@intentius/chant 0.100.0 → 0.101.0

package/src/workspace/trust/dsse.ts

@@ -0,0 +1,134 @@
+/**
+ * DSSE envelopes (https://github.com/secure-systems-lab/dsse, v1) signed with
+ * Ed25519 runner keys (#2553).
+ *
+ * The signature covers the pre-authentication encoding (PAE) of the payload
+ * type and the payload, never the payload alone, so an envelope cannot be
+ * replayed under another type. Everything here runs offline: verifying needs
+ * the envelope and the public key, nothing else.
+ *
+ * Public keys are written the way ssh writes them (`ssh-ed25519 AAAA...`), so
+ * the runner keys in `.chant/trust.json` read like the signers file beside
+ * them, and a key id is the key's ssh fingerprint (`SHA256:...`).
+ */
+
+import { createHash, createPrivateKey, createPublicKey, sign, verify, type KeyObject } from "node:crypto";
+
+export const IN_TOTO_PAYLOAD_TYPE = "application/vnd.in-toto+json";
+
+export interface DsseSignature {
+  keyid: string;
+  sig: string;
+}
+
+export interface DsseEnvelope {
+  payloadType: string;
+  /** Base64 of the payload bytes. */
+  payload: string;
+  signatures: DsseSignature[];
+}
+
+/** DSSE v1 pre-authentication encoding. Lengths are byte lengths in ASCII decimal. */
+export function pae(payloadType: string, payload: Buffer): Buffer {
+  const type = Buffer.from(payloadType, "utf8");
+  return Buffer.concat([Buffer.from(`DSSEv1 ${type.length} `, "utf8"), type, Buffer.from(` ${payload.length} `, "utf8"), payload]);
+}
+
+// ── ssh-ed25519 public keys ──────────────────────────────────────────────────
+
+function sshString(buf: Buffer, at: number): { value: Buffer; next: number } {
+  if (at + 4 > buf.length) throw new Error("truncated key");
+  const len = buf.readUInt32BE(at);
+  if (at + 4 + len > buf.length) throw new Error("truncated key");
+  return { value: buf.subarray(at + 4, at + 4 + len), next: at + 4 + len };
+}
+
+/** The 32 raw bytes of an `ssh-ed25519 <base64>` public key. */
+export function ed25519FromSsh(line: string): Buffer {
+  const [type, b64] = line.trim().split(/\s+/);
+  if (type !== "ssh-ed25519" || !b64) throw new Error("runner keys must be ssh-ed25519 public keys");
+  const blob = Buffer.from(b64, "base64");
+  const t = sshString(blob, 0);
+  if (t.value.toString("utf8") !== "ssh-ed25519") throw new Error("the key blob is not ssh-ed25519");
+  const k = sshString(blob, t.next);
+  if (k.value.length !== 32 || k.next !== blob.length) throw new Error("not a 32-byte ed25519 key");
+  return Buffer.from(k.value);
+}
+
+/** An `ssh-ed25519 <base64>` line for 32 raw public key bytes. */
+export function sshFromEd25519(raw: Buffer): string {
+  const part = (b: Buffer) => {
+    const len = Buffer.alloc(4);
+    len.writeUInt32BE(b.length);
+    return Buffer.concat([len, b]);
+  };
+  return `ssh-ed25519 ${Buffer.concat([part(Buffer.from("ssh-ed25519")), part(raw)]).toString("base64")}`;
+}
+
+/** The ssh fingerprint of a public key line: `SHA256:` and unpadded base64. */
+export function sshFingerprint(line: string): string {
+  const blob = Buffer.from(line.trim().split(/\s+/)[1] ?? "", "base64");
+  return `SHA256:${createHash("sha256").update(blob).digest("base64").replace(/=+$/, "")}`;
+}
+
+function publicKeyObject(line: string): KeyObject {
+  return createPublicKey({ key: { kty: "OKP", crv: "Ed25519", x: ed25519FromSsh(line).toString("base64url") }, format: "jwk" });
+}
+
+/** A private Ed25519 key from PEM (PKCS#8), and its public half as an ssh line. */
