@emilia-protocol/gate 0.9.4 → 0.10.0

package/evidence-postgres.js

@@ -0,0 +1,357 @@
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * EMILIA Gate production evidence backend for Postgres.
+ *
+ * The deployment SQL exposes one SECURITY DEFINER append function. That
+ * function locks the tenant/gate/stream head, checks the caller's expected
+ * head, inserts one immutable record, and advances the head in the same SQL
+ * statement transaction. Runtime roles receive SELECT and EXECUTE only; they
+ * cannot insert, update, delete, or truncate evidence tables directly.
+ *
+ * Database errors and malformed driver responses always propagate on the
+ * write path. A storage outage must never be mistaken for a successful append
+ * or an ordinary contention retry.
+ */
+
+import {
+  canonicalEvidenceJson,
+  verifyEvidenceRecord,
+} from './evidence.js';
+
+export const PG_EVIDENCE_VERSION = 'EP-GATE-PG-EVIDENCE-v1';
+export const EVIDENCE_SCHEMA = 'emilia_gate_evidence';
+export const EVIDENCE_RECORDS_TABLE = `${EVIDENCE_SCHEMA}.records`;
+export const EVIDENCE_HEADS_TABLE = `${EVIDENCE_SCHEMA}.heads`;
+export const EVIDENCE_APPEND_FUNCTION = `${EVIDENCE_SCHEMA}.append_record`;
+
+const HEX_256 = /^[0-9a-f]{64}$/;
+// evidence.js permits 1 MiB of raw string/key bytes. JSON control-character
+// escaping can expand those bytes by up to 6x, plus bounded container syntax.
+const MAX_CANONICAL_BYTES = 8 * 1024 * 1024;
+
+/** Exact statements issued by the adapter, exported for audit and test fakes. */
+export const EVIDENCE_SQL = Object.freeze({
+  health: `SELECT
+  to_regclass('${EVIDENCE_RECORDS_TABLE}') IS NOT NULL AS records_ready,
+  to_regclass('${EVIDENCE_HEADS_TABLE}') IS NOT NULL AS heads_ready,
+  to_regprocedure('${EVIDENCE_APPEND_FUNCTION}(text,text,text,text,jsonb,text)') IS NOT NULL AS append_ready,
+  CASE WHEN to_regclass('${EVIDENCE_RECORDS_TABLE}') IS NULL THEN FALSE
+    ELSE has_table_privilege(current_user, to_regclass('${EVIDENCE_RECORDS_TABLE}'), 'SELECT') END AS can_read_records,
+  CASE WHEN to_regclass('${EVIDENCE_HEADS_TABLE}') IS NULL THEN FALSE
+    ELSE has_table_privilege(current_user, to_regclass('${EVIDENCE_HEADS_TABLE}'), 'SELECT') END AS can_read_heads,
+  CASE WHEN to_regclass('${EVIDENCE_RECORDS_TABLE}') IS NULL THEN FALSE ELSE (
+    has_table_privilege(current_user, to_regclass('${EVIDENCE_RECORDS_TABLE}'), 'INSERT')
+    OR has_table_privilege(current_user, to_regclass('${EVIDENCE_RECORDS_TABLE}'), 'UPDATE')
+    OR has_table_privilege(current_user, to_regclass('${EVIDENCE_RECORDS_TABLE}'), 'DELETE')
+    OR has_table_privilege(current_user, to_regclass('${EVIDENCE_RECORDS_TABLE}'), 'TRUNCATE')
+  ) END AS can_write_records_directly,
+  CASE WHEN to_regclass('${EVIDENCE_HEADS_TABLE}') IS NULL THEN FALSE ELSE (
+    has_table_privilege(current_user, to_regclass('${EVIDENCE_HEADS_TABLE}'), 'INSERT')
+    OR has_table_privilege(current_user, to_regclass('${EVIDENCE_HEADS_TABLE}'), 'UPDATE')
+    OR has_table_privilege(current_user, to_regclass('${EVIDENCE_HEADS_TABLE}'), 'DELETE')
+    OR has_table_privilege(current_user, to_regclass('${EVIDENCE_HEADS_TABLE}'), 'TRUNCATE')
+  ) END AS can_write_heads_directly,
+  CASE WHEN to_regprocedure('${EVIDENCE_APPEND_FUNCTION}(text,text,text,text,jsonb,text)') IS NULL THEN FALSE
+    ELSE has_function_privilege(current_user,
+      to_regprocedure('${EVIDENCE_APPEND_FUNCTION}(text,text,text,text,jsonb,text)'), 'EXECUTE') END AS can_append`,
+
+  readHead: `SELECT head_seq AS seq, head_hash AS hash
+FROM ${EVIDENCE_HEADS_TABLE}
+WHERE tenant_id = $1 AND gate_id = $2 AND stream_id = $3`,
+
+  getById: `SELECT seq, record_id, prev_hash, hash, record
+FROM ${EVIDENCE_RECORDS_TABLE}
+WHERE tenant_id = $1 AND gate_id = $2 AND stream_id = $3 AND record_id = $4`,
+
