@atep/core 0.1.0-alpha.4 → 0.1.0-alpha.5

package/README.md

@@ -4,7 +4,7 @@ ATEP is a quantum-safe trust layer for robots and AI agents. Every signature and
 
 > **Experimental alpha. Do not rely on this to protect anything of value.** There has been no independent security audit. The wire format may change between releases (the COSE labels are private-use values and the media types are unregistered), and the post-quantum crates underneath are young. "Quantum-safe" means finalized NIST algorithms (FIPS 203 and FIPS 204) in a hybrid construction; it does not mean audited or proven.
 
-`@atep/core` is the ATEP reference core (Draft 08, `ATEP-1` suite, including `retired`, `successor`, anchors and domain binding) for JavaScript: the Rust
+`@atep/core` is the ATEP reference core (Draft 09, `ATEP-1` suite, including `retired`, `successor`, anchors and domain binding) for JavaScript: the Rust
 `atep-core` crate compiled to WebAssembly, with a TypeScript API. One ESM
 package for Node, Bun, Deno and browsers, no framework and no runtime
 dependencies.
@@ -183,16 +183,16 @@ Types are in `dist/index.d.ts`.
 
 ### Runtimes
 
-What was run, on one Linux development machine (Ubuntu 20.04 under WSL) on 3 October 2026, against the built `dist/` with the same vector checks and the roundtrip tests:
+What was run against the built `dist/`, with the same vector checks and the roundtrip tests:
 
 | Runtime | How | Result |
 | --- | --- | --- |
-| Node 25 | `npm test` | 442 tests: 437 pass, 5 skipped by name (the 4 `log-admission` and 1 `monitor` vectors) |
-| Deno 2.9.7 | `deno test -A test/` | all vector checks (432 pass, 5 skipped by name) and the 5 roundtrip tests pass |
-| Bun 1.4.2 | `bun test test/` | 442 tests: 437 pass, 5 skipped by name, 0 fail |
-| Chromium 131 (headless shell, Playwright) | `node scripts/browser-vectors.mjs` (needs `playwright-core`, see the header of the script) | the vector checks run in the page: 432 pass, 5 skipped by name, 0 fail |
+| Node 25 | `npm test` | 538 tests: 517 pass, 21 skipped by name (the 20 `log-admission` and 1 `monitor` vectors); in CI on every push |
+| Deno 2.9.7 | `deno test -A test/` | all 441 vector checks that apply pass, 5 skipped by name, and the roundtrip tests pass; in CI on every push (pinned release binary) |
+| Bun 1.4.2 | `bun test test/` | 451 tests: 446 pass, 5 skipped by name, 0 fail; in CI on every push (pinned release binary) |
+| Chromium 131 (headless shell, Playwright) | `node scripts/browser-vectors.mjs` (needs `playwright-core`, see the header of the script) | the vector checks ran in the page on 3 October 2026, when the suite had 437 vectors: 432 pass, 5 skipped by name, 0 fail; manual, not in CI and not re-run on the current suite |
 
-These runs were made on the 437 vectors of that date. The suite now has 446; only Node was re-run on it (451 tests: 446 pass, 5 skipped by name).
+The Node, Deno and Bun results were first obtained on a Linux development machine (Ubuntu 20.04 under WSL) and are now also produced by the CI of the repository.
 
 Notes:
 
@@ -246,12 +246,12 @@ Node 25 on the development machine (WSL2), average over 50 to 100 calls after wa
 
 `npm test` (node:test) runs, under Node, through the built package:
 
-* `test/vectors.test.mjs`: every vector listed in `../vectors/manifest.json`: **441 passed + 5 skipped = 446**.
+* `test/vectors.test.mjs`: every vector listed in `../vectors/manifest.json`: **512 passed + 21 skipped = 533**.
   The first 200 (identity, signing, encryption, verify-positive/negative, attestation, chain-positive/negative,
   srl, log, atep-r-positive/negative, retired-positive/negative, successor-positive/negative, srl-context,
   log-admission, monitor) and the 236 of Draft 05: checkpoint-hash 9, anchor-record 36, chain-id 30,
   anchor-envelope 13, anchor-media-type 3, require-anchor 27, anchor-not-supported 9, registry-endpoint 26,
-  domain-binding 83. The 5 skipped are named and counted in the summary: `log-admission` (4) and `monitor` (1),
+  domain-binding 94. The 21 skipped are named and counted in the summary: `log-admission` (20) and `monitor` (1),
   because they need a stateful log or a monitor, which this package does not have. Each vector is checked for
   CBOR hash, JSON view equality with the vector's `.json` (a vector whose `.json` says `not_strict_cbor` has no
   view, and the runner only accepts a failing view for those), and by category: exact bytes for identity,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@atep/core",
-  "version": "0.1.0-alpha.4",
+  "version": "0.1.0-alpha.5",
   "description": "ATEP (Autonomy Trust Envelope Protocol) core: the Rust atep-core compiled to WebAssembly, with a TypeScript API for Node, Bun, Deno and browsers.",
   "license": "Apache-2.0",
   "type": "module",