@iislee/opencodex 2.11.0 → 2.31.0

package/src/lab/public/community-authority.ts

@@ -0,0 +1,175 @@
+import { loadCaseAuthority } from "../conformance/manifest";
+import {
+  FABRIC_COMPATIBILITY_VERSION,
+  FABRIC_SCENARIO_ID,
+  FABRIC_SCENARIO_VERSION,
+  FABRIC_SUITE_ID,
+  FABRIC_SUITE_VERSION,
+  FABRIC_TASK_CLASS_ID,
+  FABRIC_TASK_CLASS_VERSION,
+} from "../fabric/constants";
+import { loadFabricCaseAuthority } from "../fabric/manifest";
+import { verifierManifestDigest } from "../fabric/subject";
+import { findPublicRouteRegistryEntry } from "./registry";
+import type { PublicEvidenceBundleV1, PublicEvidenceRecordV1, PublicRouteSubjectV1 } from "./types";
+import { PublicEvidenceValidationError } from "./validate";
+
+type ProtocolCaseAuthority = ReturnType<typeof loadCaseAuthority>;
+
+interface ProtocolAuthoritySnapshot {
+  scenarioVersion: string;
+  suiteVersion: string;
+  sourceCommit: string;
+  load: () => ProtocolCaseAuthority;
+}
+
+// Public records are historical evidence. Never replace an authority entry when a
+// protocol version advances: retain the old loader and append a new snapshot.
+const PROTOCOL_AUTHORITY_SNAPSHOTS: readonly ProtocolAuthoritySnapshot[] = Object.freeze([
+  Object.freeze({
+    scenarioVersion: "1.0.0",
+    suiteVersion: "1.0.0",
+    sourceCommit: "3ad5bb6bd3f76f6879d84b78ea39edd3e01ec296",
+    load: loadCaseAuthority,
+  }),
+]);
+
+const cachedCaseAuthorities = new Map<string, ProtocolCaseAuthority>();
+let cachedFabricCaseAuthority: ReturnType<typeof loadFabricCaseAuthority> | null = null;
+let cachedVerifierManifestDigest: string | null = null;
+
+function protocolAuthorityKey(snapshot: ProtocolAuthoritySnapshot): string {
+  return `${snapshot.suiteVersion}\0${snapshot.scenarioVersion}`;
+}
+
+function caseAuthorityFor(record: PublicEvidenceRecordV1): ProtocolCaseAuthority {
+  const snapshot = PROTOCOL_AUTHORITY_SNAPSHOTS.find((candidate) =>
+    candidate.scenarioVersion === record.scenarioVersion
+    && candidate.suiteVersion === record.suiteVersion
+  );
+  if (!snapshot) {
+    throw new PublicEvidenceValidationError(
+      "public_authority",
+      "scenario/suite authority version is not retained",
+    );
+  }
+
+  const key = protocolAuthorityKey(snapshot);
+  const cached = cachedCaseAuthorities.get(key);
+  if (cached) return cached;
+
+  const authority = snapshot.load();
+  if (
+    String(authority.manifestDefaults.version) !== snapshot.scenarioVersion
+    || String(authority.manifestDefaults.suiteVersion) !== snapshot.suiteVersion
+    || authority.sourceCommit !== snapshot.sourceCommit
+  ) {
+    throw new Error("public protocol authority snapshot drift");
+  }
+  cachedCaseAuthorities.set(key, authority);
+  return authority;
+}
+
+function fabricCaseAuthority(): ReturnType<typeof loadFabricCaseAuthority> {
+  cachedFabricCaseAuthority ??= loadFabricCaseAuthority();
+  return cachedFabricCaseAuthority;
+}
+
+function reviewedVerifierManifestDigest(): string {
+  cachedVerifierManifestDigest ??= verifierManifestDigest();
+  return cachedVerifierManifestDigest;
+}
+
+function validateRouteAuthority(subject: PublicRouteSubjectV1): void {
+  const entry = findPublicRouteRegistryEntry(subject.providerId, subject.modelId);
+  if (!entry || !entry.adapterFamilies.includes(subject.adapterFamily)) {
+    throw new PublicEvidenceValidationError("public_authority", "public route is not in reviewed registry authority");