+  readAll: `SELECT seq, record_id, prev_hash, hash, record
+FROM ${EVIDENCE_RECORDS_TABLE}
+WHERE tenant_id = $1 AND gate_id = $2 AND stream_id = $3
+ORDER BY seq ASC`,
+
+  // One SELECT gives verify() a single MVCC snapshot of rows and head.
+  snapshot: `SELECT
+  COALESCE((
+    SELECT jsonb_agg(jsonb_build_object(
+      'seq', r.seq,
+      'record_id', r.record_id,
+      'prev_hash', r.prev_hash,
+      'hash', r.hash,
+      'record', r.record
+    ) ORDER BY r.seq ASC)
+    FROM ${EVIDENCE_RECORDS_TABLE} r
+    WHERE r.tenant_id = $1 AND r.gate_id = $2 AND r.stream_id = $3
+  ), '[]'::jsonb) AS record_rows,
+  (
+    SELECT CASE WHEN h.head_seq = -1 THEN NULL ELSE jsonb_build_object(
+      'seq', h.head_seq, 'hash', h.head_hash
+    ) END
+    FROM ${EVIDENCE_HEADS_TABLE} h
+    WHERE h.tenant_id = $1 AND h.gate_id = $2 AND h.stream_id = $3
+  ) AS head`,
+
+  appendIfHead: `SELECT ${EVIDENCE_APPEND_FUNCTION}($1, $2, $3, $4, $5::jsonb, $6) AS appended`,
+});
+
+function assertScopedId(value, label, { minLength = 1, maxLength = 256 } = {}) {
+  if (typeof value !== 'string' || value.length < minLength
+      || value.length > maxLength || value.includes('\0')) {
+    throw new Error(`${label} must be a string of ${minLength} to ${maxLength} characters`);
+  }
+  return value;
+}
+
+function queryRows(result, operation) {
+  if (!result || !Number.isInteger(result.rowCount) || result.rowCount < 0
+      || !Array.isArray(result.rows) || result.rows.length !== result.rowCount) {
+    throw new Error(`${operation}: malformed Postgres result; storage outcome is unproven`);
+  }
+  return result.rows;
+}
+
+function parseSequence(value, operation, { sentinel = false } = {}) {
+  let parsed = value;
+  if (typeof value === 'string' && /^-?(0|[1-9][0-9]*)$/.test(value)) parsed = Number(value);
+  const minimum = sentinel ? -1 : 0;
+  if (!Number.isSafeInteger(parsed) || parsed < minimum) {
+    throw new Error(`${operation}: Postgres returned an invalid evidence sequence`);
+  }
+  return parsed;
+}
+
+function parseJson(value, operation) {
+  if (typeof value !== 'string') return value;
+  try {
+    return JSON.parse(value);
+  } catch {
+    throw new Error(`${operation}: Postgres returned malformed JSON`);
+  }
+}
+
+function normalizeHead(value, operation) {
+  const head = parseJson(value, operation);
+  if (head === null || head === undefined) return null;
+  if (!head || typeof head !== 'object' || Array.isArray(head)) {
+    throw new Error(`${operation}: Postgres returned a malformed evidence head`);
+  }
+  const seq = parseSequence(head.seq, operation, { sentinel: true });
+  if (seq === -1) {
+    if (head.hash !== null && head.hash !== undefined) {
+      throw new Error(`${operation}: empty evidence head has a hash`);
+    }
+    return null;
+  }
+  if (typeof head.hash !== 'string' || !HEX_256.test(head.hash)) {
+    throw new Error(`${operation}: Postgres returned a malformed evidence head hash`);
+  }
+  return { seq, hash: head.hash };
+}
+
+function normalizeRecordRow(value, operation) {
+  const row = parseJson(value, operation);
+  if (!row || typeof row !== 'object' || Array.isArray(row)) {
+    throw new Error(`${operation}: Postgres returned a malformed evidence row`);
+  }
+  const seq = parseSequence(row.seq, operation);
+  const record = parseJson(row.record, operation);
+  if (!record || typeof record !== 'object' || Array.isArray(record)
+      || record.seq !== seq
+      || record.record_id !== row.record_id
+      || record.prev_hash !== row.prev_hash
+      || record.hash !== row.hash) {
+    throw new Error(`${operation}: evidence row metadata does not match its record`);
+  }
+  return structuredClone(record);
+}
+
+function canonicalAppendPayload(record, expectedHeadHash) {
