@fluxpointstudios/orynq-sdk-tool-receipts 0.2.0

package/package.json

@@ -0,0 +1,73 @@
+{
+  "name": "@fluxpointstudios/orynq-sdk-tool-receipts",
+  "version": "0.2.0",
+  "description": "Verifiable tool-call receipts for the Orynq process-trace SDK — RFC 9421, webhook-signature, and JWS verifiers",
+  "type": "module",
+  "main": "./dist/index.cjs",
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "import": {
+        "types": "./dist/index.d.ts",
+        "default": "./dist/index.js"
+      },
+      "require": {
+        "types": "./dist/index.d.cts",
+        "default": "./dist/index.cjs"
+      }
+    }
+  },
+  "files": [
+    "dist",
+    "src"
+  ],
+  "keywords": [
+    "poi",
+    "proof-of-intent",
+    "orynq",
+    "tool-receipts",
+    "tool-call",
+    "rfc9421",
+    "jws",
+    "webhook",
+    "verifiable",
+    "audit"
+  ],
+  "author": "Flux Point Studios",
+  "license": "MIT",
+  "publishConfig": {
+    "access": "public",
+    "registry": "https://registry.npmjs.org"
+  },
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/Flux-Point-Studios/orynq-sdk",
+    "directory": "packages/tool-receipts"
+  },
+  "homepage": "https://github.com/Flux-Point-Studios/orynq-sdk#readme",
+  "bugs": "https://github.com/Flux-Point-Studios/orynq-sdk/issues",
+  "dependencies": {
+    "@fluxpointstudios/orynq-sdk-core": "0.1.0",
+    "@fluxpointstudios/orynq-sdk-process-trace": "0.3.0"
+  },
+  "devDependencies": {
+    "tsup": "^8.0.1",
+    "typescript": "^5.3.3",
+    "vitest": "^1.2.0"
+  },
+  "engines": {
+    "node": ">=18.0.0"
+  },
+  "sideEffects": false,
+  "scripts": {
+    "build": "tsup",
+    "dev": "tsup --watch",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "typecheck": "tsc --noEmit",
+    "lint": "eslint src --ext .ts",
+    "lint:fix": "eslint src --ext .ts --fix",
+    "clean": "rimraf dist"
+  }
+}

package/src/__tests__/hardening-round2.test.ts

@@ -0,0 +1,233 @@
+/**
+ * @summary Round-2 hardening regression tests for tool-call receipts.
+ *
+ * Each suite reproduces an exploit an adversarial re-review surfaced, then
+ * asserts the receipt now FAILS to verify:
+ *  1. response.payload↔hash gap — auditors read `response.payload`, so an
+ *     honest `response.hash` paired with a fabricated `response.payload` must
+ *     not verify.
+ *  2. JWT algorithm confusion — an asymmetric public key must never be fed into
+ *     an HMAC branch (alg:HS256 over a known public-key PEM).
+ *  3. Replay / call-binding — a self-signed JWS receipt lifted into a different
+ *     runId/request must fail; external webhook receipts are authenticity-only
+ *     and flagged not-call-bound.
+ */
+
+import { describe, it, expect } from "vitest";
+import { createHmac, generateKeyPairSync } from "node:crypto";
+import {
+  createTrace,
+  addSpan,
+  closeSpan,
+  finalizeTrace,
+} from "@fluxpointstudios/orynq-sdk-process-trace";
+import type {
+  TraceRun,
+  TraceBundle,
+  ToolReceiptEvent,
+} from "@fluxpointstudios/orynq-sdk-process-trace";
+import {
+  addToolReceipt,
+  hashToolPayload,
+  verifyToolReceipts,
+  createSigningProxy,
+} from "../index.js";
+
+const pem = (k: ReturnType<typeof generateKeyPairSync>["publicKey"]): string =>
+  k.export({ type: "spki", format: "pem" }).toString();
+
+/** Record a receipt with an explicit request/response, returning the bundle. */
+async function traceWith(opts: {
+  receipt: ToolReceiptEvent["receipt"];
+  request: { hash: string };
+  response: { hash: string; payload?: unknown };
+}): Promise<TraceBundle> {
+  const run: TraceRun = await createTrace({ agentId: "agent-h2" });
+  const span = addSpan(run, { name: "tool-call", visibility: "public" });
+  await addToolReceipt(run, span.id, {
+    toolId: "demo.tool",
+    request: opts.request,
+    response: opts.response,
+    receipt: opts.receipt,
+  });
+  await closeSpan(run, span.id);
+  return finalizeTrace(run);
+}
+
+describe("response.payload vs response.hash binding", () => {
+  it("rejects an honest response.hash paired with a fabricated response.payload", async () => {
+    const { privateKey, publicKey } = generateKeyPairSync("ed25519");
+    const proxy = createSigningProxy({
+      signer: "tee://oracle",
+      alg: "EdDSA",
+      privateKey,
+      publicKey: pem(publicKey),
+    });
+    const honest = { price: 100, currency: "usd" };
+    const receipt = proxy.sign(honest);
+
+    // Signature binds to the honest hash, but the retained human-readable
+    // payload auditors actually read is fabricated.
