSF2N4+nkpnm5ikaNmWRT/6EECRGkUCj7tzfDtnW7M+AOarMDiCvbmNgcn2w96XJAbRzwW8LPv6GI3YgPlTcU4lTBgodoW8U0XfxreGl8PYX1teGrWVhnmCLxGgesVb0zQmV3hN1E/2zH9WBpeKZtyzyo2jAiUr2neqGD6oaOd/OenlWkbbME9CxhmtKOn35TsnqR3mdAe3fHmL+Xgpj9ka7Xjb9GHwimLFekY+ZsiPd4oq1H0JqOezAq8rLIh/bcrLd7S1yvUKihg2XIE2xGpiUnqwZaO5qH39rEACndqtlB0ZkAjS/mNZbq1o1ecFRolSvxMgfjdHL5bdvB8m7CBHKSy8ezz5BMe/zjIKef0do+Zh+ijMfqLRORIv3NYVodI7k3E6Fwf7bR+sGK6HLoxSpllhdQgQoERWXkWRYmTECMdHmSBEf4LWC6PdBNvtnAjW18aRYT5wGcmyUWXB9zCXuu67ku07WnZTRNxG0LqjOLTrWUtBfrFtAUTVypVR5aKPxWXElY1JYY5X4Oa43req+6dimIb5FBsVxH2u5LJgsJs1UVKadW3Q5Ll+PEwp88rtdvZTImsykI1Kt5B46Mg7L6Yia3Eb9WEw2NHuX/dc1BrL9yOFVIYXNb787QbXYQ044ZQ2V86g6pGRafF1M1M0cX/vcKu0kP57cEThD8V9ff4JUkrrqzCBCPn+YOO4JXZTXSE/lZ7S3BnLHQ7CKtC3LyZaZ0iaFWMKYJ0Z1CpbzvASgX6llpr3LaDKxcw3qva5fcBZlY9bF23Owin75uFGH4iFyJnI/SolDTEfZ0ymCho5EMb0KIpcWUFK18zRgyJC/y5ogvdrE6KkPZWVA0pvLReZE7SxoHX93+PK+IDmoY2sjXqSYyrvnMDFR1xPA5rT90w0rhLV/33tV6A84ptI4Lsc5D6cJYDUKbcJYUV3lStpIuu0ZlSUI4/zqXqhtAGLy2g4WkLCLxux1JzqXTJJWYoug79QTUZJ7iBaedE9Wd/TjvSOLw0vskgNrBo58EgPTUZVozuu9xbzR1+O1ewBONbiQNRd0siBXFyZdeUJyx7SSt1343mwE8eiO2gqTE0K/y2HT2MAhoeGk5djEbSQN5xXTDKNY1Ek/3226m5ZlZTK8hR6lgfkkeTNITzrhtXsmmclRD8kTIskszFaPxIR8tPaO1641OFAgWbn0i0l+wVZsjTxUQChflLGTIoPqK920XCvGVPJDjtUYx8FYGBaomzq5OJa1MvKWJsMpgU65WuDaobSBDwGOF/RBv1Xl6x3FIJQoNZoR8HXog2fgpQ0Pb/TVMn6izwLtAZrkr+eVMcY9ofI63exf4VP7tOmbDofs2zU8oYM6XZcDA6+0BuSqsOBrqMAAYsqOIBlt8zQZkaezA80Llzs6WvfI9syL68qgZ72PKH4onXFsgSiBKZu9NvNwaYQXcIHCKS/r/HzMOLaMMxz8cDlqQAnINSsJetxUCbKdXtCa9vXhpOP8n6gdhW+QItQpUaykYgHe/LrlginX4Vw9f5d3uPJeWxu2HuvIur9q29mMWHvrD3rTWm+fhH5mEgvz5uftqcYZf6OTk9dxH2whSO7avTOqx7xJgf/W8K0ITsT0+43ETn4ZBPhgb3Byv/x+a5b6wyP3Im2DGcJQyYvzBpNg6v3Sg65OIMVy5d8dylg3Uzrfn5mdr8S5EFFgGC02hjw89WZwk82QHgQmXdaHFErMCEZEVdR8X+JzNrXALx2ckDM5a02aJgnu5hztJnRYn8RGnqPA8sJN79AUlQIETk1USi27hgFluWdS0lCSpiRJN5Qjim31B6R7uQRZimoft/hkZL8c5E+mN6Mv2Y9IjiRuPtLVNmarvGwssvPhXdNXJAxmK/rzwa65SI/Sr2zCbLHX5J6WF//7EmnIBmtWsOYjvIu8IsQ6oZV7P6JPaV6IW2ATSKPrYC5I2dSX2yigRjMo82vKmAdSMeYKi2nsfBH1gaegcF5N/DJel8tV4P32qXqZKbyoqYAglkc5w/lcFxnL5tDbbdubDE/EnkrPXQ1HmI81bn5c1a8sZmNUkFthELar9DdDScowT2TGolUCdMxNuQV2DH0l37XqcsGeXhnbAcULwmpkrse8pw9gagzDWGBlA7LN0UbdNChkWhey52OM8afj2yAjOMuw1W3heRCDIM+gJ2THFdUhiGCAN3HjCn3hjhvmasvGisbVbfYPVi1nADaQxUAXTt3O+djbl4TKIhXONatJ49a9n9ZdcFks4WBo35vmORrOBocFfMsIBE6x7oqXNNZjF9VeA6eakSY/8rMfbVx/4pGm3gJDQtg5cgSKjG3Z6mFCdfymUohGuviUIeJVXJGUn2ddlY/W3Sc2WCh/JKfljccJG8stCO6gngRzPwXOmkbOmEY5a9VOpQvO5hNavxdpymT0Asvs+/lztpeAwRC7T5vmCg4jQwZtWxdXyi+4B1jEHsTgSmeGpaa8I8HBuB+MAsK8ZFP4CNU0jKazacVQE8mpy60HphCVDm83r77dy6OGJgn1/iWpr6E7H/ET1hGsn7ww/pnDVcCqzt20rhXwL576he2Dxr07dDDX+RpP1LFsd2Tk499n1LSJHu9qchRAxdX1J9xQVnTnbNJerDZdrQlE66YOvbKWRU/LlD8u5g+gHuOeQd+tkt4qDaaEnB2yC4YST5GjclPHKLEi9yk+vP95WJ4Q9L+XSkTiRylMA1dOoM+m8HH+/43f7eMeqP5xWwWcy5U597ZhGa1D6OyH7W/jMs0Uv5Lt8hMA5KbOA59cOY4wIEkvOxC/b2PpBxDqvllJTtQjqQZW5lQjH3i9mJkzXTxMv4uaColYKKFTnwzmKNlV3AHhYwc7CjDzpfWA/LhAQqoROQkVYzg77fbegNy8WLtBh/Kq8VLu4Jn/zFM/KLBcw9piC7CjJrt69sr3nJl+oEf0OoDF1Spa3K56YSdfnXQMzj9xSDRGNffcntG8Ww0go8UMFV+