@cygnuxlabs/tracekit 0.0.0-stage → 1.2.2

package/dist/verify/index.js

@@ -0,0 +1,930 @@
+/**
+ * An independent verifier of `tracekit.bundle.v2` bundles, written from docs/format-v2.md (§11 is the algorithm) and
+ * checked against the reference (tracekit/verify/v2.py) by tests/test_ts_verifier.py: same checks, integrity, assurance
+ * and exit codes. Web Crypto and DecompressionStream only, so it runs in Node ≥ 20 and current browsers.
+ *
+ *     import { verify } from "@cygnuxlabs/tracekit/verify";
+ *     const { report, code } = await verify(bundleBytes, trustConfigBytes);
+ *
+ * Not implemented here, so never VERIFIED when a bundle relies on them (integrity `UNVERIFIABLE (...)` names them):
+ * SLH-DSA-SHA2-128s hybrid checkpoint lines (Web Crypto has no SLH-DSA), Rekor v2 anchors, record-key certificates,
+ * tracekit why findings and replay runs.
+ * Monitor reports, revocations and the v1 format bridge are inputs of the reference's CLI that this one doesn't take.
+ */
+import { canonicalize, strictParseBytes } from "./jcs.js";
+import { HYBRID, NoteError, SIGNER_LEAVES, b64decode, bytes, equal, keyAlg, leafHash, openNote, parseLeaf, parseVkey, registryOrigin, runHash, sha256hex, spkiKid, unhex, verifyConsistency, verifyInclusion, verifyV2, vkey, } from "./primitives.js";
+import { Detector } from "./detect.js";
+import { same, validateEvent } from "./schema.js";
+import { MAX_ENTRY, readZip } from "./zip.js";
+export { MAX_ENTRIES, MAX_ENTRY, MAX_TOTAL, Unusable, readZip } from "./zip.js";
+export { StrictJSONError, canonicalize, strictParse, strictParseBytes } from "./jcs.js";
+/** The bundle format version this verifier implements: a bundle needing a later one is UNVERIFIABLE. */
+export const VERSION = "1.2.2";
+export const EXIT_OK = 0, EXIT_FAIL = 1, EXIT_BAD = 2, EXIT_WARN = 3;
+const FORMAT = "tracekit.bundle.v2";
+const MAX_LINE = 1 << 20;
+const MAX_LINES = MAX_ENTRY / 256; // per JSON lines file: no signed record is shorter than 256 bytes
+const CLASSES = ["public", "customer", "tracekit", "operator"];
+const KEY_TYPES = ["signer.epoch", "key.retire"];
+const ZERO_HASH = "sha256:" + "0".repeat(64);
+const MATRIX = ["model_calls", "tool_calls", "network", "processes", "services"];
+const COVERED = ["none", "reported", "observed", "enforced"]; // weakest first
+export class Report {
+    checks = [];
+    failures = [];
+    warnings = [];
+    notes = [];
+    integrity = "UNUSABLE BUNDLE";
+    assurance = "none";
+    /** Checks the bundle needs that this verifier does not implement. */
+    unsupported = [];
+    check(check, ok, detail = "", problems = [], warn = false) {
+        this.checks.push({ check, status: ok ? "pass" : warn ? "warn" : "fail", detail, problems });
+        if (!ok)
+            (warn ? this.warnings : this.failures).push(check);
+    }
+    unsupport(what) {
+        if (this.unsupported.includes(what))
+            return;
+        this.unsupported.push(what);
+        this.check(what, false, "not implemented by this verifier", [], true);
+    }
+}
+const isObj = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+/** The manifest check's detail: on a failure, the files that differ from the manifest (the first 5) and how. */
+function manifestDetail(listed, hashes, bad) {
+    if (!isObj(listed))
+        return "the manifest lists no files";
+    if (bad.length === 0)
+        return "every file is listed with its SHA-256 and nothing else is in the bundle";
+    const how = bad.slice(0, 5).map((n) => `${n} (${Object.hasOwn(listed, n) && hashes.has(n) ? "changed"
+        : Object.hasOwn(listed, n) ? "missing" : "not listed"})`);
+    return "files differ from the manifest: " + how.join(", ") + (bad.length > 5 ? ` and ${bad.length - 5} more` : "");
+}
+const kind = (v) => v === null ? "null" : Array.isArray(v) ? "array" : typeof v;
+function at(o, k) {
+    if (!isObj(o))
+        throw new TypeError(`${kind(o)} is not an object`);
+    if (!Object.hasOwn(o, k))
+        throw new TypeError(`missing ${JSON.stringify(k)}`);
+    return o[k];
+}
+function get(o, k, missing = null) {
+    if (!isObj(o))
+        throw new TypeError(`${kind(o)} is not an object`);
+    return Object.hasOwn(o, k) ? o[k] : missing;
+}
+function has(o, k) {
+    if (isObj(o))
+        return Object.hasOwn(o, k);
+    if (Array.isArray(o))
+        return o.some((x) => x === k);
+    if (typeof o === "string")
+        return o.includes(k);
+    throw new TypeError(`${kind(o)} is not a container`);
+}
+function list(v) {
+    if (!Array.isArray(v))
+        throw new TypeError(`${kind(v)} is not a list`);
+    return v;
+}
+function num(v) {
+    if (typeof v === "number")
+        return v;
+    if (typeof v === "boolean")
+        return Number(v);
+    throw new TypeError(`${kind(v)} is not a number`);
+}
+function text(v) {
+    if (typeof v !== "string")
+        throw new TypeError(`${kind(v)} is not a string`);
+    return v;
+}
+const truthy = (v) => Array.isArray(v) ? v.length > 0 : isObj(v) ? Object.keys(v).length > 0 : !!v;
+const str = (v) => v === null ? "None" : v === true ? "True" : v === false ? "False"
+    : typeof v === "string" ? v : JSON.stringify(v);
+const repr = (v) => typeof v === "string" ? `'${v.replace(/\\/g, "\\\\").replace(/'/g, "\\'")}'` : str(v);
+const cut = (s, n) => [...s].slice(0, n).join("");
+const count = (xs) => {
+    const m = new Map();
+    for (const x of xs)
+        m.set(x, (m.get(x) ?? 0) + 1);
+    return [...m].sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0);
+};
+const fmt = (ts) => {
+    if (ts > 253402300799)
+        throw new RangeError("year is out of range");
+    return new Date(Number(ts) * 1000).toISOString().slice(0, 19) + "Z";
+};
+async function loadTrust(data) {
+    const floats = new WeakMap();
+    const t = strictParseBytes(data.subarray(0, MAX_LINE), floats);
+    const int = (o, k, d) => !Object.hasOwn(o, k) ? d
+        : Number.isInteger(o[k]) && !floats.get(o)?.has(k) ? o[k] : NaN;
+    const exactly = (o, ks) => isObj(o) && Object.keys(o).length === ks.length && ks.every((k) => Object.hasOwn(o, k));
+    const strings = (a) => Array.isArray(a) && a.length > 0 && a.every((x) => typeof x === "string");
+    const opt = (o, k) => Object.hasOwn(o, k) ? o[k] : [];
+    const r = isObj(t) ? get(t, "rekor", {}) : null;
+    const ok = isObj(t) && Object.keys(t).every((k) => ["logs", "witnesses", "algs", "witnesses_required", "rekor",
+        "monitors", "issuers"].includes(k))
+        && isObj(r) && (!Object.keys(r).length || exactly(r, ["trusted_root", "publishing_key", "class"])
+        && isObj(r.trusted_root) && typeof r.publishing_key === "string" && CLASSES.includes(r.class))
+        && strings(t.logs)
+        && Array.isArray(opt(t, "witnesses")) && opt(t, "witnesses").every((w) => exactly(w, ["vkey", "class"])
+        && typeof w.vkey === "string" && CLASSES.includes(w.class))
+        && strings(t.algs) && int(t, "witnesses_required", 0) >= 0
+        && Array.isArray(opt(t, "monitors")) && opt(t, "monitors").every((m) => exactly(m, ["vkey", "class", "max_age_s"])
+        && typeof m.vkey === "string" && CLASSES.includes(m.class) && int(m, "max_age_s", 0) > 0)
