@coderifts/agent-guard 17.3.0 → 17.3.1

package/dist/cjs/vendor/verified-execution-binding.js

@@ -43,6 +43,7 @@ const crypto = require('node:crypto');
 
 const { verifyExecutionGrant } = require('./verify-grant.js');
 const { verifyEvidenceRootBinding } = require('./verify-evidence.js');
+const { verifyReceipt } = require('./verify.js');
 
 const BINDING_V = 'cr.verified-execution-binding.v1';
 
@@ -57,6 +58,24 @@ const STATE = Object.freeze({
   RECORDED_UNWITNESSED: 'RECORDED_UNWITNESSED',
   NOT_COMMITTED: 'NOT_COMMITTED',
   AUTHORIZED_AND_COMMITTED: 'AUTHORIZED_AND_COMMITTED',
+  /**
+   * A CUSTOM aggregation was satisfied — and it is NOT the global success token.
+   *
+   * ── THE HOLE THIS CLOSES, REPRODUCED BEFORE IT WAS WRITTEN ──────────────────────────────
+   *
+   *   valid grant + committed + NO attestation + NO root, required: ['issuer_grant']
+   *     -> AUTHORIZED_AND_COMMITTED, authorized_and_committed: true
+   *
+   * Nothing was forged. The caller simply asked for less, and the function handed back the token
+   * every consumer reads as "authorized and committed". `required[]` was a strictness dial that
+   * also selected the NAME of success, so narrowing the dial upgraded the verdict — the strongest
+   * word in the vocabulary, reachable by asking for the least.
+   *
+   * A caller may still choose its own authorities. What it may no longer do is call the result by
+   * the global name. `AUTHORIZED_AND_COMMITTED` is now reachable ONLY through a closed, versioned
+   * profile whose authority set the caller does not get to shorten.
+   */
+  CUSTOM_REQUIREMENTS_SATISFIED: 'CUSTOM_REQUIREMENTS_SATISFIED',
 });
 
 /** What each authority is allowed to be missing for, so a caller can choose its own strictness. */
@@ -67,6 +86,36 @@ const AUTHORITY = Object.freeze({
   PROVIDER_WITNESS: 'provider_witness',
 });
 
+/**
+ * CLOSED, VERSIONED ASSURANCE PROFILES.
+ *
+ * A profile fixes its authority set. The caller names the profile; it does not get to edit what
+ * the profile means, and the version in the name is what lets the set change later without
+ * silently changing what an older caller was promised.
+ *
+ * `TRUSTED_EXECUTOR_INTEGRITY_V1` is the honest ceiling of a single-machine chain: the decision
+ * receipt verified, the issuer's grant verified, the executor's attestation verified, and one
+ * signed root binding the set to one run. It says nothing about a third party, and the name is
+ * chosen so it cannot be read as one — `EXTERNALLY_WITNESSED_EXECUTION_V1` is a different profile
+ * and no producer can satisfy it today (no signed-witness format exists), which is why it is not
+ * declared here as an empty promise.
+ */
+const PROFILE = Object.freeze({
+  TRUSTED_EXECUTOR_INTEGRITY_V1: Object.freeze({
+    name: 'TRUSTED_EXECUTOR_INTEGRITY_V1',
+    authorities: Object.freeze([
+      AUTHORITY.ISSUER_GRANT,
+      AUTHORITY.EXECUTOR_ATTESTATION,
+      AUTHORITY.ONE_RUN_ROOT,
+    ]),
+    // The receipt is mandatory in every profile and is not listed as an authority because it is
+    // not optional anywhere — it gates the whole predicate above the state machine.
+    proof_scope: 'TRUSTED_EXECUTOR',
+    externally_witnessed: false,
+  }),
+});
+const PROFILE_NAMES = Object.freeze(Object.keys(PROFILE));
+
 const sha256pref = (v) =>
   `sha256:${crypto.createHash('sha256').update(String(v), 'utf8').digest('hex')}`;
 
