@cygnuxlabs/tracekit 1.2.3 → 1.4.0

package/dist/verify/jcs.d.ts

@@ -4,6 +4,8 @@
  * integer tokens (no `.` or exponent) outside ±(2^53-1) are refused, and so are arrays and objects nested deeper than
  * MAX_DEPTH. No node: imports: browsers load this too.
  */
+/** A string as Python's repr() writes it, as the reference verifier's messages quote names and keys. */
+export declare function repr(s: string): string;
 /** `code` is one of: invalid_utf8, syntax, duplicate_key, non_finite, int_range, lone_surrogate, depth. */
 export declare class StrictJSONError extends Error {
     readonly code: string;

package/dist/verify/jcs.js

@@ -4,6 +4,14 @@
  * integer tokens (no `.` or exponent) outside ±(2^53-1) are refused, and so are arrays and objects nested deeper than
  * MAX_DEPTH. No node: imports: browsers load this too.
  */
+/** A string as Python's repr() writes it, as the reference verifier's messages quote names and keys. */
+export function repr(s) {
+    const q = s.includes("'") && !s.includes('"') ? '"' : "'";
+    const named = { "\\": "\\\\", "\n": "\\n", "\r": "\\r", "\t": "\\t", [q]: "\\" + q };
+    // lean: control characters only; Python also escapes other code points it can't print (U+0080..U+009F, U+2028...)
+    return q + s.replace(/[\\'"\x00-\x1f\x7f]/g, (c) => named[c] ?? (c === "'" || c === '"' ? c
+        : "\\x" + c.charCodeAt(0).toString(16).padStart(2, "0"))) + q;
+}
 /** `code` is one of: invalid_utf8, syntax, duplicate_key, non_finite, int_range, lone_surrogate, depth. */
 export class StrictJSONError extends Error {
     code;
@@ -62,7 +70,7 @@ export function strictParse(text, floats) {
         match(WS);
         const c = text[i];
         if ((c === "{" || c === "[") && depth === MAX_DEPTH)
-            fail("depth", `nesting deeper than ${MAX_DEPTH} at ${i}`);
+            fail("depth", `nesting deeper than ${MAX_DEPTH}`);
         if (c === "{") {
             i++;
             const o = {};
@@ -73,7 +81,7 @@ export function strictParse(text, floats) {
                 match(WS);
                 const k = str();
                 if (Object.hasOwn(o, k))
-                    fail("duplicate_key", JSON.stringify(k));
+                    fail("duplicate_key", repr(k));
                 expect(":");
                 Object.defineProperty(o, k, { value: value(depth + 1), enumerable: true, writable: true, configurable: true }); // "__proto__" too
                 mark(o, k);

package/dist/verify/primitives.d.ts

@@ -47,8 +47,9 @@ export type Note = {
 /**
  * Open a checkpoint note with pinned vkeys: a pinned Ed25519 log key named after the origin must sign it, and each
  * pinned hybrid key of the origin must have a line. Web Crypto has no SLH-DSA, so a hybrid line is left `unchecked`.
+ * `anchored` false (no trust config, so `logKeys` is empty): no log signature is required.
  */
-export declare function openNote(data: Uint8Array, logKeys: string[], witnessKeys: string[]): Promise<Note>;
+export declare function openNote(data: Uint8Array, logKeys: string[], witnessKeys: string[], anchored?: boolean): Promise<Note>;
 export declare const LEAF_TYPES: string[];
 export declare const SIGNER_LEAVES: string[];
 export declare const registryOrigin: (logOrigin: string, tsalt: Uint8Array) => Promise<string>;

package/dist/verify/primitives.js

@@ -194,8 +194,9 @@ export async function parseVkey(text) {
 /**
  * Open a checkpoint note with pinned vkeys: a pinned Ed25519 log key named after the origin must sign it, and each
  * pinned hybrid key of the origin must have a line. Web Crypto has no SLH-DSA, so a hybrid line is left `unchecked`.
+ * `anchored` false (no trust config, so `logKeys` is empty): no log signature is required.
  */
-export async function openNote(data, logKeys, witnessKeys) {
+export async function openNote(data, logKeys, witnessKeys, anchored = true) {
     if (data.length > MAX_NOTE)
         throw new NoteError("note too large");
     let note;
@@ -279,7 +280,7 @@ export async function openNote(data, logKeys, witnessKeys) {
             cosigs.push([k, ts]);
         }
     }
-    if (!logged)
+    if (!logged && anchored)
         throw new NoteError(`no signature from a pinned log key for origin ${origin}`);
     if (hybrids.size)
         throw new NoteError(`no SLH-DSA signature from the pinned hybrid key for origin ${origin}`);