+  if (expectedHeadHash !== null && (typeof expectedHeadHash !== 'string' || !HEX_256.test(expectedHeadHash))) {
+    throw new Error('appendIfHead: expected head must be null or a lowercase SHA-256 hash');
+  }
+  if (!verifyEvidenceRecord(record, { atomicRequired: true })) {
+    throw new Error('appendIfHead: record is not a valid canonical atomic evidence record');
+  }
+  if (expectedHeadHash === null) {
+    if (record.seq !== 0 || record.prev_hash !== 'genesis') {
+      throw new Error('appendIfHead: genesis append has an invalid sequence or predecessor');
+    }
+  } else if (record.seq < 1 || record.prev_hash !== expectedHeadHash) {
+    throw new Error('appendIfHead: record does not extend the expected head');
+  }
+
+  let persisted;
+  try {
+    persisted = JSON.parse(JSON.stringify(record));
+  } catch {
+    throw new Error('appendIfHead: record is not losslessly JSON-serializable');
+  }
+  if (!persisted || typeof persisted !== 'object' || Array.isArray(persisted)
+      || canonicalEvidenceJson(persisted) !== canonicalEvidenceJson(record)
+      || !verifyEvidenceRecord(persisted, { atomicRequired: true })) {
+    throw new Error('appendIfHead: record is not losslessly JSON-serializable');
+  }
+
+  const { hash: _hash, ...body } = persisted;
+  const canonicalBody = canonicalEvidenceJson(body);
+  if (typeof canonicalBody !== 'string' || Buffer.byteLength(canonicalBody, 'utf8') > MAX_CANONICAL_BYTES) {
+    throw new Error('appendIfHead: canonical evidence body exceeds the Postgres limit');
+  }
+  return { canonicalBody, persisted };
+}
+
+function verifyHistory(records, head) {
+  const recordIds = new Set();
+  const sequences = new Set();
+  let previous = 'genesis';
+
+  for (let index = 0; index < records.length; index++) {
+    const record = records[index];
+    if (sequences.has(record.seq)) return { ok: false, at: record.seq, reason: 'fork_detected' };
+    sequences.add(record.seq);
+    if (record.seq !== index) return { ok: false, at: index, reason: 'sequence_gap_or_rollback' };
+    if (record.prev_hash !== previous) {
+      return { ok: false, at: index, reason: 'fork_or_predecessor_mismatch' };
+    }
+    if (recordIds.has(record.record_id)) {
+      return { ok: false, at: index, reason: 'duplicate_record_id' };
+    }
+    if (!verifyEvidenceRecord(record, { atomicRequired: true })) {
+      return { ok: false, at: index, reason: 'hash_mismatch_or_malformed_record' };
+    }
+    recordIds.add(record.record_id);
+    previous = record.hash;
+  }
+
+  const expectedHead = records.length === 0
+    ? null
+    : { seq: records.length - 1, hash: previous };
+  if ((expectedHead === null && head !== null)
+      || (expectedHead !== null && (head === null
+        || head.seq !== expectedHead.seq || head.hash !== expectedHead.hash))) {
+    return { ok: false, reason: 'head_rollback_or_mismatch' };
+  }
+  return { ok: true, length: records.length, head: expectedHead?.hash ?? null };
+}
+
+/**
+ * Create a tenant-and-gate-bound backend for createAtomicEvidenceLog().
+ *
+ * `query` is a node-postgres style function such as `pool.query.bind(pool)`.
+ * The migration must be installed and the connection role must inherit or SET
+ * ROLE to `emilia_gate_evidence_runtime`.
+ */
+export function createPostgresEvidenceBackend({ query, tenantId, gateId } = {}) {
+  if (typeof query !== 'function') {
+    throw new Error('createPostgresEvidenceBackend: query must be an async pg-style function that throws on failure');
+  }
+  const tenant = assertScopedId(tenantId, 'tenantId');
+  const gate = assertScopedId(gateId, 'gateId');
+  const scope = Object.freeze({ tenantId: tenant, gateId: gate });
+  const scopeParams = (streamId) => [tenant, gate, assertScopedId(streamId, 'streamId')];
+
+  async function readHead(streamId) {