+        && Array.isArray(opt(t, "issuers")) && opt(t, "issuers").every((i) => exactly(i, ["vkey", "issuance_log_vkey"])
+        && Object.values(i).every((v) => typeof v === "string"));
+    if (!ok)
+        throw new Error("not a v2 trust config (logs, witnesses, algs, witnesses_required, rekor, monitors, issuers)");
+    for (const k of [...t.logs, ...opt(t, "witnesses").map((w) => w.vkey), ...opt(t, "monitors").map((m) => m.vkey),
+        ...opt(t, "issuers").flatMap((i) => Object.values(i))])
+        await parseVkey(k);
+    t.witnesses ??= [];
+    t.witnesses_required ??= 0;
+    t.issuers ??= [];
+    return t;
+}
+function newer(need, have) {
+    const a = need.split(".").map(Number), b = have.split(".").map(Number);
+    for (let i = 0; i < Math.min(a.length, b.length); i++)
+        if (a[i] !== b[i])
+            return a[i] > b[i];
+    return a.length > b.length;
+}
+const errorText = (e) => `${e?.constructor?.name ?? "Error"}: ${e?.message ?? e}`;
+/** Verify a v2 bundle (zip bytes) against the verifier's own pinned trust config (JSON bytes). Never throws. */
+export async function verify(bundle, trust) {
+    const rep = new Report();
+    let t, files, manifest;
+    try {
+        t = await loadTrust(trust);
+    }
+    catch (e) {
+        rep.check("trust config", false, errorText(e));
+        return { report: rep, code: EXIT_BAD };
+    }
+    const floats = new WeakMap();
+    try {
+        files = await readZip(bundle);
+        const m = files.get("manifest.json");
+        if (!m)
+            throw new Error("no manifest.json");
+        files.delete("manifest.json");
+        manifest = strictParseBytes(m, floats);
+        if (!isObj(manifest) || manifest.format !== FORMAT)
+            throw new Error(`format is not ${FORMAT}`);
+        const need = manifest.verifier_min_version;
+        if (!(typeof need === "string" && /^\d{1,9}(\.\d{1,9}){0,2}$/.test(need)))
+            throw new Error("verifier_min_version is not a version number");
+        if (newer(need, VERSION)) {
+            rep.integrity = `UNVERIFIABLE (needs tracekit >= ${need})`;
+            rep.check("bundle readable", false, rep.integrity);
+            return { report: rep, code: EXIT_BAD };
+        }
+    }
+    catch (e) {
+        rep.check("bundle readable", false, `cannot read bundle: ${errorText(e)}`);
+        return { report: rep, code: EXIT_BAD };
+    }
+    try {
+        await check(rep, manifest, files, t, floats);
+    }
+    catch (e) {
+        rep.check("bundle structure", false, "", [`malformed and could not be fully checked: ${errorText(e)}`]);
+    }
+    if (rep.failures.length)
+        rep.integrity = "FAILED";
+    else if (rep.unsupported.length)
+        rep.integrity = `UNVERIFIABLE (not checked by this verifier: ${rep.unsupported.join(", ")})`;
+    return { report: rep, code: rep.failures.length ? EXIT_FAIL : rep.integrity.startsWith("UNVERIFIABLE") ? EXIT_BAD : EXIT_OK };
+}
+async function check(rep, manifest, files, trust, floats) {
+    const file = (name) => {
+        const f = files.get(name);
+        if (!f)
+            throw new TypeError(`no ${name}`);
+        return f;
+    };
+    const json = (name) => strictParseBytes(file(name), floats);
+    const jsonl = (name) => {
+        const data = file(name);
+        if (data.length && data.at(-1) !== 0x0a)
+            throw new Error("a JSON lines file must end in a newline");
+        const lines = [];
+        for (let i = 0, j; (j = data.indexOf(0x0a, i)) >= 0; i = j + 1) {
+            // checked before any is parsed: a run of tiny lines costs no memory
+            if (lines.length === MAX_LINES)
+                throw new Error("more lines than the bundle limits");
+            lines.push(data.subarray(i, j));
+        }
+        if (lines.some((l) => l.length > MAX_LINE))
+            throw new Error("line longer than the bundle limits");
+        return lines.map((l) => strictParseBytes(l, floats));
+    };
+    const listed = manifest.files, hashes = new Map();
+    for (const [n, b] of files)
+        hashes.set(n, await sha256hex(b));
+    const bad = isObj(listed) ? [...new Set([...Object.keys(listed), ...hashes.keys()])]
+        .filter((n) => !(Object.hasOwn(listed, n) && hashes.get(n) === listed[n])).sort() : [];
+    rep.check("manifest", isObj(listed) && bad.length === 0, manifestDetail(listed, hashes, bad));
+    // the checkpoint: the only thing the records' trust hangs on
+    const proofs = json("proofs/records.json");
+    const name = at(proofs, "checkpoint");
+    if (!(typeof name === "string" && name.startsWith("checkpoints/") && name.endsWith(".note")))
+        throw new Error("proofs name no checkpoint note");
+    const witnesses = new Map(trust.witnesses.map((w) => [w.vkey, w.class]));
+    let note;
+    try {
+        note = await openNote(file(name), trust.logs, [...witnesses.keys()]);
+    }
+    catch (e) {
+        if (!(e instanceof NoteError))
+            throw e;
+        rep.check("checkpoint", false, e.message);
+        return;
+    }
+    const { origin, size, root, cosigs } = note;
+    rep.check("checkpoint", same(size, at(proofs, "tree_size")), `${origin} at tree size ${size}, signed by its pinned log key`);
+    if (note.unchecked)
+        rep.unsupport("SLH-DSA-SHA2-128s checkpoint signature");
+    rep.check("witness quorum", cosigs.length >= trust.witnesses_required, `${cosigs.length} pinned cosignature(s), ${trust.witnesses_required} required`);
+    if (truthy(trust.rekor) && files.has(`rekor/${size}.json`))
+        rep.unsupport("rekor anchor");
+    const included = async (r) => {
+        const seq = at(at(r, "event"), "seq");
+        const path = get(at(proofs, "inclusion"), str(seq));
+        return path !== null && verifyInclusion(num(seq), size, await leafHash(unhex(text(at(r, "hash")).slice(7))), list(path).map(b64decode), root);
+    };
+    // keys: declared and retired by records the checkpointed tree includes, so the log key vouches for them
+    const keyRecords = jsonl("keys/records.jsonl"), keyProblems = [], timeline = new Map();
+    const logId = keyRecords.length ? get(at(keyRecords[0], "event"), "log_id") : null;
+    const keysAt = (seq) => [...timeline.values()].filter((k) => num(k.from) <= seq
+        && (k.until === null || seq <= num(k.until))).map((k) => k.spki);
+    /** Signature, schema and log membership of one record under `keys`, the SPKIs valid at its position. */
+    const checkRecord = async (r, keys, problems) => {
+        const err = await verifyRecord(r, keys, trust.algs);
+        if (err) {
+            const seq = err === "unknown kid" ? get(r.event, "seq") : null; // a well-formed record by then
+            const retired = [...timeline.values()].filter((k) => Number.isInteger(seq) && k.until !== null && k.until < seq);
+            if (retired.length && !await verifyRecord(r, retired.map((k) => k.spki), trust.algs))
+                problems.push(`seq ${seq}: signed by key ${cut(r.kid, 80)} after its key.retire`);
+            else
+                problems.push(`seq ${repr(get(get(r, "event", {}), "seq"))}: ${err}`);
+            return;
+        }
+        const e = r.event;
+        const errs = get(e, "schema_version") === "tracekit.event.v2" ? validateEvent(e, floats) : ["not a tracekit.event.v2 event"];