@@ -116,12 +165,55 @@ function grantClaims(token) {
  * @param {{artifact: object, executorKey}} [o.evidenceRoot]
  * @param {{signed: boolean}} [o.providerReadback]
  * @param {boolean} o.committed
- * @param {string[]} [o.required]  authorities this caller demands; default: grant + attestation.
+ * @param {string} [o.profile]     a CLOSED profile name (see PROFILE). Its authority set cannot be
+ *        edited by the caller, and only a profile can reach AUTHORIZED_AND_COMMITTED.
+ * @param {string[]} [o.required]  a CUSTOM authority set. Legal, and it can never produce the
+ *        global success token — a satisfied custom set reads CUSTOM_REQUIREMENTS_SATISFIED.
  */
 function verifiedExecutionBinding(o = {}) {
-  const required = new Set(Array.isArray(o.required) && o.required.length
-    ? o.required
-    : [AUTHORITY.ISSUER_GRANT, AUTHORITY.EXECUTOR_ATTESTATION]);
+  // ── WHICH SET, AND WHO CHOSE IT ─────────────────────────────────────────────────────────
+  //
+  // A profile and a custom set are different KINDS of question, so they are answered separately
+  // and never merged. Passing both is refused rather than resolved by precedence: a caller that
+  // names a profile and then also lists authorities is asking two things at once, and picking one
+  // silently is how a caller ends up believing it got the other.
+  const profileName = typeof o.profile === 'string' && o.profile ? o.profile : null;
+  const customRequired = Array.isArray(o.required) && o.required.length ? o.required : null;
+  if (profileName && customRequired) {
+    return {
+      v: BINDING_V,
+      authorized_and_committed: false,
+      requirements_satisfied: false,
+      profile: null,
+      proof_scope: null,
+      externally_witnessed: false,
+      state: STATE.UNAUTHORIZED,
+      authorities: {},
+      shortfalls: ['profile: both `profile` and `required` were supplied — a closed profile\'s '
+        + 'authority set is not editable, so this asks two different questions at once'],
+      does_not_prove: [],
+    };
+  }
+  if (profileName && !Object.prototype.hasOwnProperty.call(PROFILE, profileName)) {
+    // FAIL CLOSED on an unknown profile. Falling back to a default would let a typo — or a caller
+    // written against a future version — silently receive a weaker check than it named.
+    return {
+      v: BINDING_V,
+      authorized_and_committed: false,
+      requirements_satisfied: false,
+      profile: null,
+      proof_scope: null,
+      externally_witnessed: false,
+      state: STATE.UNAUTHORIZED,
+      authorities: {},
+      shortfalls: [`profile: unknown assurance profile "${profileName}"; known: ${PROFILE_NAMES.join(', ')}`],
+      does_not_prove: [],
+    };
+  }
+  const profile = profileName ? PROFILE[profileName] : null;
+  const required = new Set(profile
+    ? profile.authorities
+    : (customRequired || [AUTHORITY.ISSUER_GRANT, AUTHORITY.EXECUTOR_ATTESTATION]));
   const shortfalls = [];
   const authorities = {};
   const note = (name, ok, detail) => {
@@ -225,9 +317,31 @@ function verifiedExecutionBinding(o = {}) {
   if (!er || !er.artifact) {
     note(AUTHORITY.ONE_RUN_ROOT, false,
       'no cr.evidence.root.v1 was supplied, so these bytes are not shown to be one run');
+  } else if (typeof verifyEvidenceRootBinding !== 'function') {
+    // ── A MISSING VERIFIER IS A REFUSAL, NEVER A CRASH ───────────────────────────────────
+    //
+    // MEASURED on a consumer: agent-guard vendors an OLDER `verify-evidence.js` that does not
+    // export `verifyEvidenceRootBinding` (true on its HEAD too), so this line threw a TypeError
+    // the moment anyone passed an `evidenceRoot`. Latent there — that guard holds no root — and
+    // the SHAPE is what matters: a crash is not an answer, and a caller cannot tell "the core
+    // blew up" from "the core is unavailable" from "the binding failed".
+    //
+    // Every OTHER dependency this file has is already used unconditionally, so this is the one
+    // place a mixed vendor pin can leave a hole. Refusing here is the fail-closed answer, and it
+    // names the cause rather than reporting a generic unbound root.
+    note(AUTHORITY.ONE_RUN_ROOT, false,
+      'the evidence-root verifier is not available in this build (the vendored verify-evidence.js '
+      + 'does not export verifyEvidenceRootBinding) — the root was NOT checked, and an unchecked '
+      + 'root is refused rather than reported as unbound');
   } else {
-    const r = verifyEvidenceRootBinding(er.artifact, { executorKey: er.executorKey, sidecars: er.sidecars });
-    note(AUTHORITY.ONE_RUN_ROOT, r.ok === true, r.ok ? 'bound' : (r.failures[0] || 'unbound'));
+    let r;
+    try {
+      r = verifyEvidenceRootBinding(er.artifact, { executorKey: er.executorKey, sidecars: er.sidecars });
+    } catch (err) {
+      r = { ok: false, failures: [`the evidence-root verifier threw: ${(err && err.message) || 'error'}`] };
+    }
+    note(AUTHORITY.ONE_RUN_ROOT, r.ok === true,
+      r.ok ? 'bound' : ((r.failures && r.failures[0]) || 'unbound'));
   }
 
   // ── 4. THE PROVIDER WITNESS ────────────────────────────────────────────────────────────
@@ -273,11 +387,65 @@ function verifiedExecutionBinding(o = {}) {
   // Left as-is deliberately: making a bare boolean insufficient would change the input shape of
   // all five consumers at once, and that belongs with the closed-profile work (1465), not
   // half-done in a round that would leave them broken. The gap is named, not narrowed in silence.
-  const receiptOk = !!(o.receipt && o.receipt.verified === true);
-  const receiptAsserted = receiptOk && !(o.receipt.token && (o.receipt.keyring || o.receipt.publicKey));
-  if (!receiptOk) shortfalls.unshift('receipt: the decision receipt did not verify');
+  // ── THE DECISION RECEIPT, VERIFIED HERE WHEN IT CAN BE ─────────────────────────────────
+  //
+  // ── THE FOURTH CALLER-BOOLEAN THIS REPOSITORY HAS MET ──────────────────────────────────
+  //
+  //   providerReadback: { signed: true }   believed because it was set        (closed)
+  //   attestation:      { present: true }  believed because it was set        (closed)
+  //   call_hash present == "tool-call bound"                                  (pre-empted)
+  //   receipt:          { verified: true } believed because it was set        (this)
+  //
+  // `receipt.verified` is the CALLER's word. With no token and no keyring, nothing was checked and
+  // this function had no way to check it — and a caller that simply set the flag reached a
+  // satisfied verdict. `receipt_caller_asserted` recorded it, which is honest reporting and not a
+  // gate: a field nobody branches on does not stop anything.
+  //
+  // Now: when a token AND a key source are supplied, THIS function verifies the receipt. When they
+  // are not, the assertion is accepted only for a CUSTOM aggregation — where the caller owns its
+  // own question — and can never reach AUTHORIZED_AND_COMMITTED, which is the word every consumer
+  // reads as the answer.
+  const rc = o.receipt || {};
+  let receiptOk = false;
+  let receiptAsserted = false;
+  let receiptDetail = 'the decision receipt did not verify';
+  const keySource = rc.keyring || rc.publicKey;
+  if (typeof rc.token === 'string' && rc.token.length > 0 && keySource) {
+    let rv;
+    try {
+      rv = verifyReceipt(rc.token, {
+        ctx: { ...(rc.keyring ? { keyring: rc.keyring } : { publicKey: rc.publicKey }),
+          expectedKid: rc.expectedKid === undefined ? null : rc.expectedKid },
+        ...(Number.isFinite(rc.now) ? { now: rc.now } : {}),
+      });
+    } catch (err) {
+      rv = { valid: false, status: 'VERIFIER_ERROR', reason: (err && err.message) || 'error' };
+    }
+    receiptOk = rv.valid === true;
+    if (!receiptOk) receiptDetail = `the decision receipt did not verify (${rv.status}: ${rv.reason})`;
+  } else if (rc.verified === true) {
+    // Accepted, and MARKED. The state machine below refuses to hand this the global name.
+    receiptOk = true;
+    receiptAsserted = true;
+  } else if (rc.token || keySource) {
+    receiptDetail = 'the receipt was supplied without '
+      + `${rc.token ? 'a keyring or public key' : 'its token'}, so it could not be verified here`;
+  } else {
+    receiptDetail = 'no decision receipt was supplied';
+  }
+  if (!receiptOk) shortfalls.unshift(`receipt: ${receiptDetail}`);
+  if (receiptAsserted) {
+    shortfalls.push('decision_receipt: `verified` was taken on the caller\'s word — no token and '
+      + 'no keyring were supplied, so nothing was checked here');
+  }
 