+  }
+}
+
+function validateAssertionAuthority(
+  record: PublicEvidenceRecordV1,
+  assertions: readonly { id: string; required: boolean }[],
+): void {
+  const allowed = new Map(assertions.map((assertion) => [assertion.id, assertion.required] as const));
+  if (allowed.size !== assertions.length) {
+    throw new PublicEvidenceValidationError("public_authority", "reviewed scenario assertion authority contains duplicates");
+  }
+  if (record.assertions.length !== allowed.size) {
+    throw new PublicEvidenceValidationError(
+      "public_authority",
+      "public assertion set does not exactly match reviewed scenario authority",
+    );
+  }
+  const seen = new Set<string>();
+  for (const assertion of record.assertions) {
+    if (seen.has(assertion.id)) {
+      throw new PublicEvidenceValidationError("public_authority", "public assertion set contains duplicate assertion ids");
+    }
+    seen.add(assertion.id);
+    if (!allowed.has(assertion.id) || allowed.get(assertion.id) !== assertion.required) {
+      throw new PublicEvidenceValidationError(
+        "public_authority",
+        "public assertion id/required flag is not in reviewed scenario authority",
+      );
+    }
+  }
+  for (const assertionId of allowed.keys()) {
+    if (!seen.has(assertionId)) {
+      throw new PublicEvidenceValidationError("public_authority", "public assertion set is missing reviewed scenario authority");
+    }
+  }
+}
+
+function validateTaskAuthority(record: PublicEvidenceRecordV1): void {
+  const fabricAuthority = fabricCaseAuthority();
+  const caseRecord = fabricAuthority.cases.find((candidate) => candidate.id === FABRIC_SCENARIO_ID);
+  if (
+    !caseRecord
+    || record.suiteId !== FABRIC_SUITE_ID
+    || record.suiteVersion !== FABRIC_SUITE_VERSION
+    || record.scenarioId !== FABRIC_SCENARIO_ID
+    || record.scenarioVersion !== FABRIC_SCENARIO_VERSION
+    || record.subject.subjectKind !== "task"
+    || record.subject.taskClassId !== FABRIC_TASK_CLASS_ID
+    || record.subject.taskClassVersion !== FABRIC_TASK_CLASS_VERSION
+    || record.subject.taskFixtureDigest !== caseRecord.fixture.digest
+    || record.subject.verifierManifestDigest !== reviewedVerifierManifestDigest()
+    || record.subject.fabricCompatibilityVersion !== FABRIC_COMPATIBILITY_VERSION
+  ) {
+    throw new PublicEvidenceValidationError("public_authority", "task scenario/verifier authority mismatch");
+  }
+  validateAssertionAuthority(record, caseRecord.assertions);
+  validateRouteAuthority(record.subject.route);
+}
+
+function validateScenarioAuthority(record: PublicEvidenceRecordV1): void {
+  if (record.evidenceLayer === "task_effectiveness") {
+    validateTaskAuthority(record);
+    return;
+  }
+
+  const authority = caseAuthorityFor(record);
+  const caseRecord = authority.cases.find((candidate) => candidate.id === record.scenarioId);
+  if (!caseRecord || caseRecord.suite !== record.suiteId) {
+    throw new PublicEvidenceValidationError("public_authority", "scenario/suite authority mismatch");
+  }
+  validateAssertionAuthority(record, caseRecord.assertions);
+
+  if (record.evidenceLayer === "live_route_compatibility") {
+    if (record.subject.subjectKind !== "route") {
+      throw new PublicEvidenceValidationError("public_authority", "live route subject mismatch");
+    }
+    validateRouteAuthority(record.subject);
+  }
+}
+