package/dist/verify/schema.d.ts

@@ -1,8 +1,8 @@
 /**
  * The JSON Schema 2020-12 subset tracekit.event.v2.json uses (docs/format-v2.md §3): type, const, enum, required,
- * properties, additionalProperties, items, oneOf, allOf, if/then, $ref to #/$defs, pattern (full match, ASCII),
- * minimum, maximum, minLength, maxLength (code points), minItems, maxItems. "integer" excludes number tokens written with a
- * fraction or exponent. Any other keyword throws, so the schema can't silently lose a check.
+ * properties, additionalProperties, propertyNames, items, oneOf, allOf, if/then, $ref to #/$defs, pattern (full match,
+ * ASCII), minimum, maximum, minLength, maxLength (code points), minItems, maxItems. "integer" excludes number tokens
+ * written with a fraction or exponent. Any other keyword throws, so the schema can't silently lose a check.
  */
 import type { Floats } from "./jcs.js";
 /** JSON equality with numbers and booleans compared as numbers, as the reference's Python does. */

package/dist/verify/schema.js

@@ -1,7 +1,7 @@
 import SCHEMA from "./tracekit.event.v2.json" with { type: "json" };
-const KEYWORDS = new Set(["type", "const", "enum", "required", "properties", "additionalProperties", "items", "oneOf",
-    "allOf", "if", "then", "$ref", "pattern", "minimum", "maximum", "minLength", "maxLength", "minItems", "maxItems", "$schema", "$id",
-    "$defs", "title", "description"]);
+const KEYWORDS = new Set(["type", "const", "enum", "required", "properties", "additionalProperties", "propertyNames",
+    "items", "oneOf", "allOf", "if", "then", "$ref", "pattern", "minimum", "maximum", "minLength", "maxLength", "minItems",
+    "maxItems", "$schema", "$id", "$defs", "title", "description"]);
 const isObject = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
 const isNumber = (v) => typeof v === "number";
 const PATTERNS = new Map();
@@ -68,6 +68,8 @@ function check(v, s, path, errs, float, floats) {
                 errs.push(`${path}: unexpected field '${k}'`);
             else if (isObject(ap))
                 check(x, ap, `${path}.${k}`, errs, f, floats);
+            if ("propertyNames" in s)
+                check(k, s.propertyNames, `${path}.${k}`, errs, false, floats);
         }
     }
     if (Array.isArray(v) && "items" in s)