-  let state = STATE.AUTHORIZED_AND_COMMITTED;
+  // THE NAME OF SUCCESS DEPENDS ON WHO CHOSE THE SET, not on how much of it passed. A custom
+  // aggregation that meets everything it asked for is satisfied — and says so in its own words.
+  // A CALLER-ASSERTED RECEIPT CAN NEVER BE THE GLOBAL CLAIM. It is not downgraded to a failure —
+  // a custom aggregation may legitimately own that determination — but the strongest word in the
+  // vocabulary is not available to a run whose receipt nobody verified.
+  let state = (profile && !receiptAsserted)
+    ? STATE.AUTHORIZED_AND_COMMITTED : STATE.CUSTOM_REQUIREMENTS_SATISFIED;
   if (!receiptOk || (required.has(AUTHORITY.ISSUER_GRANT) && !grantOk)) state = STATE.UNAUTHORIZED;
   else if (required.has(AUTHORITY.EXECUTOR_ATTESTATION) && !attOk) state = STATE.COMMIT_UNPROVEN;
   else if (required.has(AUTHORITY.ONE_RUN_ROOT) && !authorities[AUTHORITY.ONE_RUN_ROOT].ok) {
@@ -285,11 +453,31 @@ function verifiedExecutionBinding(o = {}) {
   } else if (required.has(AUTHORITY.PROVIDER_WITNESS) && !authorities[AUTHORITY.PROVIDER_WITNESS].ok) {
     state = STATE.RECORDED_UNWITNESSED;
   } else if (!committed) state = STATE.NOT_COMMITTED;
+  // The default set (no profile, no custom list) is the historical grant+attestation pair. It is
+  // an implicit choice by the caller, not a profile, so it lands in the custom lane too.
+
 
   return {
     v: BINDING_V,
     authorized_and_committed: state === STATE.AUTHORIZED_AND_COMMITTED,
+    /**
+     * Did the set THIS CALLER ASKED FOR pass? True for a satisfied profile and for a satisfied
+     * custom aggregation alike.
+     *
+     * Separated from `authorized_and_committed` on purpose. A caller that only wants to know
+     * whether its own question was answered should not have to string-compare a state name, and
+     * — more importantly — should not be tempted to read the global claim because it was the only
+     * boolean available. That temptation is how `required: ['issuer_grant']` came to mean
+     * "authorized and committed" in the first place.
+     */
+    requirements_satisfied: state === STATE.AUTHORIZED_AND_COMMITTED
+      || state === STATE.CUSTOM_REQUIREMENTS_SATISFIED,
     state,
+    /** Which closed profile answered this, or null when the caller aggregated its own set. */
+    profile: profile ? profile.name : null,
+    /** Stated on every result so a reader never has to infer it from the state name. */
+    proof_scope: profile ? profile.proof_scope : null,
+    externally_witnessed: profile ? profile.externally_witnessed : false,
     authorities,
     shortfalls,
     /** True when `receipt.verified` was taken on the caller's word rather than established here. */
@@ -313,4 +501,7 @@ function verifiedExecutionBinding(o = {}) {
   };
 }
 
-module.exports = { verifiedExecutionBinding, STATE, AUTHORITY, BINDING_V, grantClaims, attestationClaims };
+module.exports = {
+  verifiedExecutionBinding, STATE, AUTHORITY, PROFILE, PROFILE_NAMES, BINDING_V,
+  grantClaims, attestationClaims,
+};

package/dist/cjs/vendor/verify-evidence.js

@@ -36,8 +36,18 @@ const crypto = require('node:crypto');
 const { verifyReceipt, keyringFromDocument } = require('./verify.js');
 const { verifyExecutionGrant } = require('./verify-grant.js');
 const { verifyProveTranscript } = require('./verify-prove-transcript.js');
+const {
+  ROOT_V, SLOTS, SLOT_NAMES, digestToken, verifyEvidenceRoot, canonicalJson,
+} = require('./evidence-root.js');
 
 const CORRELATION_V = 'cr.exec.correlation.v1';
+
+/**
+ * The version four consumers must agree on. `verifyEvidenceRootBinding` returns it, so "prove,
+ * conformance, the guard and the provider all ran the same library" is something a report can
+ * SHOW rather than assert. Bump it when a check is added, removed or changed in meaning.
+ */
+const LIBRARY_VERSION = 'cr.evidence-verifier.1';
 const US = '\x1f';
 
 /** The slots this verifier knows how to authenticate. */
@@ -227,7 +237,169 @@ function verifyEvidenceEnvelope(artifact, o = {}) {
   return { ok: failures.length === 0, slots, failures };
 }
 