+/** Repository-owned authority gate used by both local signing and community imports. */
+export function validatePublicEvidenceAuthorities(records: readonly PublicEvidenceRecordV1[]): void {
+  for (const record of records) validateScenarioAuthority(record);
+}
+
+export function validateCommunityEvidenceAuthorities(bundle: PublicEvidenceBundleV1): PublicEvidenceBundleV1 {
+  validatePublicEvidenceAuthorities(bundle.records);
+  return bundle;
+}

package/src/lab/public/community-files.ts

@@ -0,0 +1,29 @@
+const COMMUNITY_ID_FRAGMENT = "[0-9a-f]{64}";
+const COMMUNITY_BUNDLE_FILE_RE = new RegExp(
+  `^bundle-(${COMMUNITY_ID_FRAGMENT})-(${COMMUNITY_ID_FRAGMENT})\\.json$`,
+);
+const COMMUNITY_REVOCATION_FILE_RE = new RegExp(
+  `^revocation-(${COMMUNITY_ID_FRAGMENT})\\.json$`,
+);
+
+export interface CommunityBundleFileIdentity {
+  publisherKeyId: string;
+  bundleId: string;
+}
+
+export function communityBundleFileName(publisherKeyId: string, bundleId: string): string {
+  return `bundle-${publisherKeyId}-${bundleId}.json`;
+}
+
+export function communityRevocationFileName(revocationId: string): string {
+  return `revocation-${revocationId}.json`;
+}
+
+export function parseCommunityBundleFileName(name: string): CommunityBundleFileIdentity | null {
+  const match = COMMUNITY_BUNDLE_FILE_RE.exec(name);
+  return match ? { publisherKeyId: match[1]!, bundleId: match[2]! } : null;
+}
+
+export function isCommunityRevocationFileName(name: string): boolean {
+  return COMMUNITY_REVOCATION_FILE_RE.test(name);
+}

package/src/lab/public/community.ts

@@ -0,0 +1,479 @@
+import { lstatSync, readdirSync, unlinkSync } from "node:fs";
+import { join } from "node:path";
+import { jcsStringify } from "../digest";
+import { ensureLabDirs, labCommunityDir } from "../paths";
+import { validateCommunityEvidenceAuthorities } from "./community-authority";
+import { communityBundleFileName } from "./community-files";
+import { privateRegularFileSize, readPrivateRegularFile } from "./file-safety";
+import { withPublicEvidenceMutationLock } from "./mutation-lock";
+import { recordLocalPublicOrigin } from "./origin";
+import {
+  cleanupStalePrivateFileStages,
+  cleanupStalePrivateFileStagesInDir,
+  isPrivateFileStageName,
+  publishPrivateFileExclusive,
+} from "./private-file";
+import { validatePublicEvidencePrivacy } from "./privacy";
+import { verifyPublicEvidenceRevocation } from "./revocation";
+import { loadExistingPublicPublisher, verifyPublicEvidenceBundle } from "./signature";
+import { parseStrictPublicJson } from "./strict-json";
+import type {
+  CommunityEvidenceSummaryV1,
+  PublicEvidenceBundleV1,
+  PublicEvidenceRevocationV1,
+} from "./types";
+import { PublicEvidenceValidationError } from "./validate";
+
+const MAX_IMPORT_BYTES = 2 * 1024 * 1024;
+const MAX_CACHE_FILES = 512;
+const MAX_CACHE_BYTES = 64 * 1024 * 1024;
+const MAX_DEPTH = 8;
+const MAX_OBJECT_KEYS = 64;
+const MAX_ARRAY_ELEMENTS = 512;
+const MAX_GENERIC_STRING_BYTES = 384 * 1024;
+const COMMUNITY_MUTATION_LOCK_NAME = ".mutation-lock";
+const COMMUNITY_BUNDLE_FILE_RE = /^bundle-([0-9a-f]{64})-([0-9a-f]{64})\.json$/;
+const COMMUNITY_REVOCATION_FILE_RE = /^revocation-([0-9a-f]{64})\.json$/;
+
+const COMMUNITY_FILE_OPTIONS = {
+  maxBytes: MAX_IMPORT_BYTES,
+  errorCode: "community_unsafe_target",
+  errorMessage: "community object is not a bounded private regular file",
+  sizeErrorCode: "community_size",
+  sizeErrorMessage: "community file exceeds bound",