+        problems.push(...errs.map((x) => `seq ${repr(get(e, "seq"))}: ${x}`));
+        if (!errs.length && !same(get(e, "log_id"), logId))
+            problems.push(`seq ${e.seq}: another log's record`);
+    };
+    let last = -1;
+    for (const r of keyRecords) {
+        const e = at(r, "event");
+        if (!KEY_TYPES.includes(at(e, "type")) || num(at(e, "seq")) <= last || !await included(r)) {
+            keyProblems.push(`seq ${str(at(e, "seq"))}: not a key record of the checkpointed tree, in order`);
+            continue;
+        }
+        last = e.seq;
+        const declared = new Map();
+        if (e.type === "signer.epoch") {
+            for (const k of list(get(at(e, "data"), "keys", []))) {
+                const der = b64decode(at(k, "spki"));
+                if (await spkiKid(der) !== at(k, "kid") || keyAlg(der) !== at(k, "alg"))
+                    keyProblems.push(`seq ${e.seq}: key ${str(k.kid)} does not match its SPKI`);
+                if (!has(k, "cert") && trust.issuers.length && !truthy(get(e.data, "bridge"))) {
+                    keyProblems.push(`seq ${e.seq}: key ${cut(str(k.kid), 80)} has no certificate, and the trust config pins issuers`);
+                    continue;
+                }
+                // lean: a certified key is taken as declared and the bundle left UNVERIFIABLE; port docs/issuer.md's checks
+                // (issuance log notes, validity, tenants, revocations) when certified record keys are in use
+                if (has(k, "cert"))
+                    rep.unsupport("record-key certificates");
+                declared.set(k.kid, { spki: der, from: e.seq, until: null });
+            }
+        }
+        await checkRecord(r, [...keysAt(e.seq), ...[...declared.values()].map((k) => k.spki)], keyProblems);
+        if (e.type === "key.retire") {
+            const kid = at(at(e, "data"), "kid");
+            if (!timeline.has(kid))
+                keyProblems.push(`seq ${e.seq}: retires an unknown key`);
+            else
+                timeline.get(kid).until = at(e.data, "last_seq");
+        }
+        for (const [kid, k] of declared)
+            timeline.set(kid, k);
+    }
+    // the runs: one, or with a run-set any number, or one with its tracekit why findings and replay runs
+    // lean: findings (verify/v2.py's _findings) are not checked here: a bundle with them is UNVERIFIABLE; port it when
+    // TS users verify findings bundles
+    const names = [...files.keys()].filter((n) => n.startsWith("runs/")).sort();
+    const runSet = files.has("registry/run-set.json");
+    const runs = new Map(), problems = [], chain = [], outside = [];
+    for (const name of names) {
+        const records = jsonl(name);
+        runs.set(name, records);
+        if (!records.length)
+            throw new Error("a run has no records");
+        const head = at(records[0], "event");
+        for (const [i, r] of records.entries()) {
+            await checkRecord(r, keysAt(num(at(at(r, "event"), "seq"))), problems);
+            const e = r.event, prev = i ? records[i - 1] : null;
+            if (!same(get(e, "run_seq"), i) || !same(get(e, "run_prev_hash"), prev ? at(prev, "hash") : ZERO_HASH)
+                || !same([get(e, "tenant"), get(e, "run_id")], [get(head, "tenant"), get(head, "run_id")])
+                || prev && (num(at(e, "seq")) <= num(at(at(prev, "event"), "seq")) || get(prev.event, "type") === "run.final"))
+                chain.push(`run ${repr(cut(str(get(head, "run_id")), 200))} run_seq ${i} (seq ${repr(get(e, "seq"))}) does not `
+                    + "continue the run");
+        }
+        if (!(await included(records[0]) && await included(records.at(-1))))
+            outside.push(`run ${repr(cut(str(get(head, "run_id")), 200))}`);
+    }
+    const why = [...runs.values()].some((rs) => rs.some((r) => get(r.event, "type") === "why.finding")
+        || get(rs[0].event, "type") === "run.registered" && ["analyzes", "replay_of"].some((k) => has(get(rs[0].event, "data"), k)));
+    if (why)
+        rep.unsupport("tracekit why findings");
+    else if (names.length !== 1 && !runSet)
+        throw new Error("a v2 bundle holds exactly one run, or a run-set");
+    let retired = [], provenTo = -1, regCosigs = [];
+    if (runSet) {
+        [retired, provenTo, regCosigs] = await checkRunSet(rep, json("registry/run-set.json"), jsonl, file, trust, witnesses, origin, size, runs, included, (r, p) => checkRecord(r, keysAt(num(at(at(r, "event"), "seq"))), p), floats);
+        const keyed = new Set(keyRecords.map((r) => `${at(at(r, "event"), "seq")} ${at(r, "hash")}`));
+        keyProblems.push(...retired.filter(([seq, h]) => !keyed.has(`${seq} ${h}`))
+            .map(([seq]) => `seq ${seq}: key.retire withheld (the registry log has it)`));
+    }
+    rep.check("keys", timeline.size > 0 && !keyProblems.length, `${timeline.size} record key(s) from ${keyRecords.length} key `
+        + "record(s)", keyProblems);
+    const every = [...runs.values()].flat();
+    const seqs = [...keyRecords, ...every].map((r) => num(at(at(r, "event"), "seq")));
+    if (!seqs.length)
+        throw new Error("the bundle holds no key or run records");
+    const relied = Math.max(...seqs);
+    const rotated = timeline.size > 1 || keyRecords.some((r) => get(r.event, "type") === "key.retire");
+    if (provenTo < relied && rotated) // one key never retired: the assurance line notes it, no warning
+        rep.check("keys", false, "retirements not proven complete", [`no run-set from registry size 0 reaches seq ${relied}, so a withheld key.retire would not show`], true);
+    const bridge = keyRecords.map((r) => r.event).find((e) => e.type === "signer.epoch" && has(at(e, "data"), "bridge"));
+    if (bridge && truthy(bridge.data.bridge))
+        rep.notes.push(`this log continues the v1 ledger of key ${str(at(bridge.data.bridge, "v1_kid"))}; pass the v1 ledger and `
+            + "its signer.pub to the reference verifier to check the format bridge");
+    rep.check("signatures", !problems.length, `${every.length} record(s), keys valid at their position`, problems);
+    const only = runs.size === 1 ? [...runs.values()][0][0].event : null;
+    rep.check("run chain", !chain.length, only ? `run ${repr(cut(str(get(only, "run_id")), 200))} of tenant `
+        + `${repr(get(only, "tenant"))}, contiguous from run_seq 0` : `${runs.size} run(s), each contiguous from run_seq 0`, chain);
+    rep.check("inclusion", !outside.length, `first and last records of ${runs.size} run(s) are in the checkpointed tree of `
+        + `size ${size}`, outside);
+    // policy_hash -> the bundled snapshot named by it: the one set checkIncidents and approvals check against
+    const policies = new Map();
+    for (const p of [...files.keys()].filter((n) => n.startsWith("policies/")).sort()) {
+        const hex = await sha256hex(file(p));
+        rep.check("policy snapshot", p === `policies/${hex}.json`, p);
+        if (p === `policies/${hex}.json`)
+            policies.set(`sha256:${hex}`, file(p));
+    }
+    const open = [...runs.values()].filter((rs) => get(rs.at(-1).event, "type") !== "run.final");