+/**
+ * THE ROOT CHECK — is this set of tokens ONE run?
+ *
+ * Ten questions, in the order a reader would ask them. Each is answered against something the
+ * producer signed, never against a value copied out of the thing being checked.
+ *
+ *  1  the root's own signature verifies against the executor key
+ *  2  every mandatory slot is present in the root (absence is refused, not skipped)
+ *  3  every token PRESENT in the envelope has the EXACT byte digest the root recorded
+ *  4  every token the root records is present to be checked, or named as unavailable
+ *  5  the grant's claims match the root's claims (grant_id, scope, policy)
+ *  6  grant.receipt_hash === sha256(the chain_receipt bytes actually carried)
+ *  7  grant_id === the consumed jti === the attested jti
+ *  8  run_id === the transcript's run_id === the correlation's scope binding
+ *  9  the outer artifact's summaries agree with what the tokens say
+ * 10  the verifier reports its own version, so four consumers can be shown to run one library
+ *
+ * @param {object} artifact
+ * @param {object} o
+ * @param {import('crypto').KeyObject} o.executorKey  the key the root and correlation are signed with
+ * @param {object} [o.sidecars]  tokens the artifact does not carry but the caller holds, by slot
+ *                               name (e.g. provider_readback bytes, atomic_attestation token)
+ */
+function verifyEvidenceRootBinding(artifact, o = {}) {
+  const failures = [];
+  const checks = [];
+  const note = (id, ok, detail) => { checks.push({ id, ok, detail }); if (!ok) failures.push(detail); };
+
+  const root = artifact && artifact.evidence_root;
+  if (!root) {
+    return {
+      ok: false,
+      present: false,
+      library: LIBRARY_VERSION,
+      checks: [],
+      failures: ['cross_run_collage: the artifact carries no cr.evidence.root.v1, so nothing binds '
+        + 'its tokens to ONE run'],
+    };
+  }
+
+  // 1 — the root's own signature.
+  const rv = verifyEvidenceRoot(root, o.executorKey);
+  note('root_signature', rv.valid,
+    rv.valid ? 'the evidence root is signed by the executor key'
+      : `the evidence root signature does not verify (${rv.status}: ${rv.reason})`);
+  // Everything below reads the root. A root that does not verify is not a source of truth about
+  // anything, so the remaining checks are not run rather than run against unsigned values.
+  if (!rv.valid) return { ok: false, present: true, library: LIBRARY_VERSION, checks, failures };
+
+  // The tokens as they travel, by slot. Sidecars are tokens the artifact does not republish but
+  // the caller holds — the provider readback is one, and binding it is what stops a readback from
+  // another run being paired with this artifact.
+  const carried = {
+    chain_receipt: artifact.issuance && artifact.issuance.chain_receipt,
+    execution_grant: artifact.issuance && artifact.issuance.execution_grant,
+    transcript_token: artifact.transcript_token,
+    correlation: artifact.correlation || null,
+    atomic_attestation: null,
+    provider_readback: null,
+    ...(o.sidecars || {}),
+  };
+
+  // 2 — mandatory slots. A root that omits a token would make deletion look like "not applicable".
+  for (const name of SLOT_NAMES) {
+    if (!SLOTS[name].mandatory) continue;
+    note(`root_slot_${name}`, root.artifact_digests && root.artifact_digests[name] != null,
+      `the root records no digest for the mandatory ${name}`);
+  }
+
+  // 3 & 4 — EXACT BYTES. This is the check the collage fails: a substituted token is authentic and
+  // has different bytes, so its digest cannot match whatever it says inside.
+  for (const name of SLOT_NAMES) {
+    const want = root.artifact_digests ? root.artifact_digests[name] : null;
+    const got = digestToken(carried[name]);
+    if (want == null && got == null) continue;
+    if (want == null) {
+      note(`digest_${name}`, false,
+        `the envelope carries a ${name} the root does not account for — an extra token is not evidence`);
+      continue;
+    }
+    if (got == null) {
+      // Not a failure for an optional slot the caller simply did not supply: it is UNCHECKED, and
+      // saying so beats grading a token nobody looked at.
+      note(`digest_${name}`, !SLOTS[name].mandatory,
+        `the root records a ${name} digest but no such token was supplied to check it`);
+      continue;
+    }
+    note(`digest_${name}`, got === want,
+      got === want ? `${name} bytes match the root`
+        : `${name} does not match the root's digest — these bytes were not emitted by run ${root.run_id}`);
+  }
+
+  // 5 — the grant's own claims vs the root's.
+  const grantBody = (() => {
+    const t = carried.execution_grant;
+    if (typeof t !== 'string') return null;
+    try { return JSON.parse(Buffer.from(t.split('.')[0], 'base64url').toString('utf8')); } catch (_) { return null; }
+  })();
+  if (grantBody) {
+    const gid = grantBody.grant_id || grantBody.jti || null;
+    note('claim_grant_id', root.grant_id == null || root.grant_id === gid,
+      `the root names grant ${root.grant_id} but the grant it carries is ${gid}`);
+    const scope = grantBody.after_payload_hash || grantBody.scope_hash || null;
+    note('claim_scope_hash', root.scope_hash == null || root.scope_hash === scope,
+      `the root names scope ${root.scope_hash} but the grant scopes ${scope}`);
+    note('claim_policy_hash', root.policy_hash == null || grantBody.policy_hash == null
+      || root.policy_hash === grantBody.policy_hash,
+      'the root and the grant disagree about policy_hash');
+
+    // 6 — grant → receipt, by the digest of the receipt actually carried, not by a copied string.
+    const rh = grantBody.receipt_hash || grantBody.receipt_digest || null;
+    if (rh && typeof carried.chain_receipt === 'string') {
+      const actual = digestToken(carried.chain_receipt);
+      note('grant_binds_receipt', rh === actual,
+        `the grant was issued against receipt ${rh}, but the receipt carried here hashes to ${actual}`);
+    }
+  }
+
+  // 7 — one grant, through consume and attestation. Read from the continuity block the producer
+  // signed into the transcript, re-derived rather than trusted: the identities must agree with the
+  // root's grant_id too, or the root and the chain are describing different executions.
+  const ids = (artifact.continuity && artifact.continuity.identities) || {};
+  if (root.grant_id != null && ids.issued_jti != null) {
+    const oneGrant = ids.issued_jti === root.grant_id
+      && ids.consumed_jti === root.grant_id
+      && ids.attestation_jti === root.grant_id;
+    note('identity_chain', oneGrant,
+      `the root names grant ${root.grant_id}, the chain records issued ${ids.issued_jti} / `
+      + `consumed ${ids.consumed_jti} / attested ${ids.attestation_jti}`);
+  }
+
+  // 8 — one run, through the transcript and the correlation.
+  note('run_id_artifact', artifact.run_id === root.run_id,
+    `the artifact says run ${artifact.run_id}, the root says ${root.run_id}`);
+  if (carried.correlation && root.scope_hash != null) {
+    note('run_id_correlation', carried.correlation.scope_hash === root.scope_hash,
+      `the correlation binds scope ${carried.correlation.scope_hash}, the root ${root.scope_hash}`);
+  }
+  if (root.contract_commit != null && carried.correlation) {
+    note('contract_commit', carried.correlation.contract_commit === root.contract_commit,
+      `the correlation names commit ${carried.correlation.contract_commit}, the root ${root.contract_commit}`);
+  }
+
+  // 9 — the outer summary vs the tokens. The artifact is a wrapper; a wrapper that disagrees with
+  // what it wraps is the thing that is wrong.
+  const tv = typeof carried.transcript_token === 'string'
+    ? verifyProveTranscript(carried.transcript_token, { keyring: null, publicKey: o.executorKey })
+    : null;
+  if (tv && tv.valid && tv.payload) {
+    const claimed = tv.payload.run_id || tv.payload.deployment_id || null;
+    if (claimed && tv.payload.run_id) {
+      note('transcript_run_id', tv.payload.run_id === root.run_id,
+        `the signed transcript is run ${tv.payload.run_id}, the root says ${root.run_id}`);
+    }
+  }
+
+  return { ok: failures.length === 0, present: true, library: LIBRARY_VERSION, checks, failures };
+}
+
 module.exports = {
+  verifyEvidenceRootBinding,
+  LIBRARY_VERSION,
+  ROOT_V,
   verifyEvidenceEnvelope,
   verifyCorrelation,
   verifyAtomicAttestationToken,