FlssUUfcPwljtZoLf4UGV8bqsjeJEs2eqSTYfVUD4A3gqKzSyy2xWuXR5vpTTccTIoVJDDujo8IpBvfZys8cL1FxxuGcsKy0cFh5VxT8nrAPBHUSC2BkJEhic4+9bPGsFw1FMnH7WBYWCVbI3cngywh3nAyBWOZZilaDBatLpethevLG8cR/zov3y1LU3MSX8FU7ETFD3I4bzNiN9dZ4DcOo83lHSI9PZNHCMWHxm/AkxGSI/MieV3RHRSlbWXfnkC8hD7OnxfrNuHLQ8jaqIFcLRJqTQJOlJkgi/p5j2D+0yjHwpPI31CDfka8DQV71lplyX3lOhVV6oZGlTNoxlPG1SUL4SXLa7w1xQHbaby2j5rDWzdnmu0zakfM8BlqzKml7xOZ8u75rN7yNIswAv/oW1/Qp5sRbSdw55FB9AH+nNthL1rXdBw3BQtTfIkAyl2ju5m7LWSqUOwL7fVo3kSxUXqatvZUftvi+SXsVyd0Edd17rqmnGGvu7VgOL1VbmAxFCloaP349T7kU7BLws5EhzWikZUsdb2u7/FR+y1fd/52EXHis9JccT5ELy6CQLtvjMyzw84K1Jqib1q2Qo4pwPP9zxqgAUj5/sUk1iySU3bUgrbMQekUe1iEEBa+9LogwyL4wvjJ3R3HBCR97vzFmIE8iBBGdc6ZJ9w7oYFcOJri5ni4Qhopo6cYSFwOJ1klsslG02MasDFn2ChMMz4uRcUFM52HEGvp/lxN6fwJgOEQspNcddjvyEuX2b/AGbaxTjbgbOsrE7h9NVg+RMRJJaIwk7VKW2BeAEZXViD5bg4yG/wR7LaghClgNDlEbROzYDiE8acFlnzJANylQK8rP3a+rbNdekUfpHQYQrhiEauRPn7VJI5K8OFPuGzKs3OquxH20BvSZE4J5UO7A6138NQRnix++3GH5AZi1vdmNoAj7tlyzueM5lHwlWQf4ZRW/S5BzANiNMH6MmgE2XrEUr2b1yp5JkNDOAegYJ++q9ky72h7n2HFizg/PX0PhFNNnEBeu4VKIJeFGrobYZlGwUNdJ6hkBa3iyn3YyPv6BfjLNCkTahP2GJ6YRwtWxh2ZWRb+uLowORX3qra3O9nL5Q1MUJTzWk/QKid/mYpxTolxSm4GStSU1PnSIs+CuRCYzXGb9IEh4h+T2W3eXPMZd8BvP1smi4cM1zNw0zyqMid9S1+05ErUl2O8Ebq7PbRBhppkqe5PI2v+AxSa4+Twdrb6QAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABQkKEBQd",
+  "signing_key_id": "test-signer-2026-v1"
+}

package/testdata/v3_golden_sar_acknowledged.json

@@ -0,0 +1,21 @@
+{
+  "$schema_comment": "chain_b cross-language v3 golden vectors for sar_acknowledged. See v3_golden_sar_intent.json for the file-format conventions. Hashes baked from Go encoder 2026-05-10.",
+  "domain_prefix_v3": "aleutian.chain.entry.v3:",
+  "entry_type": "sar_acknowledged",
+  "vectors": [
+    {
+      "expected_canonical_bytes_hex": "0000001f636f6d705f3031484b37414141414141414141414141414141414141414141000000107361725f61636b6e6f776c656467656400000015616e63686f722d7369676e65722d323032362d76310000018f4df73e000000002430313866613162332d633464352d373030302d383030302d3132333435363738393061620000001a3031484b37424242424242424242424242424242424242424242",
+      "expected_content_hash_sha512_hex": "4367da6ee46bcafda03566b57a4ea34a2ab2a5dd6e68d6a1c55c423e18c08218c69d95516467b49cb52c16f1b249633efc07a259e69cefdb1a2e90fb81952af7",
+      "input": {
+        "company_id": "comp_01HK7AAAAAAAAAAAAAAAAAAAAA",
+        "entry_type": "sar_acknowledged",
+        "intent_entry_id": "018fa1b3-c4d5-7000-8000-1234567890ab",
+        "request_id": "01HK7BBBBBBBBBBBBBBBBBBBBB",
+        "signing_key_id": "anchor-signer-2026-v1",
+        "timestamp_ms": 1715000000000
+      },
+      "name": "sar_acknowledged"
+    }
+  ],
+  "version": 3
+}

package/testdata/v3_golden_sar_extended.json

@@ -0,0 +1,40 @@
+{
+  "$schema_comment": "dsar_p4_polish_v1_0_cleanup #4 (2026-05-15) cross-language v3 golden vectors for sar_extended. See v3_golden_sar_intent.json for the file-format conventions. Hashes baked from Go encoder via TestBakeSARExtendedGolden.",