+export function loadRunnerKey(pem: string): { key: KeyObject; publicKey: string } {
+  const key = createPrivateKey(pem);
+  if (key.asymmetricKeyType !== "ed25519") throw new Error(`runner keys must be Ed25519, not ${key.asymmetricKeyType}`);
+  const jwk = createPublicKey(key).export({ format: "jwk" }) as { x: string };
+  return { key, publicKey: sshFromEd25519(Buffer.from(jwk.x, "base64url")) };
+}
+
+// ── Sign and verify ──────────────────────────────────────────────────────────
+
+export function signEnvelope(payloadType: string, payload: Buffer, key: KeyObject, publicKey: string): DsseEnvelope {
+  const sig = sign(null, pae(payloadType, payload), key);
+  return { payloadType, payload: payload.toString("base64"), signatures: [{ keyid: sshFingerprint(publicKey), sig: sig.toString("base64") }] };
+}
+
+export interface TrustedKey {
+  principal: string;
+  /** `ssh-ed25519 <base64>`. */
+  key: string;
+}
+
+export type EnvelopeVerdict =
+  | { ok: true; principal: string; keyid: string; payloadType: string; payload: Buffer }
+  | { ok: false; code: "envelope-invalid" | "envelope-untrusted"; reason: string };
+
+/** Verify an envelope against `trusted`. One valid signature by a trusted key is enough. */
+export function verifyEnvelope(envelope: unknown, trusted: readonly TrustedKey[]): EnvelopeVerdict {
+  if (!isEnvelope(envelope)) return { ok: false, code: "envelope-invalid", reason: "not a DSSE envelope: it needs payloadType, payload and signatures" };
+  const payload = Buffer.from(envelope.payload, "base64");
+  if (payload.toString("base64") !== envelope.payload) return { ok: false, code: "envelope-invalid", reason: "the payload is not canonical base64" };
+  const message = pae(envelope.payloadType, payload);
+  const byId = new Map(trusted.map((t) => [sshFingerprint(t.key), t]));
+  for (const s of envelope.signatures) {
+    const t = byId.get(s.keyid);
+    if (!t) continue;
+    let good = false;
+    try {
+      good = verify(null, message, publicKeyObject(t.key), Buffer.from(s.sig, "base64"));
+    } catch {
+      good = false;
+    }
+    if (good) return { ok: true, principal: t.principal, keyid: s.keyid, payloadType: envelope.payloadType, payload };
+  }
+  const ids = envelope.signatures.map((s) => s.keyid).join(", ") || "none";
+  return { ok: false, code: "envelope-untrusted", reason: `no signature verifies against a runner key the policy at base lists (key ids: ${ids})` };
+}
+
+function isEnvelope(v: unknown): v is DsseEnvelope {
+  if (v === null || typeof v !== "object") return false;
+  const e = v as Record<string, unknown>;
+  return (
+    typeof e.payloadType === "string" &&
+    typeof e.payload === "string" &&
+    Array.isArray(e.signatures) &&
+    e.signatures.every((s) => s !== null && typeof s === "object" && typeof (s as DsseSignature).keyid === "string" && typeof (s as DsseSignature).sig === "string")
+  );
+}

package/src/workspace/trust/evidence-cli.ts

@@ -0,0 +1,195 @@
+/**
+ * `chant workspace evidence sign|verify` (#2553): runner evidence over the
+ * records a kind locates, in a DSSE envelope. See ./evidence.ts.
+ *
+ * `sign` runs in CI or in a service, with a runner key the policy at base
+ * lists. It refuses a key the signers file lists: evidence is a machine's
+ * statement, and a developer's key cannot make one. `verify` needs no
+ * network and no key, only the envelope and the repository.
+ *
+ * With `--json`, `verify` prints the `evidence.schema.json` document, and a
+ * refused `sign` prints its failure branch.