+    const bundle = await traceWith({
+      receipt,
+      request: { hash: await hashToolPayload({ q: 1 }) },
+      response: { hash: await hashToolPayload(honest), payload: { price: 1, currency: "usd" } },
+    });
+
+    const outcome = await verifyToolReceipts(bundle, {
+      keys: { "tee://oracle": pem(publicKey) },
+    });
+    expect(outcome.results[0]!.verified).toBe(false);
+    expect(outcome.results[0]!.reason).toBe("response-payload-mismatch");
+  });
+
+  it("accepts a payload that hashes to response.hash", async () => {
+    const { privateKey, publicKey } = generateKeyPairSync("ed25519");
+    const proxy = createSigningProxy({
+      signer: "tee://oracle",
+      alg: "EdDSA",
+      privateKey,
+      publicKey: pem(publicKey),
+    });
+    const honest = { price: 100, currency: "usd" };
+    const receipt = proxy.sign(honest);
+    const bundle = await traceWith({
+      receipt,
+      request: { hash: await hashToolPayload({ q: 1 }) },
+      response: { hash: await hashToolPayload(honest), payload: honest },
+    });
+    const outcome = await verifyToolReceipts(bundle, {
+      keys: { "tee://oracle": pem(publicKey) },
+    });
+    expect(outcome.results[0]!.verified).toBe(true);
+  });
+});
+
+describe("JWT algorithm confusion (HS* over an asymmetric public key)", () => {
+  it("refuses to HMAC-verify with a pinned asymmetric public key (alg:HS256 forgery)", async () => {
+    const { publicKey } = generateKeyPairSync("ed25519");
+    const pubPem = pem(publicKey);
+
+    // Attacker forges a JWS with alg:HS256 and HMACs the signing input using the
+    // VICTIM'S PUBLIC KEY PEM as the "secret" (public = known to the attacker).
+    const header = Buffer.from(JSON.stringify({ alg: "HS256", typ: "JWT" })).toString("base64url");
+    const body = { price: 999_999, note: "FORGED" };
+    const payloadSeg = Buffer.from(JSON.stringify(body)).toString("base64url");
+    const signingInput = `${header}.${payloadSeg}`;
+    const forgedSig = createHmac("sha256", pubPem).update(signingInput).digest("base64url");
+
+    const receipt: ToolReceiptEvent["receipt"] = {
+      scheme: "jws",
+      signer: "tee://asym-oracle",
+      signature: forgedSig,
+      signedPayload: signingInput,
+    };
+    const bundle = await traceWith({
+      receipt,
+      request: { hash: await hashToolPayload({ q: 1 }) },
+      response: { hash: await hashToolPayload(body), payload: body },
+    });
+
+    // Auditor pins the ASYMMETRIC public key. The HMAC branch must NOT accept it.
+    const outcome = await verifyToolReceipts(bundle, {
+      keys: { "tee://asym-oracle": pubPem },
+    });
+    expect(outcome.results[0]!.verified).toBe(false);
+    expect(outcome.results[0]!.error ?? "").toMatch(/public key|asymmetric|hmac/i);
+  });
+
+  it("optional keyAlgs allow-list rejects an alg outside it", async () => {
+    // A genuine HS256 receipt, but the auditor pins keyAlgs to EdDSA only.