+  "domain_prefix_v3": "aleutian.chain.entry.v3:",
+  "entry_type": "sar_extended",
+  "vectors": [
+    {
+      "expected_canonical_bytes_hex": "0000001f636f6d705f3031484b374141414141414141414141414141414141414141410000000c7361725f657874656e64656400000015616e63686f722d7369676e65722d323032362d76310000018f4df73e000000019000c79c000000002430313866613162332d633464352d373030302d383030302d3132333435363738393061620000008066666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666660000001a3031484b37424242424242424242424242424242424242424242",
+      "expected_content_hash_sha512_hex": "1db720a084a7be66c7be950f25e2c1eb3ec7bb62a53f138c2a06d7675d48d9c8a66001a13510845b53c5ce5ca988cf4fd4aa7bcfd49038d30a2831a15a4fdcdf",
+      "input": {
+        "company_id": "comp_01HK7AAAAAAAAAAAAAAAAAAAAA",
+        "entry_type": "sar_extended",
+        "extended_due_at_ms": 1718000000000,
+        "intent_entry_id": "018fa1b3-c4d5-7000-8000-1234567890ab",
+        "reason_hash": "ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff",
+        "request_id": "01HK7BBBBBBBBBBBBBBBBBBBBB",
+        "signing_key_id": "anchor-signer-2026-v1",
+        "timestamp_ms": 1715000000000
+      },
+      "name": "sar_extended"
+    },
+    {
+      "$comment": "pii_hmac_key_rotation_R4: versioned reason_hash leaf (pii_digest_key_version=sm:v1) emitted between intent_entry_id and reason_hash. Cross-language byte-identity (R6 review M2).",
+      "expected_canonical_bytes_hex": "0000001f636f6d705f3031484b374141414141414141414141414141414141414141410000000c7361725f657874656e64656400000015616e63686f722d7369676e65722d323032362d76310000018f4df73e000000018f4df73e000000002430313839306135642d616339362d373734622d626363652d62333032303939613830353700000005736d3a76310000008062626262626262626262626262626262626262626262626262626262626262626262626262626262626262626262626262626262626262626262626262626262626262626262626262626262626262626262626262626262626262626262626262626262626262626262626262626262626262626262626262626262626262620000001a3031484b37424242424242424242424242424242424242424242",
+      "expected_content_hash_sha512_hex": "d50dc2aa7ee3570a414568d1004f5b019533df4dc6466ddb681de2ad960fdd904b1b78f05d5499d5c4bb5d090facaf28764839b8d1a82dc95ce743c1ca7d8ff2",
+      "input": {
+        "company_id": "comp_01HK7AAAAAAAAAAAAAAAAAAAAA",
+        "entry_type": "sar_extended",
+        "extended_due_at_ms": 1715000000000,
+        "intent_entry_id": "01890a5d-ac96-774b-bcce-b302099a8057",
+        "pii_digest_key_version": "sm:v1",
+        "reason_hash": "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
+        "request_id": "01HK7BBBBBBBBBBBBBBBBBBBBB",
+        "signing_key_id": "anchor-signer-2026-v1",
+        "timestamp_ms": 1715000000000
+      },
+      "name": "sar_extended_versioned"
+    }
+  ],
+  "version": 3
+}

package/testdata/v3_golden_sar_fulfilled.json

@@ -0,0 +1,46 @@
+{