+ */
+
+import { readFileSync, writeFileSync } from "node:fs";
+import { formatError, formatSuccess } from "../../cli/format";
+import type { CommandContext } from "../../cli/registry";
+import { readerVersion } from "../declaration";
+import { gitRevisionSource, gitRoot } from "../record-source";
+import { loadRecordKind, readRecords, RecordReadError } from "../records";
+import { loadRunnerKey, type DsseEnvelope } from "./dsse";
+import { buildStatement, signEvidence, verifyEvidence, EVIDENCE_ERROR_CODES, type EvidenceErrorCode, type EvidenceStatement, type EvidenceVerdict } from "./evidence";
+import { policyAtBase, resolveBase } from "./provenance";
+
+export const EVIDENCE_CONTRACT_VERSION = 1;
+export const EVIDENCE_OUTPUT_SCHEMA_ID = "https://intentius.io/chant/schemas/workspace/evidence/v1/evidence.schema.json";
+
+const USAGE =
+  "chant workspace evidence sign --kind <kind file> --key <runner key.pem> --check-id <id> [--claim <file>] [--environment <file>] [--at <rev>] [--base <rev>] [--output <file>] [--json]\n" +
+  "  chant workspace evidence verify --envelope <file> [--at <rev>] [--base <rev>] [--json]";
+
+export interface EvidenceFailure {
+  code: EvidenceErrorCode;
+  message: string;
+}
+
+/** What `evidence verify --json` prints, and a refused `evidence sign --json`. */
+export type EvidenceDocument =
+  | ({ $schema: string; contract: number; chant: string; at: string } & Extract<EvidenceVerdict, { ok: true }>)
+  | { $schema: string; contract: number; chant: string; at: string | null; error: EvidenceFailure };
+
+function head(): { $schema: string; contract: number; chant: string } {
+  return { $schema: EVIDENCE_OUTPUT_SCHEMA_ID, contract: EVIDENCE_CONTRACT_VERSION, chant: readerVersion() };
+}
+
+function report(json: boolean | undefined, at: string | null, error: EvidenceFailure, usage = false): number {
+  if (json) console.log(JSON.stringify({ ...head(), at, error }, null, 2));
+  else console.error(formatError({ message: `${error.message} (${error.code})`, ...(usage ? { hint: USAGE } : {}) }));
+  return 1;
+}
+
+function usage(message: string): number {
+  console.error(formatError({ message, hint: USAGE }));
+  return 1;
+}
+
+function commitOf(repo: string, rev: string): string | undefined {
+  return resolveBase(repo, rev).commit ?? undefined;
+}
+
+export async function runWorkspaceEvidence(ctx: CommandContext): Promise<number> {
+  const { args } = ctx;
+  const sub = args.extraPositional;
+  if (sub !== "sign" && sub !== "verify") return usage(sub ? `Unknown evidence subcommand: ${sub}` : "chant workspace evidence needs sign or verify");
+  const repo = gitRoot(process.cwd());
+  if (!repo) return report(args.json, null, { code: "not-a-git-repository", message: "runner evidence is bound to git commits, and this directory is not in a git repository" });
+  return sub === "sign" ? sign(ctx, repo) : verify(ctx, repo);
+}
+
+export interface SignRequest {
+  repo: string;
+  /** The kind file, resolved against `cwd`. */
+  kind: string;
+  cwd: string;
+  keyPem: string;
+  checkId: string;
+  at?: string;
+  base?: string;
+  claim?: Buffer;
+  environment?: Buffer;
+}
+
+/**
+ * Build and sign evidence, or say why not. Refuses a key the signers file
+ * lists, and a key the policy at base does not list as a runner.