+    rep.integrity = !open.length ? "VERIFIED" : only ? `VERIFIED TO HEAD ${str(get(open[0].at(-1).event, "run_seq"))} (open)`
+        : `VERIFIED (${open.length} run(s) open)`;
+    const events = every.map((r) => r.event), typed = (t) => events.filter((e) => get(e, "type") === t);
+    const selfApproved = typed("approval").some((e) => get(at(e, "data"), "self_approved") === true);
+    const gaps = (k) => typed("capture.gap").filter((e) => get(at(e, "data"), "kind") === k)
+        .map((e) => `seq ${e.seq}: ${cut(str(get(e.data, "reason")), 200)}`);
+    const against = gaps("executed_against_policy");
+    if (against.length)
+        rep.check("policy", false, `${against.length} tool call(s) ran against a deny or an unapproved ask`, against.slice(0, 20), true);
+    const unresolved = gaps("held_call_unresolved"); // the signer's word that a held call ended its run without a result
+    if (unresolved.length)
+        rep.check("held calls", false, `${unresolved.length} tool call(s) a gateway or executor decided have no result`, unresolved.slice(0, 20), true);
+    // capture.gap kinds that say nothing against a run's own records, and those warned on lines of their own
+    const info = ["witness_late", "witness_failed", "degraded_unanchored", "clock_skew", "format_upgrade", "key_retired",
+        "args_coerced", "approval_expired", "executed_against_policy", "held_call_unresolved", "decision_mismatch",
+        "observer_lost"];
+    const alarms = events.filter((e) => ["approval.binding_mismatch", "trace.tamper"].includes(get(e, "type"))
+        || get(e, "type") === "capture.gap" && !info.includes(get(at(e, "data"), "kind")));
+    if (alarms.length) {
+        const kindOf = (e) => e.type === "capture.gap" ? cut(str(get(e.data, "kind")), 64) : e.type;
+        rep.check("gaps", false, `${alarms.length} signed gap, tamper or mismatch record(s): `
+            + count(alarms.map(kindOf)).map(([k, n]) => `${k} ${n}`).join(", "), alarms.map((e) => `seq ${e.seq}: ${kindOf(e)}: ` + (e.type === "approval.binding_mismatch"
+            ? `approval ${cut(str(get(e.data, "approval_id")), 200)} of call ${cut(str(get(e.data, "tool_use_id")), 200)}`
+                + ": the arguments differ from the approved ones"
+            : cut(str(get(e.data, "reason", get(e.data, "path"))), 200))).slice(0, 20), true);
+    }
+    const external = typed("policy.external").map((e) => at(e, "data")), mismatched = gaps("decision_mismatch");
+    if (external.length || mismatched.length) {
+        const systems = count(external.map((d) => cut(str(at(d, "system")), 64)));
+        const verified = external.filter((d) => at(d, "signature") === "verified").length;
+        rep.check("external decisions", !mismatched.length, `${external.length} imported: `
+            + (systems.map(([k, n]) => `${k} ${n}`).join(", ") || "none") + `; signatures verified ${verified}, unverified `
+            + `${external.length - verified}; ${mismatched.length} disagree with the signer`, mismatched.slice(0, 20), true);
+    }
+    const finals = [...runs.values()].map((rs) => rs.at(-1).event)
+        .filter((e) => get(e, "type") === "run.final" && has(at(e, "data"), "coverage")).map((e) => e.data.coverage);
+    const reconciles = events.filter((e) => str(get(e, "type")).startsWith("reconcile."));
+    const paired = [...runs.values()].map((rs) => rs.at(-1).event).filter((e) => get(e, "type") === "run.final")
+        .reduce((n, e) => n + num(get(e.data, "paired_by_args", 0)), 0);
+    if (finals.length || reconciles.length) {
+        const unreconciled = count(reconciles.map((e) => e.type.slice("reconcile.".length)));
+        const layers = [...new Set(finals.flatMap((c) => list(at(c, "layers"))))].sort();
+        rep.check("coverage", !reconciles.length, `layers ${layers.join("+") || "none"}` + (layers.includes("L3") ? "" : " (L3 absent)")
+            + `; ${finals.reduce((n, c) => n + num(at(c, "reconciled")), 0)} call(s) reconciled`
+            + (paired ? ` (${paired} paired by arguments: no tool-call id)` : "") + "; unreconciled: "
+            + (unreconciled.map(([k, n]) => `${k} ${n}`).join(", ") || "none"), reconciles.map((e) => `seq ${e.seq}: ${e.type}`
+            + (has(e, "tool_call_id") ? ` ${cut(str(e.tool_call_id), 200)}` : "")
+            + `: ${cut(str(get(at(e, "data"), "detail")), 200)}`).slice(0, 20), true);
+    }
+    // the coverage matrix: per action class its weakest status across the runs, the layers behind it; never "complete"
+    const matrices = [...runs.values()].map((rs) => rs.at(-1).event)
+        .filter((e) => get(e, "type") === "run.final" && has(at(e, "data"), "matrix")).map((e) => e.data.matrix);
+    if (matrices.length)
+        rep.check("coverage matrix", true, (matrices.length > 1 ? `weakest of ${matrices.length} runs: ` : "")
+            + MATRIX.map((k) => {
+                const cs = matrices.map((m) => at(m, k));
+                const status = cs.map((c) => str(at(c, "status"))).reduce((a, b) => COVERED.indexOf(b) < COVERED.indexOf(a) ? b : a);
+                const layers = [...new Set(cs.flatMap((c) => list(at(c, "layers")).map(str)))].sort()
+                    .concat(cs.some((c) => get(c, "asserted") === true) ? ["asserted"] : []);
+                return `${k.replace("_", " ")} ` + (status === "none" ? "not covered"
+                    : status + (layers.length ? ` (${layers.join(", ")})` : ""));
+            }).join(", "));
+    const lost = gaps("observer_lost");
+    if (lost.length)
+        rep.check("observers", false, `${lost.length} egress observer(s) went silent while their run was open`, lost.slice(0, 20), true);
+    checkIncidents(rep, runs, policies, floats);
+    const accessed = typed("content.accessed").length, erased = typed("content.erased").length;
+    if (accessed || erased) // signer records of the content vault (docs/privacy.md): who read or erased retained content
+        rep.check("content vault", true, `${accessed} access(es), ${erased} erasure(s) of retained content, each signed by the signer`);
+    // a tool call's tier is the weakest its records claim (untiered < T3, receipt only, < T1 < T2): each tier a record
+    // names, and untiered for a decision or result that names none, so a call decided at T2 and completed elsewhere
+    // isn't T2;
+    // paths: the (source, tier)s of its decisions and results, which differ only when another layer answered for it
+    const order = [null, "T3", "T1", "T2"];
+    const tiers = new Map(), claims = new Map(), paths = new Map();
+    for (const e of events) {
+        if (get(e, "tool_call_id") === null)
+            continue;
+        const k = JSON.stringify([get(e, "run_id"), e.tool_call_id]);
+        const decided = ["policy.decision", "tool.result"].includes(get(e, "type"));
+        const tier = order.includes(get(e, "tier")) ? get(e, "tier") : null;
+        tiers.set(k, null);
+        if (tier !== null || decided) {
+            const had = claims.has(k) ? claims.get(k) : tier;
+            claims.set(k, order.indexOf(had) <= order.indexOf(tier) ? had : tier);
+        }
+        if (decided)
+            paths.set(k, (paths.get(k) ?? new Set()).add(`${cut(str(get(e, "source")), 64)} ${tier ?? "untiered"}`));
+    }
+    for (const [k, t] of claims)