+    const proxy = createSigningProxy({ signer: "hs-signer", alg: "HS256", secret: "topsecret" });
+    const payload = { data: "y" };
+    const receipt = proxy.sign(payload);
+    const bundle = await traceWith({
+      receipt,
+      request: { hash: await hashToolPayload({ q: 1 }) },
+      response: { hash: await hashToolPayload(payload), payload },
+    });
+    const outcome = await verifyToolReceipts(bundle, {
+      keys: { "hs-signer": "topsecret" },
+      keyAlgs: { "hs-signer": ["EdDSA"] },
+    });
+    expect(outcome.results[0]!.verified).toBe(false);
+    expect(outcome.results[0]!.error ?? "").toMatch(/alg|allow/i);
+  });
+});
+
+describe("self-signed JWS call-binding (anti-replay)", () => {
+  it("a genuine receipt copied into a different runId/request fails", async () => {
+    const { privateKey, publicKey } = generateKeyPairSync("ed25519");
+
+    // Signer commits to the response AND the run/request binding context.
+    const run: TraceRun = await createTrace({ agentId: "agent-src" });
+    const span = addSpan(run, { name: "tool-call", visibility: "public" });
+    const request = { q: "price?" };
+    const response = { price: 100 };
+    const requestHash = await hashToolPayload(request);
+    const proxy = createSigningProxy({
+      signer: "tee://oracle",
+      alg: "EdDSA",
+      privateKey,
+      publicKey: pem(publicKey),
+      binding: { runId: run.id, requestHash },
+    });
+    const receipt = proxy.sign(response);
+    await addToolReceipt(run, span.id, {
+      toolId: "demo.tool",
+      request: { hash: requestHash },
+      response: { hash: await hashToolPayload(response), payload: response },
+      receipt,
+    });
+    await closeSpan(run, span.id);
+    const srcBundle = await finalizeTrace(run);
+
+    // In the ORIGINAL run it is call-bound and verifies.
+    const honest = await verifyToolReceipts(srcBundle, {
+      keys: { "tee://oracle": pem(publicKey) },
+    });
+    expect(honest.results[0]!.verified).toBe(true);
+    expect(honest.results[0]!.callBound).toBe(true);
+
+    // Lift the genuine receipt into a DIFFERENT run (different runId).
+    const victimRun: TraceRun = await createTrace({ agentId: "agent-victim" });
+    const vspan = addSpan(victimRun, { name: "tool-call", visibility: "public" });
+    await addToolReceipt(victimRun, vspan.id, {
+      toolId: "demo.tool",
+      request: { hash: requestHash },
+      response: { hash: await hashToolPayload(response), payload: response },
+      receipt, // same genuine, honestly-signed receipt
+    });
+    await closeSpan(victimRun, vspan.id);
+    const victimBundle = await finalizeTrace(victimRun);
+
+    const replayed = await verifyToolReceipts(victimBundle, {
+      keys: { "tee://oracle": pem(publicKey) },
+    });
+    expect(replayed.results[0]!.verified).toBe(false);
+    expect(replayed.results[0]!.reason).toBe("call-binding-mismatch");
+  });
+
+  it("external webhook receipts verify for authenticity but are marked not-call-bound", async () => {
+    const secret = "whsec_test_secret";
+    const body = JSON.stringify({ id: "evt_1", type: "charge.succeeded" });
+    const t = 1_900_000_000;
+    const v1 = createHmac("sha256", secret).update(`${t}.${body}`).digest("hex");
+    const bundle = await traceWith({
+      receipt: {
+        scheme: "stripe-webhook",
+        signer: "acct_123",
+        signature: `t=${t},v1=${v1}`,
+        signedPayload: body,
+      },
+      request: { hash: await hashToolPayload({ q: 1 }) },
+      response: { hash: await hashToolPayload(body), payload: body },
+    });
+    const outcome = await verifyToolReceipts(bundle, {
+      keys: { acct_123: secret },
+      nowSec: t + 10,
+    });
+    expect(outcome.results[0]!.verified).toBe(true);
+    expect(outcome.results[0]!.callBound).toBe(false);
+  });
+});

package/src/__tests__/hardening-round3.test.ts

@@ -0,0 +1,93 @@
+/**
+ * @summary Round-3 hardening regression tests for tool-call receipts (#60).