+ */
+export async function signRecordsEvidence(
+  req: SignRequest,
+): Promise<{ envelope: DsseEnvelope; statement: EvidenceStatement; runner: string } | { error: EvidenceFailure }> {
+  const { repo } = req;
+  const at = commitOf(repo, req.at ?? "HEAD");
+  if (!at) return { error: { code: "revision-unknown", message: `--at ${req.at ?? "HEAD"} names no commit` } };
+  const policy = policyAtBase(repo, resolveBase(repo, req.base));
+  if (policy.problems.length > 0) return { error: { code: "trust-policy-unreadable", message: `the policy at base cannot be read: ${policy.problems.join("; ")}` } };
+  let runner;
+  try {
+    runner = loadRunnerKey(req.keyPem);
+  } catch (err) {
+    return { error: { code: "runner-key-invalid", message: `the key is not an Ed25519 private key in PEM: ${err instanceof Error ? err.message : String(err)}` } };
+  }
+  if (policy.signers.some((s) => s.key === runner.publicKey)) {
+    return {
+      error: {
+        code: "runner-key-is-signer",
+        message: `this is a signer's key in ${policy.signersPath}. Runner evidence is signed by a service or CI identity, never by a person's key`,
+      },
+    };
+  }
+  const listed = policy.runners.find((r) => r.key === runner.publicKey);
+  if (!listed) {
+    return { error: { code: "runner-key-unlisted", message: `the policy at base lists no runner with this key. Add it to .chant/trust.json "runners" first:\n  ${runner.publicKey}` } };
+  }
+
+  let paths: string[];
+  try {
+    const loaded = await loadRecordKind(req.kind, req.cwd);
+    const read = await readRecords(loaded, { root: repo, source: gitRevisionSource(repo, at) });
+    paths = read.records.map((r) => r.path);
+  } catch (err) {
+    if (err instanceof RecordReadError && (EVIDENCE_ERROR_CODES as readonly string[]).includes(err.code)) {
+      return { error: { code: err.code as EvidenceErrorCode, message: err.message } };
+    }
+    throw err;
+  }
+  const statement = buildStatement({
+    repo,
+    commit: at,
+    paths,
+    runner: listed.principal,
+    check: req.checkId,
+    ...(req.claim ? { claim: req.claim } : {}),
+    ...(req.environment ? { environment: req.environment } : {}),
+  });
+  return { envelope: signEvidence(statement, runner.key, runner.publicKey), statement, runner: listed.principal };
+}
+
+async function sign(ctx: CommandContext, repo: string): Promise<number> {
+  const { args } = ctx;
+  if (!args.kind || !args.key || !args.checkId) return usage("--kind, --key and --check-id are required");
+  const r = await signRecordsEvidence({
+    repo,
+    kind: args.kind,
+    cwd: process.cwd(),
+    keyPem: readFileSync(args.key, "utf-8"),
+    checkId: args.checkId,
+    at: args.at,
+    base: args.base,
+    ...(args.claim ? { claim: readFileSync(args.claim) } : {}),
+    ...(args.environment ? { environment: readFileSync(args.environment) } : {}),
+  });
+  if ("error" in r) return report(args.json, null, r.error);
+  const envelope = JSON.stringify(r.envelope, null, 2) + "\n";
+  if (args.output) {
+    writeFileSync(args.output, envelope);
+    console.error(formatSuccess(`signed evidence for ${r.statement.subject.length} records at ${r.statement.predicate.commit.slice(0, 8)} as ${r.runner}: ${args.output}`));
+  } else {
+    process.stdout.write(envelope);
+  }
+  return 0;
+}
+
+/** Verify an envelope file at `at` against the runner keys at base, as the document `--json` prints. */
+export function verifyEvidenceFile(repo: string, envelopePath: string, opts: { at?: string; base?: string } = {}): EvidenceDocument {
+  const at = commitOf(repo, opts.at ?? "HEAD");
+  if (!at) return { ...head(), at: null, error: { code: "revision-unknown", message: `--at ${opts.at ?? "HEAD"} names no commit` } };
+  const policy = policyAtBase(repo, resolveBase(repo, opts.base));
+  if (policy.problems.length > 0) {
+    return { ...head(), at, error: { code: "trust-policy-unreadable", message: `the policy at base cannot be read: ${policy.problems.join("; ")}` } };