+} as const;
+
+type CommunitySummaryCache = {
+  directory: string;
+  fingerprint: string;
+  evidence: CommunityEvidenceSummaryV1[];
+};
+
+let communitySummaryCache: CommunitySummaryCache | null = null;
+
+function assertId(value: string): string {
+  if (!/^[0-9a-f]{64}$/.test(value)) {
+    throw new PublicEvidenceValidationError("community_id", "community object id invalid");
+  }
+  return value;
+}
+
+function scanStructure(value: unknown, depth = 0): void {
+  if (depth > MAX_DEPTH) {
+    throw new PublicEvidenceValidationError("community_depth", "community JSON nesting depth exceeded");
+  }
+  if (typeof value === "string") {
+    if (new TextEncoder().encode(value).byteLength > MAX_GENERIC_STRING_BYTES || value.includes("\0")) {
+      throw new PublicEvidenceValidationError("community_string", "community string invalid or oversized");
+    }
+    return;
+  }
+  if (Array.isArray(value)) {
+    if (value.length > MAX_ARRAY_ELEMENTS) {
+      throw new PublicEvidenceValidationError("community_array", "community array bound exceeded");
+    }
+    for (const item of value) scanStructure(item, depth + 1);
+    return;
+  }
+  if (value && typeof value === "object") {
+    const keys = Object.keys(value);
+    if (keys.length > MAX_OBJECT_KEYS) {
+      throw new PublicEvidenceValidationError("community_object", "community object key bound exceeded");
+    }
+    for (const key of keys) {
+      if (new TextEncoder().encode(key).byteLength > 4096) {
+        throw new PublicEvidenceValidationError("community_key", "community key oversized");
+      }
+      scanStructure((value as Record<string, unknown>)[key], depth + 1);
+    }
+  }
+}
+
+function boundedInput(raw: unknown): unknown {
+  let bytes: Buffer;
+  if (raw instanceof Uint8Array) {
+    bytes = Buffer.from(raw);
+  } else if (typeof raw === "string") {
+    bytes = Buffer.from(raw, "utf8");
+  } else {
+    scanStructure(raw);
+    bytes = Buffer.from(jcsStringify(raw), "utf8");
+  }
+  if (bytes.byteLength > MAX_IMPORT_BYTES) {
+    throw new PublicEvidenceValidationError("community_size", "community import exceeds 2 MiB");
+  }
+  const parsed = parseStrictPublicJson(bytes, "community import");
+  scanStructure(parsed);
+  return parsed;
+}
+
+function assertCommunityArtifactAuthority(bundle: PublicEvidenceBundleV1): void {
+  if (bundle.artifacts.length !== 0) {
+    throw new PublicEvidenceValidationError(
+      "public_artifact_authority_required",
+      "community artifact bytes require reviewed public_export policy authority",
+    );
+  }
+}
+
+function verifiedBundle(raw: unknown): PublicEvidenceBundleV1 {
+  const result = verifyPublicEvidenceBundle(raw as PublicEvidenceBundleV1);
+  if (result.status !== "cryptographically_valid") {
+    throw new PublicEvidenceValidationError(result.status, "community bundle verification failed");
+  }
+  const bundle = validateCommunityEvidenceAuthorities(raw as PublicEvidenceBundleV1);
+  assertCommunityArtifactAuthority(bundle);
+  validatePublicEvidencePrivacy(bundle);
+  return bundle;
+}
+
+function bundleObjectPath(publisherKeyId: string, bundleId: string, configDir?: string): string {
+  return join(
+    labCommunityDir(configDir),
+    communityBundleFileName(assertId(publisherKeyId), assertId(bundleId)),
+  );
+}
+
+function revocationObjectPath(revocationId: string, configDir?: string): string {