package/dist/verify/tracekit.event.v2.json

@@ -126,6 +126,7 @@
                 "reconcile.result_without_call",
                 "reconcile.unexplained_effect",
                 "reconcile.args_unparseable",
+                "reconcile.result_mismatch",
                 "refusal.summary",
                 "policy.external",
                 "content.accessed",
@@ -141,7 +142,9 @@
                 "incident.resolved",
                 "incident.response",
                 "identity.suspension",
-                "effect.observed"
+                "effect.observed",
+                "constraint.added",
+                "ext"
             ]
         },
         "data": {
@@ -283,6 +286,13 @@
             "maxLength": 128,
             "pattern": "^[A-Za-z0-9._-]+@[A-Za-z0-9._+-]+$",
             "description": "Policy engine id@version."
+        },
+        "ext": {
+            "type": "object",
+            "propertyNames": {
+                "$ref": "#/$defs/ext_name"
+            },
+            "description": "Non-critical fields (format 1.4), on any record: {name: any strict JSON value}. A verifier that does not interpret a name still checks the record's signature, chain and inclusion, and says it did not interpret the name (docs/format-v2.md section 9)."
         }
     },
     "allOf": [
@@ -894,6 +904,22 @@
                 }
             }
         },
+        {
+            "if": {
+                "properties": {
+                    "type": {
+                        "const": "reconcile.result_mismatch"
+                    }
+                }
+            },
+            "then": {
+                "properties": {
+                    "data": {
+                        "$ref": "#/$defs/reconcile"
+                    }
+                }
+            }
+        },
         {
             "if": {
                 "properties": {
@@ -1145,7 +1171,46 @@
             "then": {
                 "properties": {
                     "data": {
-                        "$ref": "#/$defs/effect_observed"
+                        "oneOf": [
+                            {
+                                "$ref": "#/$defs/effect_observed"
+                            },
+                            {
+                                "$ref": "#/$defs/sensor_effect"
+                            }
+                        ]
+                    }
+                }
+            }
+        },
+        {
+            "if": {
+                "properties": {
+                    "type": {
+                        "const": "constraint.added"
+                    }
+                }
+            },
+            "then": {
+                "properties": {
+                    "data": {
+                        "$ref": "#/$defs/constraint_added"
+                    }
+                }
+            }
+        },
+        {
+            "if": {
+                "properties": {
+                    "type": {
+                        "const": "ext"
+                    }
+                }
+            },
+            "then": {
+                "properties": {
+                    "data": {
+                        "$ref": "#/$defs/ext"
                     }
                 }
             }
@@ -1990,6 +2055,29 @@
                 },
                 "verdict": {
                     "type": "object"
+                },
+                "cites": {
+                    "type": "array",
+                    "maxItems": 256,
+                    "items": {
+                        "type": "object",
+                        "additionalProperties": false,
+                        "required": [
+                            "run_seq",
+                            "hash"
+                        ],
+                        "properties": {
+                            "run_seq": {
+                                "type": "integer",
+                                "minimum": 0,
+                                "maximum": 9007199254740991
+                            },
+                            "hash": {
+                                "$ref": "#/$defs/hash"
+                            }
+                        }
+                    },
+                    "description": "A signed finding (format 1.4; review_finding), in a findings run: the records of the analysed run it rests on, by run_seq and record hash. A review without cites (a migrated v1 judge verdict) is imported, not checked."
                 }
             }
         },
@@ -2121,7 +2209,9 @@
                         "reask_after_reject",
                         "held_call_unresolved",
                         "observer_lost",
-                        "effect_outside_run"
+                        "effect_outside_run",
+                        "result_unchecked",
+                        "constraint_refused"
                     ],
                     "description": "Gap and tamper kinds (signer-written only)."
                 },
@@ -2135,6 +2225,14 @@
                         "null"
                     ],
                     "maxLength": 4096
+                },
+                "sensor": {
+                    "enum": [
+                        "tetragon",
+                        "falco",
+                        "openshell"
+                    ],
+                    "description": "format 1.4: the sensor (a kernel sensor, or OpenShell) whose import an observer_lost gap is about"
                 }
             }
         },
@@ -2322,6 +2420,10 @@
                     },
                     "maxItems": 1024
                 },
+                "said_only": {
+                    "const": true,
+                    "description": "format 1.4: a response recorded with what the model said and without the calls it asked for (a harness whose hooks name no call); reconciliation reads no call from it"
+                },
                 "tool_results_sent": {
                     "type": "array",
                     "items": {
@@ -2693,6 +2795,11 @@
                                     "type": "integer",
                                     "minimum": 1,
                                     "maximum": 9007199254740991
+                                },
+                                "result_mismatch": {
+                                    "type": "integer",
+                                    "minimum": 1,
+                                    "maximum": 9007199254740991
                                 }
                             }
                         }
@@ -4503,6 +4610,117 @@
                 }
             }
         },
+        "sensor_effect": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+                "observer",
+                "sensor",
+                "kind",
+                "ts",
+                "pid",
+                "binary",
+                "attribution"