+  }
+  let envelope: unknown;
+  try {
+    envelope = JSON.parse(readFileSync(envelopePath, "utf-8"));
+  } catch (err) {
+    return { ...head(), at, error: { code: "envelope-unreadable", message: `--envelope ${envelopePath} could not be read as JSON: ${err instanceof Error ? err.message : String(err)}` } };
+  }
+  const verdict = verifyEvidence(envelope, policy.runners, repo, at);
+  if (!verdict.ok) return { ...head(), at, error: { code: verdict.code, message: verdict.reason } };
+  return { ...head(), at, ...verdict };
+}
+
+async function verify(ctx: CommandContext, repo: string): Promise<number> {
+  const { args } = ctx;
+  if (!args.envelope) return usage("--envelope <file> is required");
+  const doc = verifyEvidenceFile(repo, args.envelope, { at: args.at, base: args.base });
+  if ("error" in doc) return report(args.json, doc.at, doc.error);
+  if (args.json) {
+    console.log(JSON.stringify(doc, null, 2));
+  } else {
+    for (const s of doc.subjects) console.log(`  ${s.matches ? "same   " : "changed"}  ${s.name}`);
+    const p = doc.statement.predicate;
+    const line = `evidence from ${doc.runner} (${doc.class}) for check ${p.check} at ${p.commit.slice(0, 8)}: ${doc.status} at ${doc.at.slice(0, 8)}`;
+    if (doc.status === "current") console.log(formatSuccess(line));
+    else console.error(formatError({ message: line, hint: "evidence is not reused for records that changed; run the check again" }));
+  }
+  return doc.status === "current" ? 0 : 1;
+}

package/src/workspace/trust/evidence.test.ts

@@ -0,0 +1,241 @@
+/**
+ * #2553: DSSE runner evidence over record hashes, verified offline against
+ * runner keys read at base. The attacker controls the change: a person's key
+ * posing as a runner, a runner key the change adds, a tampered payload, a
+ * swapped payload type, one runner speaking for another, and records edited
+ * after the evidence was signed.
+ */
+
+import { execFileSync } from "node:child_process";
+import { generateKeyPairSync } from "node:crypto";
+import { readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { afterEach, describe, expect, test } from "vitest";
+import { canonicalJson } from "../../effect-receipt";
+import { loadRunnerKey, pae, signEnvelope, sshFingerprint, ed25519FromSsh, sshFromEd25519, verifyEnvelope, IN_TOTO_PAYLOAD_TYPE } from "./dsse";
+import { EVIDENCE_OUTPUT_SCHEMA_ID, signRecordsEvidence, verifyEvidenceFile } from "./evidence-cli";
+import { contract } from "../__fixtures__/contract-repo";
+import evidenceSchema from "../evidence.schema.json";
+import { verifyEvidence } from "./evidence";
+import { policyAtBase, resolveBase } from "./provenance";
+import { hasSshKeygen, note, TestRepo, writeRecordKind, writeRotation } from "./test-repo";
+
+const repos: TestRepo[] = [];
+afterEach(() => {
+  while (repos.length) repos.pop()!.cleanup();
+});
+
+function runnerKey(): { pem: string; pub: string } {
+  const { privateKey } = generateKeyPairSync("ed25519");
+  const pem = privateKey.export({ format: "pem", type: "pkcs8" }).toString();
+  return { pem, pub: loadRunnerKey(pem).publicKey };
+}
+
+describe("DSSE", () => {
+  test("PAE matches the DSSE v1 test vector", () => {
+    expect(pae("http://example.com/HelloWorld", Buffer.from("hello world")).toString()).toBe("DSSEv1 29 http://example.com/HelloWorld 11 hello world");
+  });
+
+  test.skipIf(!hasSshKeygen)("ssh-ed25519 keys round-trip, and fingerprints match ssh-keygen", () => {
+    const r = new TestRepo("keys");
+    repos.push(r);
+    const k = r.key("k");
+    expect(sshFromEd25519(ed25519FromSsh(k.pub))).toBe(k.pub);
+    const lf = execFileSync("ssh-keygen", ["-l", "-E", "sha256", "-f", `${k.file}.pub`], { encoding: "utf-8" }).split(" ")[1];
+    expect(sshFingerprint(k.pub)).toBe(lf);
+  });
+
+  test("a signature covers the payload type as well as the payload", () => {
+    const k = runnerKey();
+    const { key } = loadRunnerKey(k.pem);