+        tiers.set(k, t);
+    const split = [...paths].filter(([, p]) => p.size > 1).map(([k, p]) => {
+        const [run, tcid] = JSON.parse(k);
+        return `${cut(str(run), 200)} ${cut(str(tcid), 200)}: ${[...p].sort().join(", ")}`;
+    });
+    if (tiers.size) {
+        const n = (t) => [...tiers.values()].filter((x) => x === t).length;
+        rep.check("tiers", !split.length, `${tiers.size} tool call(s): ` + ["T1", "T2", "T3"].map((t) => `${t} ${n(t)}`).join(", ")
+            + (n(null) ? `, untiered ${n(null)}` : "") + (split.length ? `; ${split.length} decided and completed by different capture paths` : ""), split.slice(0, 20), true);
+    }
+    const sources = events.filter((e) => has(e, "args_source")).map((e) => e.args_source);
+    if (sources.length)
+        rep.check("args source", true, `${sources.length} record(s): `
+            + ["raw", "parsed", "coerced"].map((s) => `${s} ${sources.filter((x) => x === s).length}`).join(", "));
+    const firsts = [...runs.values()].map((rs) => rs[0].event);
+    const registered = firsts.map((e) => get(e, "type") === "run.registered" ? at(e, "data") : {});
+    rep.check("isolation", true, "signer-reported: " + count(registered.map((d) => cut(str(get(d, "signer_isolation", "unreported")), 64))).map(([k, n]) => `${k} ${n} run(s)`).join(", "));
+    const principals = firsts.filter((e) => get(e, "type") === "run.registered" && has(e, "principal"))
+        .map((e) => `${cut(str(e.principal), 256)} (${get(e, "principal_attested") === true ? "attested" : "app-asserted"})`);
+    if (principals.length)
+        rep.check("principals", true, principals.slice(0, 20).join(", ") + (principals.length > 20 ? ", ..." : ""));
+    if (registered.some((d) => has(d, "harness"))) {
+        const bound = firsts.map((e, i) => `${cut(str(get(e, "run_id")), 200)} `
+            + (isObj(get(registered[i], "harness")) ? cut(str(get(registered[i].harness, "name")), 64) : "none"));
+        rep.check("harness", true, "signer-attested: " + bound.slice(0, 20).join(", ") + (bound.length > 20 ? ", ..." : ""));
+    }
+    const failOpen = [...new Set(registered.flatMap((d) => {
+            const modes = get(d, "fail_modes");
+            if (!truthy(modes))
+                return [];
+            if (!isObj(modes))
+                throw new TypeError("fail_modes is not an object");
+            return Object.entries(modes).filter(([, m]) => m === "open").map(([c]) => cut(c, 64));
+        }))].sort();
+    rep.check("fail-open classes", !failOpen.length, failOpen.join(", ") || "none", failOpen.length ? ["calls the agent classed as one of these may have run unrecorded while the signer was down"] : [], true);
+    rep.check("key assurance", true, "asserted: the log declares its record keys; none is attested");
+    const algs = new Set([...every, ...keyRecords].map((r) => text(at(r, "alg"))));
+    rep.assurance = await assurance(origin, cosigs, witnesses, trust, algs, selfApproved, regCosigs)
+        + (provenTo < relied ? "; key retirements not proven complete" : "");
+    approvals(rep, runs, policies, floats);
+    const glass = typed("approval").filter((e) => get(at(e, "data"), "break_glass") === true);
+    if (glass.length)
+        rep.check("break-glass approvals", false, `${glass.length} approval(s) answered under the break-glass role`, glass.map((e) => `seq ${e.seq}: ${str(at(e.data, "decision"))} ${str(get(e.data, "approval_id"))} by `
+            + `${cut(text(at(e.data, "approver")), 256)}: ${repr(cut(str(get(e.data, "reason")), 200))}`).slice(0, 20), true);
+}
+/** Approvals by people and by agents, each on a line of its own. An agent's approval fails the line unless its run
+ * holds the approval.request and policy.decision it answered, the signer called the request agent-eligible
+ * (agent.eligible) and no approval.escalated or approval.revoked of it comes first, the decision has no provenance and
+ * a complete provenance_state (or none: the signer leaves it out then), its approval needs no passkey, and the agent is
+ * neither the requester nor the run's owner; with the policy snapshot of the decision's policy_hash in `policies` (the
+ * bundle's, each named by its SHA-256), every rule the call was held by is an ask rule that permits agents and needs no
+ * passkey (else a warning: bounds unchecked). Argument bounds are never checkable offline (salted commitments). */
+function approvals(rep, runs, policies, floats) {
+    let people = 0, agents = 0;
+    const problems = [], unchecked = [];
+    for (const rs of runs.values()) {
+        const events = rs.map((r) => r.event);
+        const ident = get(events[0], "type") === "run.registered" ? get(at(events[0], "data"), "identity") ?? {} : {};
+        const owner = `${str(get(ident, "scheme"))}:${cut(str(get(ident, "subject")), 256)}`;
+        const asked = new Map(), decided = new Map();
+        for (const e of events) {
+            if (e.type === "approval.request")
+                asked.set(get(e.data, "approval_id"), e.data);
+            if (e.type === "policy.decision" && has(e.data, "decision_id"))
+                decided.set(e.data.decision_id, e.data);
+        }
+        const toPeople = new Set(); // approval ids escalated or revoked so far: only people answer them
+        for (const e of events) {
+            const d = e.data;
+            if (e.type === "approval.escalated" || e.type === "approval.revoked")
+                toPeople.add(get(d, "approval_id"));
+            if (e.type !== "approval" || get(d, "decision") !== "approve")
+                continue;
+            if (get(d, "approver_kind") !== "agent") {
+                people++;
+                continue;
+            }
+            agents++;
+            const where = `seq ${e.seq}: ${cut(str(get(d, "approval_id")), 128)}`;
+            const req = asked.get(get(d, "approval_id")) ?? {};
+            const dec = decided.get(get(req, "decision_id"));
+            if (dec === undefined) {
+                problems.push(`${where}: its approval.request and policy.decision are not in the run`);
+                continue;
+            }
+            const ai = get(d, "approver_identity") ?? {};
+            if (get(get(req, "agent") ?? {}, "eligible") !== true)
+                problems.push(`${where}: the signer did not route its approval.request to agents (agent.eligible)`);
+            if (toPeople.has(get(d, "approval_id")))
+                problems.push(`${where}: it was escalated or revoked before the agent approved it`);
+            if (truthy(get(dec, "provenance")) || get(dec, "provenance_state", "complete") !== "complete")
+                problems.push(`${where}: the decision's arguments carry provenance or it is incomplete`);
+            if (get(req, "passkey") === true)
+                problems.push(`${where}: a rule of the call needs a passkey`);
+            if (get(d, "approver") === get(req, "requester") || `${str(get(ai, "scheme"))}:${cut(str(get(ai, "subject")), 256)}` === owner)
+                problems.push(`${where}: the agent is the requester or the run's owner`);
+            const hash = str(get(dec, "policy_hash")), snap = policies.get(hash);
+            if (snap === undefined) {