+  "$schema_comment": "chain_b cross-language v3 golden vectors for sar_fulfilled. Two vectors cover the access (tombstone_count=0, certificate_id empty) and erasure (tombstone_count>0, certificate_id present) shapes. See v3_golden_sar_intent.json for file-format conventions. Hashes baked from Go encoder 2026-05-16 after dsar_fulfill_b_pre_02e added certificate_id as alphabetical-first body field (7 body fields total). manifest_root values are 128 hex chars (SHA-512 per OQ-8 hardening 2026-05-10).",
+  "domain_prefix_v3": "aleutian.chain.entry.v3:",
+  "entry_type": "sar_fulfilled",
+  "vectors": [
+    {
+      "$comment": "Access fulfillment: tombstone_count=0, certificate_id empty (encoded as 0-length prefix). legal_basis='art_15_access'.",
+      "expected_canonical_bytes_hex": "0000001f636f6d705f3031484b374141414141414141414141414141414141414141410000000d7361725f66756c66696c6c656400000015616e63686f722d7369676e65722d323032362d76310000018f4df73e0000000000000000066163636573730000002430313866613162332d633464352d373030302d383030302d3132333435363738393061620000000d6172745f31355f6163636573730000008063636363636363636363636363636363636363636363636363636363636363636363636363636363636363636363636363636363636363636363636363636363636363636363636363636363636363636363636363636363636363636363636363636363636363636363636363636363636363636363636363636363636363630000001a3031484b374242424242424242424242424242424242424242420000000000000000",
+      "expected_content_hash_sha512_hex": "e358b102d71a488eef1df24410c53bd49c2da60408617448d5862d51ed5202f5b85bfb93f6549c2c6ab60092280d7e8346d91bec2eec5e4281fcde7d4544c2cc",
+      "input": {
+        "certificate_id": "",
+        "company_id": "comp_01HK7AAAAAAAAAAAAAAAAAAAAA",
+        "entry_type": "sar_fulfilled",
+        "fulfillment_kind": "access",
+        "intent_entry_id": "018fa1b3-c4d5-7000-8000-1234567890ab",
+        "legal_basis": "art_15_access",
+        "manifest_root": "cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc",
+        "request_id": "01HK7BBBBBBBBBBBBBBBBBBBBB",
+        "signing_key_id": "anchor-signer-2026-v1",
+        "timestamp_ms": 1715000000000,
+        "tombstone_count": 0
+      },
+      "name": "sar_fulfilled_access"
+    },
+    {
+      "$comment": "Erasure fulfillment: tombstone_count=42, certificate_id is a canonical-shape cert_<32-hex>. legal_basis='art_17_erasure'.",
+      "expected_canonical_bytes_hex": "0000001f636f6d705f3031484b374141414141414141414141414141414141414141410000000d7361725f66756c66696c6c656400000015616e63686f722d7369676e65722d323032362d76310000018f4df73e0000000025636572745f616161616161616161616161616161616161616161616161616161616161616100000007657261737572650000002430313866613162332d633464352d373030302d383030302d3132333435363738393061620000000e6172745f31375f657261737572650000008064646464646464646464646464646464646464646464646464646464646464646464646464646464646464646464646464646464646464646464646464646464646464646464646464646464646464646464646464646464646464646464646464646464646464646464646464646464646464646464646464646464646464640000001a3031484b37424242424242424242424242424242424242424242000000000000002a",