+            ],
+            "description": "format 1.4: what a kernel sensor (Tetragon, Falco) reported a process of the run did, or what OpenShell reported of its sandbox (its connections allowed and blocked, its entrypoint's start), imported under the import's own signer identity (an observer's assertion); signer-written",
+            "properties": {
+                "observer": {
+                    "type": "string",
+                    "maxLength": 256,
+                    "description": "the import's signer identity (scheme:subject)"
+                },
+                "sensor": {
+                    "enum": [
+                        "tetragon",
+                        "falco",
+                        "openshell"
+                    ]
+                },
+                "kind": {
+                    "enum": [
+                        "exec",
+                        "exit",
+                        "connect",
+                        "file"
+                    ],
+                    "description": "exec: the process started; exit: it ended; connect: it connected to host:port; file: the sensor's policy selected a file event of it (a write outside the workspace, in the shipped samples)"
+                },
+                "ts": {
+                    "type": "string",
+                    "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}\\.\\d{6}Z$",
+                    "maxLength": 27
+                },
+                "pid": {
+                    "type": "integer",
+                    "minimum": 0,
+                    "maximum": 4294967295
+                },
+                "binary": {
+                    "type": "string",
+                    "minLength": 1,
+                    "maxLength": 4096
+                },
+                "exec_id": {
+                    "type": "string",
+                    "minLength": 1,
+                    "maxLength": 256,
+                    "description": "the sensor's id of the process (Tetragon's exec_id)"
+                },
+                "parent_exec_id": {
+                    "type": "string",
+                    "minLength": 1,
+                    "maxLength": 256,
+                    "description": "exec: the sensor's id of the process that started this one (Tetragon's parent_exec_id)"
+                },
+                "args_commitment": {
+                    "$ref": "#/$defs/commitment",
+                    "description": "commitment to sha256 of the arguments string as the sensor reported it"
+                },
+                "salt_id": {
+                    "$ref": "#/$defs/id",
+                    "description": "the signer's salt id for this record's commitments (salt label <type>:<salt_id>)"
+                },
+                "status": {
+                    "type": "integer",
+                    "minimum": 0,
+                    "maximum": 4294967295
+                },
+                "signal": {
+                    "type": "string",
+                    "maxLength": 32
+                },
+                "host": {
+                    "type": "string",
+                    "minLength": 1,
+                    "maxLength": 253
+                },
+                "port": {
+                    "type": "integer",
+                    "minimum": 0,
+                    "maximum": 65535
+                },
+                "path": {
+                    "type": "string",
+                    "minLength": 1,
+                    "maxLength": 4096
+                },
+                "tool_call_id": {
+                    "$ref": "#/$defs/id",
+                    "description": "the tool call id the process's environment carried (CODEX_TOOL_CALL_ID): the agent's claim, recorded as it came and checked by no signer (TK-X206 checks it)"
+                },
+                "denied": {
+                    "const": true,
+                    "description": "the sensor (OpenShell's network policy) blocked it"
+                },
+                "attribution": {
+                    "enum": [
+                        "token",
+                        "identity"
+                    ],
+                    "description": "identity: the import mapped the process to the run's owner and the signer picked that owner's latest open run"
+                }
+            }
+        },
         "reconcile_effect": {
             "type": "object",
             "additionalProperties": false,
@@ -4583,6 +4801,52 @@
                     "description": "the status rests on the operator's posture (signer.yaml), not on anything the signer measured"
                 }
             }
+        },
+        "constraint_added": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+                "kind"
+            ],
+            "description": "format 1.4: a live constraint of the run (constraint_add): what the person's request said not to do in the rest of it, as its client reported it (the Claude Code hook, at UserPromptSubmit). From then on the signer raises a call that breaks it to an ask (rule TK-CONSTRAINT) and never lowers a decision, so a made-up constraint can only hold more calls",
+            "properties": {
+                "kind": {
+                    "enum": [
+                        "keep_away",
+                        "only_change",
+                        "read_only",
+                        "no_push",
+                        "no_network"
+                    ],
+                    "description": "keep_away: writes of the file; only_change: writes of any other file; read_only: any write; no_push: a git push; no_network: a call that reaches the network"
+                },
+                "object_commitment": {
+                    "$ref": "#/$defs/commitment",
+                    "description": "keep_away and only_change: commitment to sha256 of the file's lower-cased basename; never the name"
+                },
+                "salt_id": {
+                    "$ref": "#/$defs/id",
+                    "description": "the signer's salt id for this record's commitment (salt label <type>:<salt_id>)"
+                }
+            }
+        },
+        "ext_name": {
+            "type": "string",
+            "pattern": "^[a-z][a-z0-9_.-]*$",
+            "maxLength": 64,
+            "description": "The name of a non-critical field or record (format 1.4)."
+        },
+        "ext": {
+            "type": "object",
+            "required": [
+                "name"
+            ],
+            "properties": {
+                "name": {
+                    "$ref": "#/$defs/ext_name"
+                }
+            },
+            "description": "A non-critical record (format 1.4): its name and any other strict JSON fields, checked as the ext field is."
         }
     }
 }

package/dist/verify/web.d.ts

@@ -0,0 +1 @@
+export {};