+  return join(labCommunityDir(configDir), `revocation-${assertId(revocationId)}.json`);
+}
+
+function readBounded(path: string): Buffer {
+  cleanupStalePrivateFileStages(path);
+  return readPrivateRegularFile(path, COMMUNITY_FILE_OPTIONS);
+}
+
+function cacheUsage(configDir?: string): { names: string[]; bytes: number } {
+  ensureLabDirs(configDir);
+  const dir = labCommunityDir(configDir);
+  cleanupStalePrivateFileStagesInDir(dir);
+  const names = readdirSync(dir)
+    .filter((name) => name !== COMMUNITY_MUTATION_LOCK_NAME && !isPrivateFileStageName(name))
+    .sort();
+  if (names.length > MAX_CACHE_FILES) {
+    throw new PublicEvidenceValidationError("community_cache_bound", "community cache file bound exceeded");
+  }
+  let bytes = 0;
+  for (const name of names) {
+    bytes += privateRegularFileSize(join(dir, name), COMMUNITY_FILE_OPTIONS);
+    if (bytes > MAX_CACHE_BYTES) {
+      throw new PublicEvidenceValidationError("community_cache_bound", "community cache byte bound exceeded");
+    }
+  }
+  return { names, bytes };
+}
+
+function assertCacheCanAdd(byteCount: number, configDir?: string): void {
+  const usage = cacheUsage(configDir);
+  if (usage.names.length >= MAX_CACHE_FILES || usage.bytes + byteCount > MAX_CACHE_BYTES) {
+    throw new PublicEvidenceValidationError("community_cache_bound", "community cache capacity exceeded");
+  }
+}
+
+function persistAtLocked(
+  path: string,
+  kind: "bundle" | "revocation",
+  value: unknown,
+  configDir?: string,
+  onCommit?: () => void,
+): { path: string; created: boolean } {
+  const bytes = Buffer.from(jcsStringify(value), "utf8");
+  if (bytes.byteLength > MAX_IMPORT_BYTES) {
+    throw new PublicEvidenceValidationError("community_size", "community object exceeds bound");
+  }
+
+  let created = false;
+  try {
+    try {
+      const existing = readBounded(path);
+      if (!existing.equals(bytes)) {
+        throw new PublicEvidenceValidationError("community_conflict", `${kind} identity already exists with different bytes`);
+      }
+    } catch (error) {
+      if (error instanceof PublicEvidenceValidationError) throw error;
+      if ((error as NodeJS.ErrnoException).code !== "ENOENT") throw error;
+      assertCacheCanAdd(bytes.byteLength, configDir);
+      const published = publishPrivateFileExclusive(path, bytes);
+      if (!published.created) {
+        const raced = readBounded(path);
+        if (!raced.equals(bytes)) {
+          throw new PublicEvidenceValidationError("community_conflict", `${kind} identity already exists with different bytes`);
+        }
+      } else {
+        created = true;
+        cacheUsage(configDir);
+      }
+    }
+
+    onCommit?.();
+    if (created) communitySummaryCache = null;
+    return { path, created };
+  } catch (error) {
+    if (created) {
+      try { unlinkSync(path); } catch { /* preserve commit error */ }
+      communitySummaryCache = null;
+    }
+    throw error;
+  }
+}
+
+function persistAt(
+  path: string,
+  kind: "bundle" | "revocation",
+  value: unknown,
+  configDir?: string,
+  onCommit?: () => void,
+): { path: string; created: boolean } {
+  return withPublicEvidenceMutationLock(
+    configDir,
+    () => persistAtLocked(path, kind, value, configDir, onCommit),
+  );
+}
+
+function readJson(path: string): unknown {
+  const parsed = parseStrictPublicJson(readBounded(path), "stored community object");
+  scanStructure(parsed);
+  return parsed;