+      "expected_content_hash_sha512_hex": "36dee5464297454779c0459b09d960f61b75ad92a6c2e04e290c98f711b1bfe09ca9796c4c56e68044aa0d7e59929cbb26f0388821420939eee754c68bcda147",
+      "input": {
+        "certificate_id": "cert_aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+        "company_id": "comp_01HK7AAAAAAAAAAAAAAAAAAAAA",
+        "entry_type": "sar_fulfilled",
+        "fulfillment_kind": "erasure",
+        "intent_entry_id": "018fa1b3-c4d5-7000-8000-1234567890ab",
+        "legal_basis": "art_17_erasure",
+        "manifest_root": "dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd",
+        "request_id": "01HK7BBBBBBBBBBBBBBBBBBBBB",
+        "signing_key_id": "anchor-signer-2026-v1",
+        "timestamp_ms": 1715000000000,
+        "tombstone_count": 42
+      },
+      "name": "sar_fulfilled_erasure"
+    }
+  ],
+  "version": 3
+}

package/testdata/v3_golden_sar_intent.json

@@ -0,0 +1,60 @@
+{
+  "$schema_comment": "chain_b cross-language v3 golden vectors for sar_intent. Each vector lists the input fields, the expected canonical-bytes hex (length-prefixed TLV per pqc_05c v3 §3 + §4.5), and the expected content_hash hex (SHA-512 of 'aleutian.chain.entry.v3:' || canonical_bytes). Cross-language verifier ports (Python in chain_e, JS in chain_f) read this file and assert byte + hash equality on their re-encode. Hashes baked from the Go encoder 2026-05-10 via TestBakeV3SARFixtures.",
+  "domain_prefix_v3": "aleutian.chain.entry.v3:",
+  "entry_type": "sar_intent",
+  "vectors": [
+    {
+      "$comment": "Empty idempotency_key_hash + reason_hash (caller supplied neither). Validates the optional-SHA-512-hex empty-string path.",
+      "expected_canonical_bytes_hex": "0000001f636f6d705f3031484b374141414141414141414141414141414141414141410000000a7361725f696e74656e7400000015616e63686f722d7369676e65722d323032362d76310000018f4df73e00000000000000001a3031484b374242424242424242424242424242424242424242420000000661636365737300000003616c6c00000006706f7274616c",
+      "expected_content_hash_sha512_hex": "e0470089758aa3cffa70c2d90048ad0f9b18dd4aa0ac1f0757a30e71c553736b53aa13b4dbab0e024907783dba1a3fa4ef437b1f8d0a28d8db0edf637f99949a",
+      "input": {
+        "company_id": "comp_01HK7AAAAAAAAAAAAAAAAAAAAA",
+        "entry_type": "sar_intent",
+        "reason_hash": "",
+        "request_id": "01HK7BBBBBBBBBBBBBBBBBBBBB",
+        "sar_type": "access",
+        "scope": "all",
+        "signing_key_id": "anchor-signer-2026-v1",
+        "source_channel": "portal",
+        "timestamp_ms": 1715000000000
+      },
+      "name": "sar_intent_minimal"
+    },
+    {
+      "$comment": "Both hashes populated, source_channel=api, sar_type=both. Exercises every body field at non-empty values.",