+                unchecked.push(`${where}: no policy snapshot of ${cut(hash, 80)}; export the run with the signer's config, which `
+                    + "bundles the policies its records cite");
+                continue;
+            }
+            let asks, flags;
+            try {
+                const pol = strictParseBytes(snap, floats);
+                asks = new Map(list(get(pol, "ask", [])).map((r) => [at(r, "id"), r]));
+                flags = new Set(list(get(pol, "flag", [])).map((r) => at(r, "id")));
+            }
+            catch {
+                problems.push(`${where}: the policy snapshot is not a policy`);
+                continue;
+            }
+            for (const rid of get(dec, "rule_ids") ?? []) {
+                const approval = get(asks.get(rid) ?? {}, "approval") ?? {};
+                if (!flags.has(rid) && (!isObj(approval) || !has(approval, "agent") || approval.passkey === "required"))
+                    problems.push(`${where}: rule ${cut(str(rid), 64)} does not permit agents`);
+            }
+        }
+    }
+    if (!agents)
+        return; // a bundle without agent approvals keeps the report it always had
+    rep.check("approvals by people", true, `${people} approval(s) answered by people`);
+    rep.check("approvals by agents", !problems.length && !unchecked.length, `${agents} approval(s) answered by agents (model `
+        + "output); argument bounds are not checkable offline (salted commitments): audit one with `tracekit signer reveal`"
+        + (unchecked.length ? `; agent approval bounds unchecked for ${unchecked.length}` : ""), (problems.length ? problems : unchecked).slice(0, 20), !problems.length);
+}
+const CONTAINMENT = ["incident.opened", "incident.updated", "run.held", "run.quarantined", "run.resumed"];
+const FIRES = ["policy.decision", "approval.consumed", "capture.gap", "trace.tamper", "refusal.summary",
+    "reconcile.unexplained_effect"];
+const RECOMPUTED = ["sequence", "limit", "denied_calls", "provenance", "executed_against_policy", "class_mismatch"];
+/** The `incidents` line, as verify/v2.py's _incidents: cited records, incidents recomputed from their run under the
+ * bundled compiled policy (`policies`, by policy_hash), responses honoured. */
+function checkIncidents(rep, runs, policies, floats) {
+    const byRun = new Map([...runs.values()].map((rs) => [get(rs[0].event, "run_id"), rs.map((r) => r.event)]));
+    if (![...byRun.values()].some((es) => es.some((e) => CONTAINMENT.includes(get(e, "type")))))
+        return;
+    const problems = [], pointers = new Set(), opened = new Set(), unbundled = new Set();
+    let checked = 0;
+    for (const es of byRun.values())
+        for (const e of es)
+            if (e.type === "incident.opened")
+                opened.add(e.data.incident_id);
+    for (const [rid, events] of byRun) {
+        const mine = [];
+        for (const e of events) {
+            const d = e.data;
+            if (!["incident.opened", "incident.updated"].includes(e.type))
+                continue;
+            for (const c of list(d.cites)) {
+                const cited = byRun.get(c.run_id);
+                if (cited && (c.run_seq >= cited.length || !FIRES.includes(cited[c.run_seq].type)))
+                    problems.push(`seq ${e.seq}: incident ${d.incident_id} cites ${cut(c.run_id, 128)} run_seq ${c.run_seq}, which is `
+                        + "not a record that fires a trigger");
+            }
+            if (e.type === "incident.updated")
+                continue;
+            if (d.trigger === "detector_unavailable") {
+                const c = d.cites.length === 1 ? d.cites[0] : {}, cited = byRun.get(c.run_id) ?? [];
+                const ok = (c.run_seq ?? cited.length) < cited.length && cited[c.run_seq].type === "policy.decision"
+                    && cited[c.run_seq].data.detect?.state === "unavailable";
+                if (ok)
+                    checked++;
+                else
+                    problems.push(`seq ${e.seq}: incident ${d.incident_id} (detector_unavailable) cites no decision whose detection `
+                        + "state was unavailable");
+            }
+            else if (d.scope.kind === "run" && RECOMPUTED.includes(d.trigger) && d.cites.every((c) => c.run_id === rid))
+                mine.push(e);
+        }
+        const hashes = new Set(events.filter((e) => e.type === "policy.decision").map((e) => get(e.data, "policy_hash")));
+        let det = null;
+        if (mine.length && hashes.size === 1) {
+            const h = str([...hashes][0]), data = policies.get(h);
+            if (!data)
+                unbundled.add(cut(h, 80));
+            else
+                det = new Detector(strictParseBytes(data, floats));
+            if (det) {
+                const st = Detector.state(), expected = [], key = (d) => JSON.stringify([d.trigger, d.rule_ids,
+                    d.cites.map((c) => [c.run_id, c.run_seq]), d.mode]);
+                for (const e of events) {
+                    if (mine.includes(e)) {
+                        const i = expected.findIndex((x) => key(x) === key(e.data));
+                        if (i >= 0) {
+                            const [hit] = expected.splice(i, 1);
+                            checked++;
+                            if (hit.mode === "enforce" && hit.would.length && !list(e.data.actions).length && !has(e.data, "reason"))
+                                problems.push(`seq ${e.seq}: incident ${e.data.incident_id} (${e.data.trigger}) is enforced under policy `
+                                    + `${cut(h, 80)} but records no response (${hit.would.join(", ")}) and no reason`);
+                        }
+                        else
+                            problems.push(`seq ${e.seq}: incident ${e.data.incident_id} (${e.data.trigger}) does not follow from the `
+                                + `run's records under policy ${cut(h, 80)}`);
+                    }
+                    expected.push(...det.observe(st, e).filter(([t]) => t === "incident.opened").map(([, d]) => d));
+                }
+            }
+        }
+        problems.push(...honoured(events, pointers));
+    }
+    const n = opened.size + [...pointers].filter((p) => !opened.has(p)).length;
+    rep.check("incidents", !problems.length, `${n} incident(s): ${checked} checked against the bundle, ${n - checked} `
+        + "signer-asserted (operator, cross-run, under several policies, or under a policy not in the bundle)", problems.slice(0, 20));
+    if (unbundled.size)
+        rep.check("incident policies", false, `${unbundled.size} cited policy(ies) not in the bundle: their incidents are `
+            + "signer-asserted, not recomputed (export the run with the signer's config, which bundles the policies its "
+            + "records cite)", [...unbundled].sort().slice(0, 20), true);
+}
+/** The problems of one run's records with the holds and quarantines they record (verify/v2.py's _honoured). */
+function honoured(events, pointers) {
+    const problems = [], flight = new Set(), asked = new Map(), consumed = new Set();
+    const due = new Map();
+    let held = [], quarantined = null;
+    const state = () => quarantined ? "quarantined" : "held";