+}
+
+function files(configDir?: string): string[] {
+  return cacheUsage(configDir).names;
+}
+
+function readVerifiedBundleAt(path: string): PublicEvidenceBundleV1 {
+  return verifiedBundle(readJson(path));
+}
+
+function bundleFromName(name: string, configDir?: string): PublicEvidenceBundleV1 | null {
+  const match = COMMUNITY_BUNDLE_FILE_RE.exec(name);
+  if (!match) return null;
+  const publisherKeyId = match[1]!;
+  const bundleId = match[2]!;
+  const bundle = readVerifiedBundleAt(bundleObjectPath(publisherKeyId, bundleId, configDir));
+  if (bundle.bundleId !== bundleId || bundle.publisher.keyId !== publisherKeyId) {
+    throw new PublicEvidenceValidationError("community_identity_mismatch", "stored community bundle does not match filename identity");
+  }
+  return bundle;
+}
+
+function bundlesFromNames(names: readonly string[], configDir?: string): PublicEvidenceBundleV1[] {
+  const bundles: PublicEvidenceBundleV1[] = [];
+  for (const name of names) {
+    const bundle = bundleFromName(name, configDir);
+    if (bundle) bundles.push(bundle);
+  }
+  return bundles;
+}
+
+function restoreOwnPublisherOrigin(bundle: PublicEvidenceBundleV1, configDir?: string): void {
+  const local = loadExistingPublicPublisher(configDir);
+  if (!local) return;
+  if (
+    local.publisher.algorithm !== bundle.publisher.algorithm
+    || local.publisher.keyId !== bundle.publisher.keyId
+    || local.publisher.publicKey !== bundle.publisher.publicKey
+  ) return;
+  recordLocalPublicOrigin({ publisherKeyId: bundle.publisher.keyId, bundleId: bundle.bundleId }, configDir);
+}
+
+export function importCommunityEvidenceBundle(
+  raw: unknown,
+  configDir?: string,
+): { created: boolean; status: "cryptographically_valid"; bundleId: string; publisherKeyId: string; path: string } {
+  const bundle = verifiedBundle(boundedInput(raw));
+  ensureLabDirs(configDir);
+  const stored = persistAt(
+    bundleObjectPath(bundle.publisher.keyId, bundle.bundleId, configDir),
+    "bundle",
+    bundle,
+    configDir,
+    () => restoreOwnPublisherOrigin(bundle, configDir),
+  );
+  return { ...stored, status: "cryptographically_valid", bundleId: bundle.bundleId, publisherKeyId: bundle.publisher.keyId };
+}
+
+function readCommunityEvidenceBundleForPublisherLocked(
+  bundleId: string,
+  publisherKeyId: string,
+  configDir?: string,
+): PublicEvidenceBundleV1 {
+  const bundle = readVerifiedBundleAt(bundleObjectPath(publisherKeyId, bundleId, configDir));
+  if (bundle.bundleId !== bundleId || bundle.publisher.keyId !== publisherKeyId) {
+    throw new PublicEvidenceValidationError("community_identity_mismatch", "stored community bundle does not match filename identity");
+  }
+  return bundle;
+}
+
+export function readCommunityEvidenceBundleForPublisher(
+  bundleId: string,
+  publisherKeyId: string,
+  configDir?: string,
+): PublicEvidenceBundleV1 {
+  return withPublicEvidenceMutationLock(
+    configDir,
+    () => readCommunityEvidenceBundleForPublisherLocked(bundleId, publisherKeyId, configDir),
+  );
+}
+
+type RevocationMetadata = {
+  publisher?: { keyId?: unknown };
+  targets?: Array<{ kind?: unknown; id?: unknown }>;
+};
+
+function resolveTargetBundle(
+  revocation: unknown,
+  bundles: readonly PublicEvidenceBundleV1[],
+): PublicEvidenceBundleV1 {
+  if (!revocation || typeof revocation !== "object") {
+    throw new PublicEvidenceValidationError("revocation_target", "revocation target metadata unavailable");