+      "expected_canonical_bytes_hex": "0000001f636f6d705f3031484b374141414141414141414141414141414141414141410000000a7361725f696e74656e7400000015616e63686f722d7369676e65722d323032362d76310000018f4df73e000000008062626262626262626262626262626262626262626262626262626262626262626262626262626262626262626262626262626262626262626262626262626262626262626262626262626262626262626262626262626262626262626262626262626262626262626262626262626262626262626262626262626262626262620000001a3031484b3742424242424242424242424242424242424242424200000004626f746800000003616c6c00000003617069",
+      "expected_content_hash_sha512_hex": "b15023b8d8f8ca28096a713c490c091f1d09dc3a7de8e84ec26e53c18db692af1c2b01eb0a2df78fff0ad3c23eb4e59a5c29d71b31811570012a8fd1fee1974d",
+      "input": {
+        "company_id": "comp_01HK7AAAAAAAAAAAAAAAAAAAAA",
+        "entry_type": "sar_intent",
+        "reason_hash": "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
+        "request_id": "01HK7BBBBBBBBBBBBBBBBBBBBB",
+        "sar_type": "both",
+        "scope": "all",
+        "signing_key_id": "anchor-signer-2026-v1",
+        "source_channel": "api",
+        "timestamp_ms": 1715000000000
+      },
+      "name": "sar_intent_full"
+    },
+    {
+      "$comment": "pii_hmac_key_rotation_R4: versioned reason_hash leaf (pii_digest_key_version=sm:v1) emitted at the alphabetical-first body slot. Proves cross-language byte-identity of the versioned SAR canonical (R6 review M2).",
+      "expected_canonical_bytes_hex": "0000001f636f6d705f3031484b374141414141414141414141414141414141414141410000000a7361725f696e74656e7400000015616e63686f722d7369676e65722d323032362d76310000018f4df73e0000000005736d3a76310000008062626262626262626262626262626262626262626262626262626262626262626262626262626262626262626262626262626262626262626262626262626262626262626262626262626262626262626262626262626262626262626262626262626262626262626262626262626262626262626262626262626262626262620000001a3031484b374242424242424242424242424242424242424242420000000661636365737300000003616c6c00000006706f7274616c",
+      "expected_content_hash_sha512_hex": "ecdf02930893f1b6efd899d54796c917779bb41636b12712d93a7cc98c528af5b86abb9cc6b85c80258ce2a7458909a6134c43205b4287396ea7bb6181a3ab2f",
+      "input": {
+        "company_id": "comp_01HK7AAAAAAAAAAAAAAAAAAAAA",
+        "entry_type": "sar_intent",
+        "pii_digest_key_version": "sm:v1",
+        "reason_hash": "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
+        "request_id": "01HK7BBBBBBBBBBBBBBBBBBBBB",
+        "sar_type": "access",
+        "scope": "all",
+        "signing_key_id": "anchor-signer-2026-v1",
+        "source_channel": "portal",
+        "timestamp_ms": 1715000000000
+      },
+      "name": "sar_intent_versioned"
+    }
+  ],
+  "version": 3
+}

package/testdata/v3_golden_sar_rejected.json

@@ -0,0 +1,40 @@
+{
+  "$schema_comment": "chain_b cross-language v3 golden vectors for sar_rejected. See v3_golden_sar_intent.json for file-format conventions. Hashes baked from Go encoder 2026-05-10. rationale_hash is REQUIRED non-empty (rejection without rationale is invalid).",