package/dist/cjs/vendor/verify-grant.js

@@ -58,6 +58,35 @@ const V2_REQUIRED_STRINGS = Object.freeze([
   'operation', 'target_uri', 'expected_state_token', 'after_payload_hash',
   'nonce_hash', 'policy_hash', 'audience_hash', 'not_before', 'expires_at',
 ]);
+/**
+ * RESERVED, AND INERT. Optional v2 fields a grant MAY carry and this verifier reads as NOTHING.
+ *
+ * ── WHY THEY EXIST BEFORE THE GATE THAT USES THEM ───────────────────────────────────────────
+ *
+ * The admitted key set is closed: an unknown field is `MALFORMED/unknown_field`, which is the
+ * right default and also means a future field cannot be introduced without every deployed
+ * verifier refusing the grants that carry it. Reserving the two names now is what keeps that
+ * introduction from being a breaking change later.
+ *
+ * ── WHAT THEY DO NOT DO, WHICH IS THE POINT ─────────────────────────────────────────────────
+ *
+ * NOTHING. A grant carrying `call_hash` is graded EXACTLY as one without it. There is no check,
+ * no comparison, and no `intended` field they bind to.
+ *
+ * A VERIFIER THAT READS THEIR PRESENCE AS AUTHORIZATION IS WRONG. `call_hash` present does not
+ * mean a tool call was bound; `executor_image_digest` present does not mean an executor image was
+ * pinned. Nothing signs a promise that the value is true, nothing compares it to anything, and an
+ * attacker who can mint a grant can put any value in them. Presence is not proof — it is a slot.
+ *
+ * They are unsigned-by-default only in the sense that no separate signature covers them: the v2
+ * signing input is the canonical JSON of the WHOLE body, so a grant that carries them signs
+ * different bytes than one that does not, and neither can be edited into the other. That binds
+ * the VALUE to the issuer; it says nothing about whether the value means anything.
+ *
+ * When a gate for them lands it will be a NEW check with its own negative fixtures, and this
+ * comment is what a reader should be shown if anyone claims otherwise before then.
+ */
+const V2_RESERVED_INERT = Object.freeze(['call_hash', 'executor_image_digest']);
 const TARGET_SCHEMES = Object.freeze(['fs', 'git', 'api', 'db', 'registry', 'deploy']);
 const DEFAULT_FETCH_URL = 'https://app.coderifts.com/api/v1/attestation/public-key';
 
@@ -177,7 +206,9 @@ function verifyExecutionGrantV2(payload, sigB64, ctx, opts = {}) {
   if (!Number.isInteger(payload.max_attempts) || payload.max_attempts < 1) {
     return { valid: false, status: 'MALFORMED', reason: 'bad_max_attempts', payload };
   }
-  const allowed = new Set([...V2_REQUIRED_STRINGS, 'max_attempts']);
+  // The reserved names are ADMITTED, never inspected. Everything below this line treats a payload
+  // carrying them identically to one that does not — verified by test, not by intent.
+  const allowed = new Set([...V2_REQUIRED_STRINGS, 'max_attempts', ...V2_RESERVED_INERT]);
   for (const k of Object.keys(payload)) {
     if (!allowed.has(k)) return { valid: false, status: 'MALFORMED', reason: 'unknown_field', payload };
   }
@@ -555,6 +586,8 @@ module.exports = {
   SIGNING_PREFIX_V2,
   SIGNED_FIELDS,
   V1_OPTIONAL_SIGNED_FIELDS,
+  V2_REQUIRED_STRINGS,
+  V2_RESERVED_INERT,
   CLOCK_SKEW_LEEWAY_MS,
   isIssuedInFuture,
 };

package/dist/cjs/vendor/verify.js

@@ -23,13 +23,13 @@
  * the command, so it left.
  *
  * CLI usage now:
- *   node cli.js <receipt> [--key pub.pem | --keys <url|file>] [--kid <kid>] [--fetch <url>]
- *   node cli.js --chain receipts.txt [--key pub.pem | --keys <url|file>] [--kid <kid>] [--fetch <url>]
+ *   node cli.js <receipt> [--key pub.pem | --keys <url|file>] [--kid <kid>] [--fetch <url>] [--refresh-keys]
+ *   node cli.js --chain receipts.txt [--key pub.pem | --keys <url|file>] [--kid <kid>] [--fetch <url>] [--refresh-keys]
  *
- * Key discovery: with no --key/--keys, keys are fetched from
- *   https://app.coderifts.com/.well-known/coderifts-keys.json  (override with --fetch <url>).
- * The fetch-and-resolve path accepts BOTH the registry array (active + retired)
- * and the legacy single-key body from /api/v1/attestation/public-key.
+ * Key discovery: with no --key/--keys/--fetch/--refresh-keys, the command loads the
+ * vendored snapshot at keys/coderifts-keys.json (offline). Live fetch is opt-in
+ * (--refresh-keys or --fetch <url> / --keys <url>). DEFAULT_FETCH_URL is the well-known
+ * registry used by those opt-in flags. This library never fetches.
  * --keys resolves each receipt's key by kid from a registry
  *   ({ keys: [{ kid, public_key_pem, status, valid_from, retired_at }] }); accepts a URL or file.
  *

package/dist/esm/cas-attestation.d.ts

@@ -178,6 +178,21 @@ export type EvaluateCasEvidenceOpts = {
             status?: string;
         }>;
     } | null;
+    /**
+     * The decision receipt's own bytes, and the keyring that signs them.
+     *
+     * Optional, and their ABSENCE is what it looks like: the core marks the result caller-asserted
+     * and says so in its shortfalls. Supplying them moves the receipt from "this guard's own bind
+     * step said so" to "the shared predicate verified a signature".
+     */
+    receipt_token?: string | null;
+    receipt_keyring?: {
+        keys?: Array<{
+            kid?: string;
+            public_key_pem?: string;
+            status?: string;
+        }>;
+    } | null;
     /** Clock injection for grant expiry, tests only. */
     now?: number;
     /** Strict-only tightening of derived.authorized_and_committed. Absent = 9.0.0 formula. */