+    const unfollowed = () => [...due].map(([i, [seq, a]]) => `seq ${seq}: incident ${i} enforces ${a} on this run, which `
+        + "no run.held or run.quarantined follows");
+    for (const e of events) {
+        const t = e.type, d = e.data, where = `seq ${e.seq}`, on = quarantined || held.join(" and ");
+        if (t === "policy.decision" && due.size && !quarantined) { // an enforced response is written before the next call
+            problems.push(...unfollowed());
+            due.clear();
+        }
+        if (t === "incident.opened" && d.scope.kind === "run" && d.scope.id === str(e.run_id).slice(0, 256)
+            && Object.keys(d.scope).length === 2 && d.actions.some((a) => a === "hold" || a === "quarantine"))
+            due.set(d.incident_id, [e.seq, d.actions.includes("quarantine") ? "quarantine" : "hold"]);
+        else if (t === "run.held" || t === "run.quarantined") {
+            pointers.add(d.incident_id);
+            due.delete(d.incident_id);
+            for (const x of d.in_flight ?? [])
+                flight.add(x.decision_id);
+            if (t === "run.quarantined")
+                [quarantined, held] = [d.incident_id, []];
+            else if (!quarantined && !held.includes(d.incident_id))
+                held.push(d.incident_id);
+        }
+        else if (t === "run.resumed") {
+            held = held.filter((i) => i !== d.incident_id);
+            if (JSON.stringify([...(d.held_by ?? held)].sort()) !== JSON.stringify([...held].sort()))
+                problems.push(`${where}: run.resumed says ${d.held_by.join(" and ") || "no incident"} still holds the run, its `
+                    + `records ${held.join(" and ") || "none"}`);
+        }
+        else if (t === "policy.decision" && on && (quarantined ? d.decision !== "deny"
+            : d.decision !== "deny" && (d.decision !== "ask" || !held.includes(d.incident_id ?? null))))
+            problems.push(`${where}: ${d.decision} while the run is ${state()} by incident ${on}`);
+        else if (t === "approval.request") {
+            asked.set(d.approval_id, d.incident_id ?? null);
+            if (quarantined || held.length && !held.includes(d.incident_id ?? null))
+                problems.push(`${where}: an approval asked while the run is ${state()} by incident ${on}, not as its held call`);
+        }
+        else if (t === "approval" && asked.get(d.approval_id ?? null) && d.decision === "approve" && (d.approver_kind === "agent" || d.self_approved || !Object.hasOwn(d, "person")
+            && !Object.hasOwn(d.approver_identity ?? {}, "person") || (d.incident_id ?? null) !== asked.get(d.approval_id)))
+            problems.push(`${where}: a held call approved by other than a person, or without its incident id`);
+        else if (t === "approval.consumed") {
+            if (quarantined || held.length && !held.includes(asked.get(d.approval_id) ?? null))
+                problems.push(`${where}: an approval consumed while the run is ${state()} by incident ${on}`);
+            else if (asked.get(d.approval_id))
+                consumed.add(e.tool_call_id ?? null);
+        }
+        else if (t === "tool.result" && on && !flight.has(d.decision_id) && (quarantined || !consumed.has(e.tool_call_id ?? null)))
+            problems.push(`${where}: a result while the run is ${state()} by incident ${on}, of a call neither in flight then nor `
+                + "approved by a person for it");
+    }
+    if (!quarantined)
+        problems.push(...unfollowed());
+    return problems;
+}
+/** §4: null when `r` is a v2 record signed by one of `keys` (SPKI DER) with an allowed algorithm that is the key's own,
+ * else why not. */
+export async function verifyRecord(r, keys, algs) {
+    if (!isObj(r) || Object.keys(r).length !== 6 || !["v", "event", "hash", "alg", "kid", "sig"].every((k) => Object.hasOwn(r, k))
+        || !same(r.v, 2) || !isObj(r.event) || !["hash", "alg", "kid", "sig"].every((k) => typeof r[k] === "string"))
+        return "not a v2 record";
+    let h;
+    try {
+        h = "sha256:" + await sha256hex(bytes(canonicalize(r.event)));
+    }
+    catch (e) {
+        return `event is not canonical JSON: ${e.message}`;
+    }
+    if (r.hash !== h)
+        return "hash does not match the event";
+    if (!algs.includes(r.alg))
+        return `algorithm ${repr(r.alg)} is not allowed`;
+    let key;
+    for (const k of keys)
+        if (await spkiKid(k) === r.kid)
+            key = k;
+    if (!key)
+        return "unknown kid";
+    if (keyAlg(key) !== r.alg)
+        return `algorithm ${repr(r.alg)} is not the key's algorithm`;
+    let sig;
+    try {
+        sig = b64decode(r.sig);
+    }
+    catch {
+        return "sig is not base64";
+    }
+    const position = Object.fromEntries(["log_id", "seq", "prev_hash", "tenant", "run_id", "run_seq", "run_prev_hash"]
+        .map((k) => [k, Object.hasOwn(r.event, k) ? r.event[k] : null]));
+    const message = canonicalize({ ...position, alg: r.alg, kid: r.kid, hash: h, t: "tracekit.record.v2" });
+    return await verifyV2(r.alg, key, bytes(message), sig) ? null : "bad signature";
+}
+/** §7: the run-set line (COMPLETE or INCOMPLETE) and the log tail line. Returns the (seq, hash) of every key.retire the
+ * range points to, the highest seq it points to when it starts at registry size 0 (else -1), and the pinned
+ * cosignatures of each registry note. */
+async function checkRunSet(rep, rs, jsonl, file, trust, witnesses, origin, size, runs, included, checkRecord, floats) {
+    const problems = [], tsalt = b64decode(at(rs, "tenant_salt"));
+    const lo = at(rs, "from"), hi = at(rs, "to"), regOrigin = await registryOrigin(origin, tsalt);
+    const span = `registry ${str(lo)}..${str(hi)}`;
+    if (![lo, hi].every((n) => Number.isSafeInteger(n)) || floats.get(rs)?.has("from") || floats.get(rs)?.has("to")) {
+        rep.check("run-set", false, `INCOMPLETE, ${span}`, ["the registry range is not two integers"]);
+        return [[], -1, []];
+    }
+    // the registry notes are signed by the record log's own pinned key, under the registry origin
+    const vkeys = [];
+    for (const k of trust.logs) {
+        const p = await parseVkey(k);
+        if (p.name === origin)
+            vkeys.push(await vkey(regOrigin, p.type, p.pub));
+    }
+    const roots = new Map(), regCosigs = [];
+    for (const n of [...new Set([num(lo), num(hi)])].filter((n) => n !== 0).sort((a, b) => a - b)) {
+        let got;
+        try {
+            const note = await openNote(file(`checkpoints/registry-${n}.note`), vkeys, [...witnesses.keys()]);
+            got = note.size;
+            roots.set(n, note.root);
+            regCosigs.push(note.cosigs);
+            if (note.unchecked)
+                rep.unsupport("SLH-DSA-SHA2-128s checkpoint signature");
+            if (note.cosigs.length < trust.witnesses_required)
+                problems.push(`registry checkpoint at size ${n}: ${note.cosigs.length} pinned cosignature(s), `
+                    + `${trust.witnesses_required} required`);
+        }
+        catch (e) {
+            got = `unusable (${errorText(e)})`;
+        }
+        if (got !== n)
+            problems.push(`registry checkpoint at size ${n}: ${got}`);
+    }