+    const rows = queryRows(await query(EVIDENCE_SQL.readHead, scopeParams(streamId)), 'readHead');
+    if (rows.length > 1) throw new Error('readHead: Postgres returned multiple scoped heads');
+    return rows.length === 0 ? null : normalizeHead(rows[0], 'readHead');
+  }
+
+  async function getById(streamId, recordId) {
+    assertScopedId(recordId, 'recordId', { minLength: 16 });
+    const rows = queryRows(
+      await query(EVIDENCE_SQL.getById, [...scopeParams(streamId), recordId]),
+      'getById',
+    );
+    if (rows.length > 1) throw new Error('getById: Postgres returned duplicate scoped record IDs');
+    return rows.length === 0 ? null : normalizeRecordRow(rows[0], 'getById');
+  }
+
+  async function appendIfHead(streamId, expectedHeadHash, record) {
+    const params = scopeParams(streamId);
+    const { canonicalBody, persisted } = canonicalAppendPayload(record, expectedHeadHash);
+    const rows = queryRows(
+      await query(EVIDENCE_SQL.appendIfHead, [
+        ...params,
+        expectedHeadHash,
+        persisted,
+        canonicalBody,
+      ]),
+      'appendIfHead',
+    );
+    if (rows.length !== 1 || typeof rows[0]?.appended !== 'boolean') {
+      throw new Error('appendIfHead: Postgres did not return a definitive append verdict');
+    }
+    return rows[0].appended;
+  }
+
+  async function readAll(streamId) {
+    const rows = queryRows(await query(EVIDENCE_SQL.readAll, scopeParams(streamId)), 'readAll');
+    return rows.map((row) => normalizeRecordRow(row, 'readAll'));
+  }
+
+  async function readSnapshot(streamId) {
+    const rows = queryRows(await query(EVIDENCE_SQL.snapshot, scopeParams(streamId)), 'verify');
+    if (rows.length !== 1) throw new Error('verify: Postgres did not return one scoped snapshot');
+    const recordRows = parseJson(rows[0].record_rows, 'verify');
+    if (!Array.isArray(recordRows)) throw new Error('verify: Postgres returned malformed evidence history');
+    return {
+      records: recordRows.map((row) => normalizeRecordRow(row, 'verify')),
+      head: normalizeHead(rows[0].head, 'verify'),
+    };
+  }
+
+  return {
+    durable: true,
+    persisted: true,
+    strict: true,
+    forkAware: true,
+    atomicAppend: true,
+    appendOnly: true,
+    version: PG_EVIDENCE_VERSION,
+    scope,
+    readHead,
+    head: readHead,
+    getById,
+    appendIfHead,
+    readAll,
+    all: readAll,
+    async verify(streamId) {
+      try {
+        const snapshot = await readSnapshot(streamId);
+        return verifyHistory(snapshot.records, snapshot.head);
+      } catch {
+        return { ok: false, reason: 'backend_read_failed_or_malformed' };
+      }
+    },
+    async health() {
+      const rows = queryRows(await query(EVIDENCE_SQL.health, []), 'health');
+      if (rows.length !== 1) throw new Error('health: Postgres did not return one readiness row');
+      const checks = {
+        recordsReady: rows[0].records_ready === true,
+        headsReady: rows[0].heads_ready === true,
+        appendReady: rows[0].append_ready === true,
+        canReadRecords: rows[0].can_read_records === true,
+        canReadHeads: rows[0].can_read_heads === true,
+        noDirectRecordWrites: rows[0].can_write_records_directly === false,
+        noDirectHeadWrites: rows[0].can_write_heads_directly === false,
+        canAppend: rows[0].can_append === true,
+      };
+      return {
+        ok: Object.values(checks).every(Boolean),
+        version: PG_EVIDENCE_VERSION,
+        scope,
+        checks,
+      };
+    },
+  };
+}
+
+const postgresEvidence = {
+  createPostgresEvidenceBackend,
+  EVIDENCE_SQL,
+  EVIDENCE_SCHEMA,
+  EVIDENCE_RECORDS_TABLE,
+  EVIDENCE_HEADS_TABLE,
+  EVIDENCE_APPEND_FUNCTION,
+  PG_EVIDENCE_VERSION,
+};
+
+export default postgresEvidence;