+  }
+  const raw = revocation as RevocationMetadata;
+  if (!Array.isArray(raw.targets) || typeof raw.publisher?.keyId !== "string") {
+    throw new PublicEvidenceValidationError("revocation_target", "revocation targets or publisher unavailable");
+  }
+  const publisherKeyId = assertId(raw.publisher.keyId);
+  const publisherBundles = bundles
+    .filter((bundle) => bundle.publisher.keyId === publisherKeyId)
+    .sort((a, b) => a.bundleId.localeCompare(b.bundleId));
+  const bundleTargets = raw.targets.filter((target) => target.kind === "bundle" && typeof target.id === "string");
+  if (bundleTargets.length > 0) {
+    const targetIds = new Set(bundleTargets.map((target) => target.id));
+    if (targetIds.size !== 1) {
+      throw new PublicEvidenceValidationError("revocation_target", "revocation bundle targets are ambiguous");
+    }
+    const id = [...targetIds][0]!;
+    const candidate = publisherBundles.find((bundle) => bundle.bundleId === id);
+    if (!candidate) throw new PublicEvidenceValidationError("revocation_target", "revocation target bundle not found");
+    return candidate;
+  }
+  const fullyMatching = publisherBundles.filter((bundle) => raw.targets!.every((target) =>
+    target.kind === "record" && typeof target.id === "string"
+      && bundle.records.some((record) => record.recordId === target.id),
+  ));
+  if (fullyMatching.length === 0) {
+    throw new PublicEvidenceValidationError(
+      "revocation_target",
+      "revocation targets do not resolve to a verified bundle for the same publisher",
+    );
+  }
+  return fullyMatching[0]!;
+}
+
+function findTargetBundleLocked(revocation: unknown, configDir?: string): PublicEvidenceBundleV1 {
+  const names = files(configDir);
+  const raw = revocation as RevocationMetadata;
+  const publisherKeyId = typeof raw?.publisher?.keyId === "string" ? assertId(raw.publisher.keyId) : null;
+  const directBundleIds = Array.isArray(raw?.targets)
+    ? [...new Set(raw.targets.filter((target) => target.kind === "bundle" && typeof target.id === "string").map((target) => target.id as string))]
+    : [];
+  if (publisherKeyId && directBundleIds.length === 1) {
+    try {
+      return readCommunityEvidenceBundleForPublisherLocked(
+        assertId(directBundleIds[0]!),
+        publisherKeyId,
+        configDir,
+      );
+    } catch (error) {
+      if ((error as NodeJS.ErrnoException).code === "ENOENT") {
+        throw new PublicEvidenceValidationError(
+          "revocation_target",
+          "revocation target bundle not found",
+        );
+      }
+      throw error;
+    }
+  }
+  return resolveTargetBundle(revocation, bundlesFromNames(names, configDir));
+}
+
+export function importCommunityEvidenceRevocation(
+  raw: unknown,
+  configDir?: string,
+): { created: boolean; status: "cryptographically_valid"; revocationId: string; path: string } {
+  const parsed = boundedInput(raw);
+  ensureLabDirs(configDir);
+  return withPublicEvidenceMutationLock(configDir, () => {
+    const targetBundle = findTargetBundleLocked(parsed, configDir);
+    const verified = verifyPublicEvidenceRevocation(parsed, targetBundle);
+    if (verified.status !== "cryptographically_valid") {
+      throw new PublicEvidenceValidationError(verified.status, verified.detail ?? "community revocation verification failed");
+    }
+    const stored = persistAtLocked(