+    if (problems.length || !(0 <= lo && lo <= hi) || hi === 0) {
+        rep.check("run-set", false, `INCOMPLETE, ${span}`, problems.length ? problems : [`bad registry range ${lo}..${hi}`]);
+        return [[], -1, regCosigs];
+    }
+    if (0 < lo && lo < hi && !await verifyConsistency(lo, hi, roots.get(lo), roots.get(hi), list(at(rs, "consistency")).map(b64decode)))
+        problems.push(`registry checkpoint ${lo} is not a prefix of ${hi}`);
+    const leaves = list(at(rs, "leaves"));
+    const pointed = new Map(jsonl("registry/records.jsonl").map((r) => [at(at(r, "event"), "seq"), r]));
+    if (leaves.length !== hi - lo)
+        problems.push(`${hi - lo} leaves in ${lo}..${hi}, ${leaves.length} in the bundle: a leaf is missing`);
+    const registered = new Map(), finals = new Map(), retired = [], targets = new Set();
+    const gaps = new Map();
+    let closed = null, tenant = null, top = -1;
+    for (const [j, x] of leaves.slice(0, hi - lo).entries()) {
+        const i = lo + j, leaf = b64decode(at(x, "leaf"));
+        if (!await verifyInclusion(i, hi, await leafHash(leaf), list(at(x, "inclusion")).map(b64decode), roots.get(hi))) {
+            problems.push(`leaf ${i} is not in the registry tree of size ${hi}`);
+            continue;
+        }
+        const { type, runHash: rh, logId, seq, hash } = parseLeaf(leaf);
+        const r = pointed.get(seq) ?? null, e = r && truthy(r) ? at(r, "event") : r;
+        if (r === null || at(r, "hash") !== hash || at(e, "type") !== type || at(e, "log_id") !== logId || !await included(r)
+            || !equal(await runHash(tsalt, text(at(e, "run_id"))), rh)
+            || !SIGNER_LEAVES.includes(type) && tenant !== null && !same(tenant, at(e, "tenant"))) {
+            problems.push(`leaf ${i} points to a missing or different record (seq ${seq})`);
+            continue;
+        }
+        await checkRecord(r, problems);
+        top = Math.max(top, seq);
+        if (type === "run.registered" || type === "run.final")
+            targets.add(await runName(at(e, "tenant"), e.run_id));
+        if (type === "run.registered") {
+            tenant = e.tenant;
+            registered.set(e.run_id, r);
+        }
+        else if (type === "run.final") {
+            tenant = e.tenant;
+            if (finals.has(e.run_id))
+                problems.push(`a second run.final for run ${repr(cut(e.run_id, 200))} (seq ${seq})`);
+            finals.set(e.run_id, r);
+        }
+        else if (type === "key.retire")
+            retired.push([seq, hash]);
+        else if (type === "log.closed")
+            closed = e;
+        else {
+            const k = at(at(e, "data"), "kind");
+            gaps.set(k, (gaps.get(k) ?? 0) + 1);
+        }
+    }
+    for (const [runId, final] of finals) {
+        const recs = runs.get(await runName(tenant, runId));
+        if (!recs?.length || at(recs.at(-1), "hash") !== at(final, "hash")
+            || registered.has(runId) && at(recs[0], "hash") !== at(registered.get(runId), "hash"))
+            problems.push(`run ${repr(cut(runId, 200))} is final in the range but its records are not in the bundle`);
+    }
+    if ([...runs.values()].some((rs) => !same(get(at(rs[0], "event"), "tenant"), tenant)))
+        problems.push("a run in the bundle is not of the run-set's tenant");
+    const untargeted = [...runs.keys()].filter((n) => !targets.has(n)).length;
+    if (untargeted > 1)
+        problems.push(`${untargeted} runs in the bundle, but only the selected run may be in no leaf of the range`);
+    if (truthy(closed) && size > num(at(at(closed, "data"), "final_seq")) + 1)
+        problems.push(`records after log.closed at seq ${str(at(closed, "seq"))}`);
+    const counted = [...gaps].sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0).map(([k, n]) => `${k} ${n}`).join(", ");
+    const named = tenant === null ? "" : ` of tenant ${repr(cut(tenant, 64))}`;
+    const open = [...registered.keys()].filter((k) => !finals.has(k)).length;
+    rep.check("run-set", !problems.length, !problems.length ? `COMPLETE, ${span}${named} (${registered.size} runs registered, `
+        + `${finals.size} final, ${open} open` + (gaps.size ? `; tenant-level gaps: ${counted}` : "") + ")" : `INCOMPLETE, ${span}`, problems);
+    if (gaps.size)
+        rep.check("tenant-level gaps", false, `${[...gaps.values()].reduce((a, b) => a + b, 0)} in the range: ${counted}`, [], true);
+    rep.check("log tail", truthy(closed), truthy(closed) ? `none: log.closed at seq ${str(closed.seq)} is the last record`
+        : `records after tree size ${size} are unproven (no log.closed in the range)`, [], true);
+    return [retired, lo === 0 ? top : -1, regCosigs];
+}
+const runName = async (tenant, runId) => `runs/${(await sha256hex(bytes(`${str(tenant)}/${str(runId)}`))).slice(0, 32)}.jsonl`;
+const LEVELS = ["dev", "local", "witnessed"];
+function level(cosigs, witnesses, trust) {
+    const independent = cosigs.filter(([k]) => witnesses.get(k) !== "operator").length;
+    return independent >= Math.max(1, trust.witnesses_required) ? "witnessed" : cosigs.length ? "local" : "dev";
+}
+/** dev: no pinned witness cosigned, or a self-approval in the run; local: only operator-run ones; witnessed: enough
+ * independent ones. A run-set's registry notes cap the level by the same rule. */
+async function assurance(origin, cosigs, witnesses, trust, algs, selfApproved, registryNotes) {
+    let hybrid = false;
+    for (const k of trust.logs) {
+        const p = await parseVkey(k);
+        hybrid ||= p.name === origin && p.type === HYBRID;
+    }
+    const times = cosigs.filter(([k]) => witnesses.get(k) !== "operator").map(([, ts]) => ts);
+    let lvl = selfApproved ? "dev" : level(cosigs, witnesses, trust);
+    let capped = registryNotes.map((c) => level(c, witnesses, trust))
+        .reduce((a, b) => LEVELS.indexOf(b) < LEVELS.indexOf(a) ? b : a, "witnessed");
+    if (LEVELS.indexOf(capped) < LEVELS.indexOf(lvl))
+        lvl = capped;
+    else
+        capped = null;
+    const cosigned = [...cosigs].sort((a, b) => a[1] < b[1] ? -1 : a[1] > b[1] ? 1 : 0)
+        .map(([k, ts]) => `${k.split("+")[0]} (${witnesses.get(k)}) at ${fmt(ts)}`).join(", ");
+    return `${lvl}; records ${[...algs].sort().join("+")}; checkpoint ${hybrid ? "Ed25519 + SLH-DSA-SHA2-128s" : "Ed25519 only"} `
+        + `(${origin})` + (cosigned ? `; cosigned ed25519 by ${cosigned}` : "; no witness cosignature")
+        + (times.length ? `; earliest independent anchor ${fmt(times.reduce((a, b) => b < a ? b : a))}` : "")
+        + (capped ? `; capped by the run-set's registry notes (${capped})` : "") + (selfApproved ? "; approvals: self" : "");
+}
+/** The report as text, as the reference CLI prints it; control characters in bundle-derived strings are dropped. */
+export function formatReport(rep) {
+    const clean = (x) => x.replace(/[\x00-\x1f\x7f-\x9f]/g, "");
+    let s = "";
+    for (const c of rep.checks) {
+        s += `[${c.status.toUpperCase()}] ${c.check}` + (c.detail ? ` — ${clean(c.detail)}` : "") + "\n";
+        for (const p of c.problems)
+            s += `        ${clean(p)}\n`;
+    }
+    return s + `\nIntegrity: ${clean(rep.integrity)}.\nAssurance: ${clean(rep.assurance)}.\n`;
+}