package/evidence.js

@@ -28,15 +28,17 @@ function sha256hex(s) {
 }
 
 /** Canonical JSON (recursive sorted keys) — matches @emilia-protocol/verify. */
-function canonical(v) {
+export function canonicalEvidenceJson(v) {
   if (v === null || v === undefined) return JSON.stringify(v);
-  if (Array.isArray(v)) return `[${v.map(canonical).join(',')}]`;
+  if (Array.isArray(v)) return `[${v.map(canonicalEvidenceJson).join(',')}]`;
   if (typeof v === 'object') {
-    return `{${Object.keys(v).sort().map((k) => JSON.stringify(k) + ':' + canonical(v[k])).join(',')}}`;
+    return `{${Object.keys(v).sort().map((k) => JSON.stringify(k) + ':' + canonicalEvidenceJson(v[k])).join(',')}}`;
   }
   return JSON.stringify(v);
 }
 
+const canonical = canonicalEvidenceJson;
+
 export function createEvidenceLog({ sink, strict = false } = {}) {
   const records = [];
   let prev = 'genesis';
@@ -229,6 +231,11 @@ export function createAtomicEvidenceLog(backend, {
     atomicAppend: true,
     streamId,
 
+    async health() {
+      if (typeof backend.health !== 'function') return { ok: false, reason: 'backend_health_unavailable' };
+      return backend.health();
+    },
+
     async record(entry) {
       const snapshot = structuredClone(entry);
       assertLogEntry(snapshot);

package/execution-binding.js

@@ -6,33 +6,125 @@ import crypto from 'node:crypto';
 
 export const EXECUTION_BINDING_VERSION = 'EP-GATE-EXECUTION-BINDING-v1';
 