+ *
+ * GitHub webhook signatures carry no timestamp, so freshness cannot be enforced
+ * cryptographically — a genuine receipt replays across traces. When the caller
+ * DOES record a `receipt.params.timestamp`, the GitHub verifier must enforce the
+ * same tolerance window Stripe uses, so a stale receipt is rejected. Without a
+ * timestamp the scheme stays authenticity-only (anti-replay via the bundle
+ * Merkle commitment), which we assert still verifies.
+ */
+
+import { describe, it, expect } from "vitest";
+import { createHmac } from "node:crypto";
+import {
+  createTrace,
+  addSpan,
+  closeSpan,
+  finalizeTrace,
+} from "@fluxpointstudios/orynq-sdk-process-trace";
+import type {
+  TraceRun,
+  TraceBundle,
+  ToolReceiptEvent,
+} from "@fluxpointstudios/orynq-sdk-process-trace";
+import { addToolReceipt, hashToolPayload, verifyToolReceipts } from "../index.js";
+
+async function traceWith(receipt: ToolReceiptEvent["receipt"], body: string): Promise<TraceBundle> {
+  const run: TraceRun = await createTrace({ agentId: "agent-h3" });
+  const span = addSpan(run, { name: "tool-call", visibility: "public" });
+  await addToolReceipt(run, span.id, {
+    toolId: "gh.webhook",
+    request: { hash: await hashToolPayload({ q: 1 }) },
+    response: { hash: await hashToolPayload(body), payload: body },
+    receipt,
+  });
+  await closeSpan(run, span.id);
+  return finalizeTrace(run);
+}
+
+describe("GitHub webhook freshness when a timestamp is recorded (#60 round-3)", () => {
+  const secret = "gh_webhook_secret";
+  const body = JSON.stringify({ action: "opened", number: 42 });
+  const t = 1_900_000_000;
+  const sig = "sha256=" + createHmac("sha256", secret).update(body).digest("hex");
+
+  it("rejects a stale GitHub receipt when params.timestamp is outside tolerance", async () => {
+    const bundle = await traceWith(
+      {
+        scheme: "github-webhook",
+        signer: "gh:org/repo",
+        signature: sig,
+        signedPayload: body,
+        params: { timestamp: String(t) },
+      },
+      body
+    );
+    const outcome = await verifyToolReceipts(bundle, {
+      keys: { "gh:org/repo": secret },
+      nowSec: t + 10_000, // far outside the 300s window
+      toleranceSec: 300,
+    });
+    expect(outcome.results[0]!.verified).toBe(false);
+    expect(outcome.results[0]!.error).toMatch(/tolerance/i);
+  });
+
+  it("verifies a fresh GitHub receipt when params.timestamp is within tolerance", async () => {
+    const bundle = await traceWith(
+      {
+        scheme: "github-webhook",
+        signer: "gh:org/repo",
+        signature: sig,
+        signedPayload: body,
+        params: { timestamp: String(t) },
+      },
+      body
+    );
+    const outcome = await verifyToolReceipts(bundle, {
+      keys: { "gh:org/repo": secret },
+      nowSec: t + 30,
+      toleranceSec: 300,
+    });
+    expect(outcome.results[0]!.verified).toBe(true);
+  });
+
+  it("still verifies a GitHub receipt with no timestamp (Merkle-committed anti-replay)", async () => {
+    const bundle = await traceWith(
+      { scheme: "github-webhook", signer: "gh:org/repo", signature: sig, signedPayload: body },
+      body
+    );
+    const outcome = await verifyToolReceipts(bundle, { keys: { "gh:org/repo": secret } });
+    expect(outcome.results[0]!.verified).toBe(true);
+  });
+});

package/src/__tests__/hardening-round4.test.ts

@@ -0,0 +1,265 @@
+/**
+ * @summary Round-4 hardening regression tests for tool-call receipts (#60).