package/dist/esm/cas-attestation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cas-attestation.d.ts","sourceRoot":"","sources":["../../src/cas-attestation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAGH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAC1D,OAAO,KAAK,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAErF,OAAO,KAAK,EAAE,yBAAyB,EAAE,mBAAmB,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAE3G,uEAAuE;AACvE,eAAO,MAAM,oBAAoB,EAAG,oBAA6B,CAAC;AAElE;;;GAGG;AACH,MAAM,MAAM,oBAAoB,GAAG;IACjC,uEAAuE;IACvE,iCAAiC,EAAE,IAAI,CAAC;IACxC,mGAAmG;IACnG,mDAAmD,EAAE,IAAI,CAAC;IAC1D,qGAAqG;IACrG,sCAAsC,EAAE,IAAI,CAAC;IAC7C,4FAA4F;IAC5F,qDAAqD,EAAE,IAAI,CAAC;IAC5D,yFAAyF;IACzF,iCAAiC,EAAE,IAAI,CAAC;IACxC,yFAAyF;IACzF,oCAAoC,EAAE,IAAI,CAAC;CAC5C,CAAC;AAWF,kFAAkF;AAClF,MAAM,MAAM,iBAAiB,GACzB;IACE,MAAM,EAAE,WAAW,CAAC;IACpB,SAAS,EAAE,IAAI,CAAC;IAChB,aAAa,EAAE,YAAY,CAAC;CAC7B,GACD;IACE,MAAM,EAAE,SAAS,CAAC;IAClB,SAAS,EAAE,KAAK,CAAC;IACjB,MAAM,EAAE,qBAAqB,CAAC;IAC9B,cAAc,EAAE,YAAY,CAAC;IAC7B,aAAa,EAAE,YAAY,GAAG,IAAI,CAAC;CACpC,GACD;IACE,MAAM,EAAE,0BAA0B,CAAC;IACnC,SAAS,EAAE,IAAI,CAAC;IAChB,MAAM,EAAE,qBAAqB,CAAC;IAC9B,cAAc,EAAE,YAAY,CAAC;IAC7B,iBAAiB,EAAE,YAAY,GAAG,IAAI,CAAC;CACxC,GACD;IACE,MAAM,EAAE,eAAe,CAAC;IACxB;;;OAGG;IACH,SAAS,EAAE,SAAS,CAAC;IACrB,MAAM,EAAE,mBAAmB,CAAC;IAC5B,cAAc,EAAE,YAAY,CAAC;IAC7B,cAAc,EAAE,YAAY,GAAG,IAAI,CAAC;CACrC,CAAC;AAEN;;;;GAIG;AACH,MAAM,MAAM,cAAc,GAAG;IAC3B,gBAAgB,EAAE,OAAO,oBAAoB,CAAC;IAC9C,UAAU,EAAE;QACV,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;QAC3B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;QACzB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;QACzB,qBAAqB,EAAE,mBAAmB,CAAC;QAC3C,gBAAgB,EAAE,OAAO,CAAC;KAC3B,CAAC;IACF,GAAG,EAAE,iBAAiB,CAAC;IACvB,OAAO,EAAE;QACP;;;WAGG;QACH,wBAAwB,EAAE,OAAO,CAAC;QAClC;;;WAGG;QACH,sCAAsC,CAAC,EAAE,OAAO,CAAC;QACjD,iEAAiE;QACjE,SAAS,EAAE,OAAO,CAAC;QACnB,qDAAqD;QACrD,mBAAmB,EAAE,OAAO,CAAC;QAC7B,oCAAoC;QACpC,OAAO,EAAE,OAAO,CAAC;QACjB;;;WAGG;QACH,aAAa,EAAE,OAAO,CAAC;KACxB,CAAC;IACF;;;;;OAKG;IACH,YAAY,EAAE,WAAW,CAAC;IAC1B,MAAM,EAAE,oBAAoB,CAAC;CAC9B,CAAC;AAEF,uEAAuE;AACvE,MAAM,MAAM,gBAAgB,GAAG,mBAAmB,GAAG,cAAc,GAAG,QAAQ,CAAC;AAE/E,MAAM,MAAM,WAAW,GAAG;IACxB,KAAK,EAAE,gBAAgB,CAAC;IACxB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG;IACtC,+EAA+E;IAC/E,QAAQ,EAAE,mBAAmB,CAAC;IAC9B;;;;;;;;;;;OAWG;IACH,aAAa,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,KAAK,CAAC;YAAE,GAAG,CAAC,EAAE,MAAM,CAAC;YAAC,cAAc,CAAC,EAAE,MAAM,CAAC;YAAC,MAAM,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC,CAAA;KAAE,GAAG,IAAI,CAAC;CACrG,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG;IACpC,QAAQ,CAAC,EAAE,mBAAmB,GAAG,IAAI,CAAC;IACtC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,YAAY,CAAC,EAAE;QACb,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,cAAc,CAAC,EAAE,MAAM,CAAC;KACzB,GAAG,IAAI,CAAC;IACT;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,aAAa,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,KAAK,CAAC;YAAE,GAAG,CAAC,EAAE,MAAM,CAAC;YAAC,cAAc,CAAC,EAAE,MAAM,CAAC;YAAC,MAAM,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC,CAAA;KAAE,GAAG,IAAI,CAAC;IACpG,oDAAoD;IACpD,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,0FAA0F;IAC1F,OAAO,CAAC,EAAE,kBAAkB,GAAG,kBAAkB,CAAC;CACnD,CAAC;AAwBF,mFAAmF;AACnF,MAAM,MAAM,mBAAmB,GAAG;IAChC,uEAAuE;IACvE,aAAa,EAAE,OAAO,CAAC;IACvB,2EAA2E;IAC3E,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB,CAAC;AAEF;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAChC,OAAO,EAAE,uBAAuB,CAAC,eAAe,CAAC,EACjD,GAAG,CAAC,EAAE,MAAM,GACX,mBAAmB,CA0CrB;AAED,6FAA6F;AAC7F,MAAM,MAAM,WAAW,GAAG,0BAA0B,GAAG,0BAA0B,GAAG,wCAAwC,CAAC;AAC7H,eAAO,MAAM,uBAAuB,EAAG,yBAAkC,CAAC;AAE1E,MAAM,MAAM,uBAAuB,GAAG;IACpC,YAAY,EAAE,WAAW,CAAC;IAC1B,sBAAsB,CAAC,EAAE,OAAO,uBAAuB,CAAC;CACzD,CAAC;AA8CF;;;;;GAKG;AACH,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,OAAO,EAChB,QAAQ,EAAE,WAAW,GAAG,SAAS,EACjC,IAAI,GAAE,uBAA4B,GACjC,uBAAuB,CAWzB;AAkBD,qFAAqF;AACrF,wBAAgB,+BAA+B,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAY/E;AAiBD;;;GAGG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,OAAO,EAChB,IAAI,GAAE,uBAA4B,GACjC,WAAW,CAsDb;AAED,2DAA2D;AAC3D,wBAAgB,qBAAqB,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,IAAI,mBAAmB,CAQ1E;AAED,iFAAiF;AACjF,wBAAgB,2BAA2B,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,IAAI,yBAAyB,CAAC,OAAO,CAAC,CAuB/F;AA0CD;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,mBAAmB,EAC1B,OAAO,EAAE,yBAAyB,CAAC,OAAO,CAAC,EAC3C,IAAI,GAAE,uBAA4B,GACjC,cAAc,CAiIhB"}