-export function canonicalize(v) {
-  if (v === null || v === undefined) return JSON.stringify(v);
-  if (Array.isArray(v)) return `[${v.map(canonicalize).join(',')}]`;
+const MAX_JSON_DEPTH = 64;
+const MAX_JSON_NODES = 50000;
+const MAX_JSON_STRING_BYTES = 1024 * 1024;
+
+function validUnicodeString(value) {
+  for (let i = 0; i < value.length; i++) {
+    const unit = value.charCodeAt(i);
+    if (unit >= 0xd800 && unit <= 0xdbff) {
+      const next = value.charCodeAt(++i);
+      if (!(next >= 0xdc00 && next <= 0xdfff)) return false;
+    } else if (unit >= 0xdc00 && unit <= 0xdfff) return false;
+  }
+  return true;
+}
+
+function isPlainObject(value) {
+  if (value === null || typeof value !== 'object' || Array.isArray(value)) return false;
+  const prototype = Object.getPrototypeOf(value);
+  return prototype === Object.prototype || prototype === null;
+}
+
+/**
+ * Match the hardened EP canonical JSON safety profile: valid Unicode strings,
+ * booleans, null, safe integers, dense arrays, and plain data objects. Object
+ * identity is unique across the graph, so cycles and aliases both refuse.
+ */
+function assertCanonicalJson(value) {
+  const stack = [{ value, depth: 0 }];
+  const seen = new WeakSet();
+  let nodes = 0;
+  let stringBytes = 0;
+
+  while (stack.length) {
+    const current = stack.pop();
+    if (++nodes > MAX_JSON_NODES || current.depth > MAX_JSON_DEPTH) {
+      throw new TypeError('value exceeds the EP canonical JSON resource profile');
+    }
+    const v = current.value;
+    if (v === null || typeof v === 'boolean') continue;
+    if (typeof v === 'string') {
+      if (!validUnicodeString(v)) throw new TypeError('value contains invalid Unicode');
+      stringBytes += Buffer.byteLength(v, 'utf8');
+      if (stringBytes > MAX_JSON_STRING_BYTES) throw new TypeError('value exceeds the EP canonical JSON string limit');
+      continue;
+    }
+    if (typeof v === 'number') {
+      if (!Number.isSafeInteger(v)) throw new TypeError('value contains a non-safe integer');
+      continue;
+    }
+    if (!Array.isArray(v) && !isPlainObject(v)) {
+      throw new TypeError('value contains a non-plain JSON object');
+    }
+    if (seen.has(v)) throw new TypeError('value contains a cycle or alias');
+    seen.add(v);
+
+    if (Array.isArray(v)) {
+      const ownKeys = Reflect.ownKeys(v);
+      if (ownKeys.length !== v.length + 1 || !ownKeys.includes('length')) {
+        throw new TypeError('value contains a sparse or extended array');
+      }
+      for (let i = 0; i < v.length; i++) {
+        const descriptor = Object.getOwnPropertyDescriptor(v, String(i));
+        if (!descriptor || descriptor.enumerable !== true || !Object.hasOwn(descriptor, 'value')) {
+          throw new TypeError('value contains a sparse or accessor array');
+        }
+        stack.push({ value: descriptor.value, depth: current.depth + 1 });
+      }
+      continue;
+    }
+
+    for (const key of Reflect.ownKeys(v)) {
+      if (typeof key !== 'string' || !validUnicodeString(key)) {
+        throw new TypeError('value contains a non-JSON object key');
+      }
+      const descriptor = Object.getOwnPropertyDescriptor(v, key);
+      if (!descriptor || descriptor.enumerable !== true || !Object.hasOwn(descriptor, 'value')) {
+        throw new TypeError('value contains a non-data JSON property');
+      }
+      stringBytes += Buffer.byteLength(key, 'utf8');
+      if (stringBytes > MAX_JSON_STRING_BYTES) throw new TypeError('value exceeds the EP canonical JSON string limit');
+      stack.push({ value: descriptor.value, depth: current.depth + 1 });
+    }
+  }
+}
+
+function canonicalizeValidated(v) {
+  if (v === null) return 'null';
+  if (Array.isArray(v)) return `[${v.map(canonicalizeValidated).join(',')}]`;
   if (typeof v === 'object') {
-    return `{${Object.keys(v).sort().map((k) => JSON.stringify(k) + ':' + canonicalize(v[k])).join(',')}}`;
+    return `{${Object.keys(v).sort().map((k) => JSON.stringify(k) + ':' + canonicalizeValidated(v[k])).join(',')}}`;
   }
   return JSON.stringify(v);
 }
 
-export function hashCanonical(v) {
-  return crypto.createHash('sha256').update(canonicalize(v)).digest('hex');
+export function canonicalize(v) {
+  assertCanonicalJson(v);
+  return canonicalizeValidated(v);
 }
 
-function hasValue(v) {
-  return v !== undefined && v !== null;
+export function hashCanonical(v) {
+  return crypto.createHash('sha256').update(canonicalize(v)).digest('hex');
 }
 