+ *
+ * Closes the request-attribution + call-binding gaps left after round 3:
+ *  - A genuine signed JWS response must not be attributable to a FABRICATED
+ *    request. A JWS that binds only `runId` (no `requestHash`) is NOT call-bound,
+ *    and `callBound` must reflect that.
+ *  - `callBound` must be TRUE only when a binding was actually signed AND both
+ *    the runId and requestHash matched — never hard-coded per scheme.
+ *  - A tampered JWS signature must be caught deterministically (decoded-byte flip).
+ *  - The algorithm-confusion guard must reject a DER-encoded SPKI public key fed
+ *    into the HMAC path (raw Uint8Array, not just PEM/JWK).
+ */
+
+import { describe, it, expect } from "vitest";
+import { generateKeyPairSync } from "node:crypto";
+import {
+  createTrace,
+  addSpan,
+  closeSpan,
+  finalizeTrace,
+} from "@fluxpointstudios/orynq-sdk-process-trace";
+import type {
+  TraceRun,
+  TraceBundle,
+  ToolReceiptEvent,
+} from "@fluxpointstudios/orynq-sdk-process-trace";
+import {
+  addToolReceipt,
+  hashToolPayload,
+  verifyToolReceipts,
+  createSigningProxy,
+} from "../index.js";
+
+const pem = (k: ReturnType<typeof generateKeyPairSync>["publicKey"]): string =>
+  k.export({ type: "spki", format: "pem" }).toString();
+
+/** Record a receipt whose request/response payloads are as given. */
+async function traceWithReceipt(
+  receipt: ToolReceiptEvent["receipt"],
+  requestPayload: unknown,
+  responsePayload: unknown
+): Promise<TraceBundle> {
+  const run: TraceRun = await createTrace({ agentId: "agent-h4" });
+  const span = addSpan(run, { name: "tool-call", visibility: "public" });
+  await addToolReceipt(run, span.id, {
+    toolId: "demo.tool",
+    request: { hash: await hashToolPayload(requestPayload) },
+    response: { hash: await hashToolPayload(responsePayload), payload: responsePayload },
+    receipt,
+  });
+  await closeSpan(run, span.id);
+  return finalizeTrace(run);
+}
+
+describe("JWS request-attribution (#60 round-4)", () => {
+  it("a JWS binding only runId is NOT call-bound (request is unauthenticated)", async () => {
+    const { privateKey, publicKey } = generateKeyPairSync("ed25519");
+    const run: TraceRun = await createTrace({ agentId: "agent-h4" });
+    // Bind only runId — no requestHash — mimicking a signer that scopes the run
+    // but leaves the request unauthenticated.
+    const proxy = createSigningProxy({
+      signer: "tee://oracle",
+      alg: "EdDSA",
+      privateKey,
+      publicKey: pem(publicKey),
+      binding: { runId: run.id },
+    });
+    const payload = { price: 100 };
+    const receipt = proxy.sign(payload);
+    const span = addSpan(run, { name: "tool-call", visibility: "public" });
+    await addToolReceipt(run, span.id, {
+      toolId: "demo.tool",
+      request: { hash: await hashToolPayload({ q: "genuine" }) },
+      response: { hash: await hashToolPayload(payload), payload },
+      receipt,
+    });
+    await closeSpan(run, span.id);
+    const bundle = await finalizeTrace(run);
+
+    const outcome = await verifyToolReceipts(bundle, { keys: { "tee://oracle": pem(publicKey) } });
+    // Signature + response binding are honest, so the receipt still verifies...
+    expect(outcome.results[0]!.verified).toBe(true);
+    // ...but the request was never signed, so it MUST NOT be reported call-bound.
+    expect(outcome.results[0]!.callBound).toBe(false);
+  });
+
+  it("a fully-bound JWS whose signed requestHash != recorded request.hash is rejected", async () => {
+    const { privateKey, publicKey } = generateKeyPairSync("ed25519");
+    const run: TraceRun = await createTrace({ agentId: "agent-h4" });
+    const payload = { price: 100 };
+    // Signer commits to the hash of the GENUINE request it actually served.