+{"version":3,"file":"cas-attestation.d.ts","sourceRoot":"","sources":["../../src/cas-attestation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAGH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAC1D,OAAO,KAAK,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAErF,OAAO,KAAK,EAAE,yBAAyB,EAAE,mBAAmB,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAE3G,uEAAuE;AACvE,eAAO,MAAM,oBAAoB,EAAG,oBAA6B,CAAC;AAElE;;;GAGG;AACH,MAAM,MAAM,oBAAoB,GAAG;IACjC,uEAAuE;IACvE,iCAAiC,EAAE,IAAI,CAAC;IACxC,mGAAmG;IACnG,mDAAmD,EAAE,IAAI,CAAC;IAC1D,qGAAqG;IACrG,sCAAsC,EAAE,IAAI,CAAC;IAC7C,4FAA4F;IAC5F,qDAAqD,EAAE,IAAI,CAAC;IAC5D,yFAAyF;IACzF,iCAAiC,EAAE,IAAI,CAAC;IACxC,yFAAyF;IACzF,oCAAoC,EAAE,IAAI,CAAC;CAC5C,CAAC;AAWF,kFAAkF;AAClF,MAAM,MAAM,iBAAiB,GACzB;IACE,MAAM,EAAE,WAAW,CAAC;IACpB,SAAS,EAAE,IAAI,CAAC;IAChB,aAAa,EAAE,YAAY,CAAC;CAC7B,GACD;IACE,MAAM,EAAE,SAAS,CAAC;IAClB,SAAS,EAAE,KAAK,CAAC;IACjB,MAAM,EAAE,qBAAqB,CAAC;IAC9B,cAAc,EAAE,YAAY,CAAC;IAC7B,aAAa,EAAE,YAAY,GAAG,IAAI,CAAC;CACpC,GACD;IACE,MAAM,EAAE,0BAA0B,CAAC;IACnC,SAAS,EAAE,IAAI,CAAC;IAChB,MAAM,EAAE,qBAAqB,CAAC;IAC9B,cAAc,EAAE,YAAY,CAAC;IAC7B,iBAAiB,EAAE,YAAY,GAAG,IAAI,CAAC;CACxC,GACD;IACE,MAAM,EAAE,eAAe,CAAC;IACxB;;;OAGG;IACH,SAAS,EAAE,SAAS,CAAC;IACrB,MAAM,EAAE,mBAAmB,CAAC;IAC5B,cAAc,EAAE,YAAY,CAAC;IAC7B,cAAc,EAAE,YAAY,GAAG,IAAI,CAAC;CACrC,CAAC;AAEN;;;;GAIG;AACH,MAAM,MAAM,cAAc,GAAG;IAC3B,gBAAgB,EAAE,OAAO,oBAAoB,CAAC;IAC9C,UAAU,EAAE;QACV,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;QAC3B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;QACzB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;QACzB,qBAAqB,EAAE,mBAAmB,CAAC;QAC3C,gBAAgB,EAAE,OAAO,CAAC;KAC3B,CAAC;IACF,GAAG,EAAE,iBAAiB,CAAC;IACvB,OAAO,EAAE;QACP;;;WAGG;QACH,wBAAwB,EAAE,OAAO,CAAC;QAClC;;;WAGG;QACH,sCAAsC,CAAC,EAAE,OAAO,CAAC;QACjD,iEAAiE;QACjE,SAAS,EAAE,OAAO,CAAC;QACnB,qDAAqD;QACrD,mBAAmB,EAAE,OAAO,CAAC;QAC7B,oCAAoC;QACpC,OAAO,EAAE,OAAO,CAAC;QACjB;;;WAGG;QACH,aAAa,EAAE,OAAO,CAAC;KACxB,CAAC;IACF;;;;;OAKG;IACH,YAAY,EAAE,WAAW,CAAC;IAC1B,MAAM,EAAE,oBAAoB,CAAC;CAC9B,CAAC;AAEF,uEAAuE;AACvE,MAAM,MAAM,gBAAgB,GAAG,mBAAmB,GAAG,cAAc,GAAG,QAAQ,CAAC;AAE/E,MAAM,MAAM,WAAW,GAAG;IACxB,KAAK,EAAE,gBAAgB,CAAC;IACxB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG;IACtC,+EAA+E;IAC/E,QAAQ,EAAE,mBAAmB,CAAC;IAC9B;;;;;;;;;;;OAWG;IACH,aAAa,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,KAAK,CAAC;YAAE,GAAG,CAAC,EAAE,MAAM,CAAC;YAAC,cAAc,CAAC,EAAE,MAAM,CAAC;YAAC,MAAM,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC,CAAA;KAAE,GAAG,IAAI,CAAC;CACrG,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG;IACpC,QAAQ,CAAC,EAAE,mBAAmB,GAAG,IAAI,CAAC;IACtC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,YAAY,CAAC,EAAE;QACb,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,cAAc,CAAC,EAAE,MAAM,CAAC;KACzB,GAAG,IAAI,CAAC;IACT;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,aAAa,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,KAAK,CAAC;YAAE,GAAG,CAAC,EAAE,MAAM,CAAC;YAAC,cAAc,CAAC,EAAE,MAAM,CAAC;YAAC,MAAM,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC,CAAA;KAAE,GAAG,IAAI,CAAC;IACpG;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,eAAe,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,KAAK,CAAC;YAAE,GAAG,CAAC,EAAE,MAAM,CAAC;YAAC,cAAc,CAAC,EAAE,MAAM,CAAC;YAAC,MAAM,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC,CAAA;KAAE,GAAG,IAAI,CAAC;IACtG,oDAAoD;IACpD,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,0FAA0F;IAC1F,OAAO,CAAC,EAAE,kBAAkB,GAAG,kBAAkB,CAAC;CACnD,CAAC;AAwBF,mFAAmF;AACnF,MAAM,MAAM,mBAAmB,GAAG;IAChC,uEAAuE;IACvE,aAAa,EAAE,OAAO,CAAC;IACvB,2EAA2E;IAC3E,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB,CAAC;AAEF;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAChC,OAAO,EAAE,uBAAuB,CAAC,eAAe,CAAC,EACjD,GAAG,CAAC,EAAE,MAAM,GACX,mBAAmB,CA0CrB;AAED,6FAA6F;AAC7F,MAAM,MAAM,WAAW,GAAG,0BAA0B,GAAG,0BAA0B,GAAG,wCAAwC,CAAC;AAC7H,eAAO,MAAM,uBAAuB,EAAG,yBAAkC,CAAC;AAE1E,MAAM,MAAM,uBAAuB,GAAG;IACpC,YAAY,EAAE,WAAW,CAAC;IAC1B,sBAAsB,CAAC,EAAE,OAAO,uBAAuB,CAAC;CACzD,CAAC;AA8CF;;;;;GAKG;AACH,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,OAAO,EAChB,QAAQ,EAAE,WAAW,GAAG,SAAS,EACjC,IAAI,GAAE,uBAA4B,GACjC,uBAAuB,CAWzB;AAkBD,qFAAqF;AACrF,wBAAgB,+BAA+B,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAY/E;AAiBD;;;GAGG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,OAAO,EAChB,IAAI,GAAE,uBAA4B,GACjC,WAAW,CAsDb;AAED,2DAA2D;AAC3D,wBAAgB,qBAAqB,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,IAAI,mBAAmB,CAQ1E;AAED,iFAAiF;AACjF,wBAAgB,2BAA2B,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,IAAI,yBAAyB,CAAC,OAAO,CAAC,CAuB/F;AA0CD;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,mBAAmB,EAC1B,OAAO,EAAE,yBAAyB,CAAC,OAAO,CAAC,EAC3C,IAAI,GAAE,uBAA4B,GACjC,cAAc,CAuKhB"}