+      revocationObjectPath(verified.revocation.revocationId, configDir),
+      "revocation",
+      verified.revocation,
+      configDir,
+    );
+    return { ...stored, status: "cryptographically_valid", revocationId: verified.revocation.revocationId };
+  });
+}
+
+function communityFingerprint(names: readonly string[], configDir?: string): string {
+  const dir = labCommunityDir(configDir);
+  return names.map((name) => {
+    const stat = lstatSync(join(dir, name));
+    return [name, stat.dev, stat.ino, stat.mode, stat.nlink, stat.size, stat.mtimeMs, stat.ctimeMs].join(":");
+  }).join("\n");
+}
+
+function copySummaries(evidence: readonly CommunityEvidenceSummaryV1[]): CommunityEvidenceSummaryV1[] {
+  return evidence.map((row) => ({ ...row }));
+}
+
+function listCommunityEvidenceLocked(configDir?: string): CommunityEvidenceSummaryV1[] {
+  const names = files(configDir);
+  const directory = labCommunityDir(configDir);
+  const fingerprint = communityFingerprint(names, configDir);
+  if (communitySummaryCache?.directory === directory && communitySummaryCache.fingerprint === fingerprint) {
+    return copySummaries(communitySummaryCache.evidence);
+  }
+
+  const bundles = bundlesFromNames(names, configDir);
+  const revocations: PublicEvidenceRevocationV1[] = [];
+
+  for (const name of names) {
+    if (!COMMUNITY_REVOCATION_FILE_RE.test(name)) continue;
+    const raw = readJson(join(directory, name));
+    let targetBundle: PublicEvidenceBundleV1;
+    try {
+      targetBundle = resolveTargetBundle(raw, bundles);
+    } catch (error) {
+      if (error instanceof PublicEvidenceValidationError) continue;
+      throw error;
+    }
+    const verified = verifyPublicEvidenceRevocation(raw, targetBundle);
+    if (verified.status === "cryptographically_valid") revocations.push(verified.revocation);
+  }
+
+  const evidence = bundles.map((bundle) => {
+    const revoked = new Set<string>();
+    const bundleRecordIds = new Set(bundle.records.map((record) => record.recordId));
+    for (const revocation of revocations) {
+      if (revocation.publisher.keyId !== bundle.publisher.keyId
+        || revocation.publisher.publicKey !== bundle.publisher.publicKey) {
+        continue;
+      }
+      if (revocation.targets.some((target) => target.kind === "bundle" && target.id === bundle.bundleId)) {
+        for (const record of bundle.records) revoked.add(record.recordId);
+      }
+      for (const target of revocation.targets) {
+        if (target.kind === "record" && bundleRecordIds.has(target.id)) revoked.add(target.id);
+      }
+    }
+    return {
+      trustClass: "community_untrusted_v1" as const,
+      status: "cryptographically_valid" as const,
+      bundleId: bundle.bundleId,
+      publisherKeyId: bundle.publisher.keyId,
+      activeRecordCount: bundle.records.filter((record) => !revoked.has(record.recordId)).length,
+      revokedRecordCount: bundle.records.filter((record) => revoked.has(record.recordId)).length,
+    };
+  }).sort((a, b) => a.bundleId.localeCompare(b.bundleId) || a.publisherKeyId.localeCompare(b.publisherKeyId));
+
+  communitySummaryCache = { directory, fingerprint, evidence: copySummaries(evidence) };
+  return copySummaries(evidence);
+}
+
+export function listCommunityEvidence(configDir?: string): CommunityEvidenceSummaryV1[] {
+  return withPublicEvidenceMutationLock(configDir, () => listCommunityEvidenceLocked(configDir));
+}