-function normalize(v) {
-  if (Array.isArray(v)) return [...new Set(v.map((x) => String(x)))].sort();
-  if (v && typeof v === 'object') {
-    return Object.fromEntries(Object.keys(v).sort().map((k) => [k, normalize(v[k])]));
+function fieldValue(container, field) {
+  if (!isPlainObject(container)) return { state: 'invalid' };
+  const descriptor = Object.getOwnPropertyDescriptor(container, field);
+  if (!descriptor) return { state: 'missing' };
+  if (descriptor.enumerable !== true || !Object.hasOwn(descriptor, 'value')) return { state: 'invalid' };
+  if (descriptor.value === null) return { state: 'missing' };
+  try {
+    assertCanonicalJson(descriptor.value);
+    return { state: 'valid', value: descriptor.value };
+  } catch {
+    return { state: 'invalid' };
   }
-  return v;
 }
 
 function equalValue(a, b) {
-  return hashCanonical(normalize(a)) === hashCanonical(normalize(b));
+  return canonicalize(a) === canonicalize(b);
 }
 
 export function materialFieldsFor(requirement) {
@@ -55,36 +147,59 @@ export function verifyExecutionBinding({ requirement, receipt, observedAction }
   const observed = observedAction || {};
   const missingSigned = [];
   const missingObserved = [];
+  const invalidSigned = [];
+  const invalidObserved = [];
   const mismatched = [];
   const signedValues = {};
   const observedValues = {};
 
   for (const field of requiredFields) {
-    const expected = signed[field];
-    const actual = observed[field];
-    if (!hasValue(expected)) {
+    const expected = fieldValue(signed, field);
+    const actual = fieldValue(observed, field);
+    if (expected.state === 'missing') {
       missingSigned.push(field);
-      continue;
+    } else if (expected.state === 'invalid') {
+      invalidSigned.push(field);
+    } else {
+      signedValues[field] = expected.value;
     }
-    signedValues[field] = normalize(expected);
-    if (!hasValue(actual)) {
+    if (actual.state === 'missing') {
       missingObserved.push(field);
-      continue;
+    } else if (actual.state === 'invalid') {
+      invalidObserved.push(field);
+    } else {
+      observedValues[field] = actual.value;
+    }
+    if (expected.state === 'valid' && actual.state === 'valid'
+        && !equalValue(expected.value, actual.value)) mismatched.push(field);
+  }
+
+  // Per-field checks do not see one object reused by two required fields.
+  // Validate the aggregate graphs before computing either digest.
+  try { assertCanonicalJson(signedValues); } catch {
+    for (const field of Object.keys(signedValues)) {
+      if (!invalidSigned.includes(field)) invalidSigned.push(field);
+    }
+  }
+  try { assertCanonicalJson(observedValues); } catch {
+    for (const field of Object.keys(observedValues)) {
+      if (!invalidObserved.includes(field)) invalidObserved.push(field);
     }
-    observedValues[field] = normalize(actual);
-    if (!equalValue(expected, actual)) mismatched.push(field);
   }
 
   return {
     '@version': EXECUTION_BINDING_VERSION,
-    ok: missingSigned.length === 0 && missingObserved.length === 0 && mismatched.length === 0,
+    ok: missingSigned.length === 0 && missingObserved.length === 0
+      && invalidSigned.length === 0 && invalidObserved.length === 0 && mismatched.length === 0,
     required: true,
     required_fields: requiredFields,
     missing_signed_fields: missingSigned,
     missing_observed_fields: missingObserved,
+    invalid_signed_fields: invalidSigned,
+    invalid_observed_fields: invalidObserved,
     mismatched_fields: mismatched,
-    signed_hash: hashCanonical(signedValues),
-    observed_hash: hashCanonical(observedValues),
+    signed_hash: invalidSigned.length === 0 ? hashCanonical(signedValues) : null,
+    observed_hash: invalidObserved.length === 0 ? hashCanonical(observedValues) : null,
     note: 'Executor MUST provide observedAction from the system of record; request-body fields are not a trust source.',
   };
 }