+  "domain_prefix_v3": "aleutian.chain.entry.v3:",
+  "entry_type": "sar_rejected",
+  "vectors": [
+    {
+      "expected_canonical_bytes_hex": "0000001f636f6d705f3031484b374141414141414141414141414141414141414141410000000c7361725f72656a656374656400000015616e63686f722d7369676e65722d323032362d76310000018f4df73e000000002430313866613162332d633464352d373030302d383030302d313233343536373839306162000000206172745f31375f335f625f66726565646f6d5f6f665f65787072657373696f6e0000008065656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565650000001a3031484b37424242424242424242424242424242424242424242",
+      "expected_content_hash_sha512_hex": "8b883803fdf2ed133d21a596be350bfa374174be9b6b406ee903be903a61256eac38cb592c1f6bdc90f435c8d0133199920be884bc0ea9c26c3db52e915115cc",
+      "input": {
+        "company_id": "comp_01HK7AAAAAAAAAAAAAAAAAAAAA",
+        "entry_type": "sar_rejected",
+        "intent_entry_id": "018fa1b3-c4d5-7000-8000-1234567890ab",
+        "legal_basis": "art_17_3_b_freedom_of_expression",
+        "rationale_hash": "eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee",
+        "request_id": "01HK7BBBBBBBBBBBBBBBBBBBBB",
+        "signing_key_id": "anchor-signer-2026-v1",
+        "timestamp_ms": 1715000000000
+      },
+      "name": "sar_rejected"
+    },
+    {
+      "$comment": "pii_hmac_key_rotation_R4: versioned rationale_hash leaf (pii_digest_key_version=sm:v1) emitted between legal_basis and rationale_hash. Cross-language byte-identity (R6 review M2).",
+      "expected_canonical_bytes_hex": "0000001f636f6d705f3031484b374141414141414141414141414141414141414141410000000c7361725f72656a656374656400000015616e63686f722d7369676e65722d323032362d76310000018f4df73e000000002430313839306135642d616339362d373734622d626363652d623330323039396138303537000000156172745f31375f335f6c6567616c5f636c61696d7300000005736d3a76310000008064646464646464646464646464646464646464646464646464646464646464646464646464646464646464646464646464646464646464646464646464646464646464646464646464646464646464646464646464646464646464646464646464646464646464646464646464646464646464646464646464646464646464640000001a3031484b37424242424242424242424242424242424242424242",
+      "expected_content_hash_sha512_hex": "6aaede462efca0c8b90f4ef9bd22a33152091477cb3858c23307211de5eea00e72dc1dd0effe0073ded6a618149d0cb3c1d490a95af4c622e34c14fcaa88fd15",
+      "input": {
+        "company_id": "comp_01HK7AAAAAAAAAAAAAAAAAAAAA",
+        "entry_type": "sar_rejected",
+        "intent_entry_id": "01890a5d-ac96-774b-bcce-b302099a8057",
+        "legal_basis": "art_17_3_legal_claims",
+        "pii_digest_key_version": "sm:v1",
+        "rationale_hash": "dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd",
+        "request_id": "01HK7BBBBBBBBBBBBBBBBBBBBB",
+        "signing_key_id": "anchor-signer-2026-v1",
+        "timestamp_ms": 1715000000000
+      },
+      "name": "sar_rejected_versioned"
+    }
+  ],
+  "version": 3
+}