+    const genuineRequestHash = await hashToolPayload({ q: "genuine" });
+    const proxy = createSigningProxy({
+      signer: "tee://oracle",
+      alg: "EdDSA",
+      privateKey,
+      publicKey: pem(publicKey),
+      binding: { runId: run.id, requestHash: genuineRequestHash },
+    });
+    const receipt = proxy.sign(payload);
+    // Attacker records the genuine signed response next to a FABRICATED request.
+    const span = addSpan(run, { name: "tool-call", visibility: "public" });
+    await addToolReceipt(run, span.id, {
+      toolId: "demo.tool",
+      request: { hash: await hashToolPayload({ q: "FABRICATED" }) },
+      response: { hash: await hashToolPayload(payload), payload },
+      receipt,
+    });
+    await closeSpan(run, span.id);
+    const bundle = await finalizeTrace(run);
+
+    const outcome = await verifyToolReceipts(bundle, { keys: { "tee://oracle": pem(publicKey) } });
+    expect(outcome.results[0]!.verified).toBe(false);
+    expect(outcome.results[0]!.reason).toBe("call-binding-mismatch");
+  });
+
+  it("a fully-bound JWS matching runId + requestHash is call-bound", async () => {
+    const { privateKey, publicKey } = generateKeyPairSync("ed25519");
+    const run: TraceRun = await createTrace({ agentId: "agent-h4" });
+    const payload = { price: 100 };
+    const req = { q: "genuine" };
+    const requestHash = await hashToolPayload(req);
+    const proxy = createSigningProxy({
+      signer: "tee://oracle",
+      alg: "EdDSA",
+      privateKey,
+      publicKey: pem(publicKey),
+      binding: { runId: run.id, requestHash },
+    });
+    const receipt = proxy.sign(payload);
+    const span = addSpan(run, { name: "tool-call", visibility: "public" });
+    await addToolReceipt(run, span.id, {
+      toolId: "demo.tool",
+      request: { hash: requestHash },
+      response: { hash: await hashToolPayload(payload), payload },
+      receipt,
+    });
+    await closeSpan(run, span.id);
+    const bundle = await finalizeTrace(run);
+
+    const outcome = await verifyToolReceipts(bundle, { keys: { "tee://oracle": pem(publicKey) } });
+    expect(outcome.results[0]!.verified).toBe(true);
+    expect(outcome.results[0]!.callBound).toBe(true);
+  });
+});
+
+describe("callBound reflects reality, not scheme (#60 round-4)", () => {
+  it("a no-binding JWS is verified but NOT call-bound", async () => {
+    const { privateKey, publicKey } = generateKeyPairSync("ed25519");
+    const proxy = createSigningProxy({
+      signer: "tee://oracle",
+      alg: "EdDSA",
+      privateKey,
+      publicKey: pem(publicKey),
+      // no binding
+    });
+    const payload = { price: 100 };
+    const bundle = await traceWithReceipt(proxy.sign(payload), { q: 1 }, payload);
+    const outcome = await verifyToolReceipts(bundle, { keys: { "tee://oracle": pem(publicKey) } });
+    expect(outcome.results[0]!.verified).toBe(true);
+    expect(outcome.results[0]!.callBound).toBe(false);
+  });
+
+  it("requireCallBinding rejects a JWS receipt that did not bind the call", async () => {
+    const { privateKey, publicKey } = generateKeyPairSync("ed25519");
+    const proxy = createSigningProxy({
+      signer: "tee://oracle",
+      alg: "EdDSA",
+      privateKey,
+      publicKey: pem(publicKey),
+    });
+    const payload = { price: 100 };
+    const bundle = await traceWithReceipt(proxy.sign(payload), { q: 1 }, payload);
+    const outcome = await verifyToolReceipts(bundle, {
+      keys: { "tee://oracle": pem(publicKey) },
+      requireCallBinding: true,
+    });
+    expect(outcome.results[0]!.verified).toBe(false);
+    expect(outcome.results[0]!.reason).toBe("call-binding-required");
+  });
+
+  it("webhook receipts are never reported call-bound", async () => {
+    const { createHmac } = await import("node:crypto");
+    const secret = "gh_webhook_secret";
+    const body = JSON.stringify({ action: "opened", number: 42 });