package/dist/esm/cas-attestation.js

@@ -387,6 +387,18 @@ export function buildCasAttestation(proof, outcome, opts = {}) {
             binding = { state: 'UNAUTHORIZED', shortfalls: ['the vendored core predicate could not be loaded'] };
         }
         else {
+            // eslint-disable-next-line global-require, @typescript-eslint/no-var-requires
+            const { createPublicKey: createPk } = require('node:crypto');
+            const receiptKeyring = opts.receipt_keyring && Array.isArray(opts.receipt_keyring.keys)
+                ? new Map(opts.receipt_keyring.keys
+                    .filter((k) => k && k.kid && k.public_key_pem)
+                    .map((k) => [k.kid, {
+                        publicKey: createPk(k.public_key_pem),
+                        status: k.status || 'active',
+                        retired_at: null,
+                        compromised_at: null,
+                    }]))
+                : null;
             const keyring = opts.grant_keyring && Array.isArray(opts.grant_keyring.keys)
                 ? new Map(opts.grant_keyring.keys
                     .filter((k) => k && typeof k.kid === 'string' && typeof k.public_key_pem === 'string')
@@ -399,7 +411,24 @@ export function buildCasAttestation(proof, outcome, opts = {}) {
                     }]))
                 : null;
             const r = core.verifiedExecutionBinding({
-                receipt: { verified: receipt_verified },
+                // ── THE RECEIPT, HANDED OVER WHEN THE CALLER HAS IT ─────────────────────────────
+                //
+                // `proof.receipt` records the guard's OWN bind step — it carries no token, by design. So
+                // when a caller supplies the receipt bytes and a keyring, the core verifies them; when it
+                // does not, `verified` is still passed and the core marks the result caller-asserted.
+                //
+                // That marking is not cosmetic any more: a caller-asserted receipt can no longer reach the
+                // global success token. It does not change THIS surface's answer, because this surface
+                // asks a CUSTOM authority set and reads `requirements_satisfied` — but the distinction is
+                // now visible in the state rather than only in a boolean nobody branched on.
+                receipt: opts.receipt_token
+                    ? {
+                        token: opts.receipt_token,
+                        keyring: receiptKeyring,
+                        expectedKid: null,
+                        ...(Number.isFinite(opts.now) ? { now: opts.now } : {}),
+                    }
+                    : { verified: receipt_verified },
                 grant: { token: grantToken, keyring, expectedKid: null, ...(Number.isFinite(opts.now) ? { now: opts.now } : {}) },
                 attestation: {
                     token: attToken,
@@ -413,7 +442,16 @@ export function buildCasAttestation(proof, outcome, opts = {}) {
                 required: ['issuer_grant', 'executor_attestation'],
             });
             binding = { state: r.state, shortfalls: r.shortfalls };
-            authorized_and_committed = r.authorized_and_committed === true;
+            // ── THE FIELD THIS SURFACE IS ENTITLED TO ────────────────────────────────────────
+            //
+            // This asks a CUSTOM authority set (issuer_grant + executor_attestation), and the core no
+            // longer lets a custom set reach `authorized_and_committed` — asking for less must not
+            // produce the word every consumer reads as the answer. `requirements_satisfied` is "the set
+            // I asked for is met", which is exactly the question this surface asks.
+            //
+            // MEASURED: reading `authorized_and_committed` after the core change would have made this
+            // permanently false, and a guard that refuses everything looks like a guard that works.
+            authorized_and_committed = r.requirements_satisfied === true;
         }
     }
     if (opts.profile === 'ENFORCING_ATOMIC') {