+    const sig = "sha256=" + createHmac("sha256", secret).update(body).digest("hex");
+    const bundle = await traceWithReceipt(
+      { scheme: "github-webhook", signer: "gh:org/repo", signature: sig, signedPayload: body },
+      { q: 1 },
+      body
+    );
+    const outcome = await verifyToolReceipts(bundle, { keys: { "gh:org/repo": secret } });
+    expect(outcome.results[0]!.verified).toBe(true);
+    expect(outcome.results[0]!.callBound).toBe(false);
+  });
+
+  it("requireCallBinding rejects a webhook receipt (request-attribution not provable)", async () => {
+    const { createHmac } = await import("node:crypto");
+    const secret = "gh_webhook_secret";
+    const body = JSON.stringify({ action: "opened", number: 42 });
+    const sig = "sha256=" + createHmac("sha256", secret).update(body).digest("hex");
+    const bundle = await traceWithReceipt(
+      { scheme: "github-webhook", signer: "gh:org/repo", signature: sig, signedPayload: body },
+      { q: 1 },
+      body
+    );
+    const outcome = await verifyToolReceipts(bundle, {
+      keys: { "gh:org/repo": secret },
+      requireCallBinding: true,
+    });
+    expect(outcome.results[0]!.verified).toBe(false);
+    expect(outcome.results[0]!.reason).toBe("call-binding-required");
+  });
+});
+
+describe("tampered JWS signature is caught deterministically (#60 round-4)", () => {
+  it("flipping a decoded signature byte fails verification", async () => {
+    const { privateKey, publicKey } = generateKeyPairSync("ed25519");
+    const proxy = createSigningProxy({ signer: "tee://x", alg: "EdDSA", privateKey, publicKey: pem(publicKey) });
+    const payload = { a: 1 };
+    const receipt = proxy.sign(payload);
+    // Deterministic tamper: flip a byte in the DECODED signature, then re-encode.
+    const sigBytes = Buffer.from(receipt.signature, "base64url");
+    sigBytes[Math.floor(sigBytes.length / 2)] ^= 0xff;
+    receipt.signature = sigBytes.toString("base64url");
+    const bundle = await traceWithReceipt(receipt, { q: 1 }, payload);
+    const outcome = await verifyToolReceipts(bundle, { keys: { "tee://x": pem(publicKey) } });
+    expect(outcome.results[0]!.verified).toBe(false);
+  });
+});
+
+describe("algorithm-confusion guard covers raw DER SPKI keys (#60 round-4)", () => {
+  it("rejects an HS256 JWS whose HMAC 'secret' is a DER-encoded public key (Uint8Array)", async () => {
+    // The victim's real ES256 public key, exported as DER SPKI bytes. An attacker
+    // sets alg:HS256 and hopes the verifier HMACs with this public material.
+    const { publicKey } = generateKeyPairSync("ec", { namedCurve: "P-256" });
+    const derSpki = publicKey.export({ type: "spki", format: "der" }) as Buffer;
+
+    // Craft an HS256 JWS the attacker "signs" with the public DER bytes as key.
+    const { createHmac } = await import("node:crypto");
+    const header = Buffer.from(JSON.stringify({ alg: "HS256", typ: "JWT" })).toString("base64url");
+    const body = Buffer.from(JSON.stringify({ price: 1 })).toString("base64url");
+    const signingInput = `${header}.${body}`;
+    const forgedSig = createHmac("sha256", derSpki).update(signingInput).digest("base64url");
+
+    const bundle = await traceWithReceipt(
+      {
+        scheme: "jws",
+        signer: "tee://victim",
+        signature: forgedSig,
+        signedPayload: signingInput,
+      },
+      { q: 1 },
+      { price: 1 }
+    );
+    // Auditor resolves the victim's key as raw DER bytes (Uint8Array).
+    const outcome = await verifyToolReceipts(bundle, {
+      resolveKey: () => new Uint8Array(derSpki),
+    });
+    expect(outcome.results[0]!.verified).toBe(false);
+    // The guard fired (algorithm confusion), landing in `error`, not a silent pass.
+    expect(outcome.results[0]!.error ?? "").toMatch(/algorithm confusion|asymmetric public key/i);
+  });
+});