+    const env = signEnvelope(IN_TOTO_PAYLOAD_TYPE, Buffer.from("{}"), key, k.pub);
+    const trusted = [{ principal: "ci", key: k.pub }];
+    expect(verifyEnvelope(env, trusted).ok).toBe(true);
+    expect(verifyEnvelope({ ...env, payloadType: "text/plain" }, trusted).ok).toBe(false);
+    expect(verifyEnvelope({ ...env, payload: Buffer.from("{ }").toString("base64") }, trusted).ok).toBe(false);
+    expect(verifyEnvelope(env, [{ principal: "ci", key: runnerKey().pub }]).ok).toBe(false);
+    expect(verifyEnvelope({ payload: "x" }, trusted).ok).toBe(false);
+  });
+});
+
+describe.skipIf(!hasSshKeygen)("runner evidence", () => {
+  /** main: alice signs; `ci` is a runner key in trust.json; two records. */
+  function setup(label: string) {
+    const r = new TestRepo(label);
+    repos.push(r);
+    const alice = r.key("alice");
+    const ci = runnerKey();
+    const kind = writeRecordKind(r);
+    r.write(".chant/allowed_signers", `alice@example.test ${alice.pub}\n`);
+    r.write(".chant/trust.json", JSON.stringify({ schema: 1, runners: [{ principal: "ci@example.test", class: "runner", key: ci.pub }] }));
+    r.commit("policy", alice);
+    r.write("records/n1.md", note("n1"));
+    r.write("records/n2.md", note("n2"));
+    r.commit("records", alice);
+    return { r, alice, ci, kind };
+  }
+
+  function runners(r: TestRepo) {
+    return policyAtBase(r.dir, resolveBase(r.dir, "main")).runners;
+  }
+
+  async function sign(r: TestRepo, kind: string, pem: string) {
+    return signRecordsEvidence({ repo: r.dir, kind, cwd: r.dir, keyPem: pem, checkId: "schema-lint", base: "main", environment: Buffer.from("node 22") });
+  }
+
+  test("evidence signed by a runner verifies offline, and goes stale when a record changes", async () => {
+    const { r, ci, kind, alice } = setup("good");
+    const s = await sign(r, kind, ci.pem);
+    if ("error" in s) throw new Error(s.error.message);
+    expect(s.statement.subject.map((x) => x.name)).toEqual(["records/n1.md", "records/n2.md"]);
+    expect(s.statement.predicate).toMatchObject({ runner: "ci@example.test", check: "schema-lint", environment: { sha256: expect.any(String) } });
+
+    let v = verifyEvidence(s.envelope, runners(r), r.dir, r.head());
+    expect(v).toMatchObject({ ok: true, status: "current", runner: "ci@example.test", class: "runner" });
+
+    r.write("records/n2.md", note("n2", "edited"));
+    r.commit("edit n2", alice);
+    v = verifyEvidence(s.envelope, runners(r), r.dir, r.head());
+    expect(v.ok && v.status).toBe("stale");
+    expect(v.ok && v.subjects.filter((x) => !x.matches).map((x) => x.name)).toEqual(["records/n2.md"]);
+  });
+
+  test("attack: a person's key cannot sign runner evidence, or be listed as a runner", async () => {
+    const { r, kind, alice } = setup("person");
+    // A developer's own ssh key is not a runner key.
+    const own = await sign(r, kind, readFileSync(alice.file, "utf-8"));
+    expect("error" in own && own.error.code).toBe("runner-key-invalid");
+    // A developer who converts their ed25519 key to PEM is refused by name.
+    const { privateKey } = generateKeyPairSync("ed25519");
+    const pem = privateKey.export({ format: "pem", type: "pkcs8" }).toString();
+    r.write(".chant/allowed_signers", `alice@example.test ${alice.pub}\ndev@example.test ${loadRunnerKey(pem).publicKey}\n`);
+    writeRotation(r, { previousText: `alice@example.test ${alice.pub}\n`, version: 2, by: [["alice@example.test", alice]] });
+    r.write(".chant/trust.json", JSON.stringify({ schema: 1, runners: [{ principal: "ci@example.test", class: "runner", key: loadRunnerKey(pem).publicKey }] }));
+    r.commit("dev key in both places", alice);
+    const dev = await sign(r, kind, pem);
+    expect("error" in dev && dev.error).toMatchObject({ code: "runner-key-is-signer", message: expect.stringMatching(/signer's key/) });
+    // Listing alice's key as a runner at base is refused when the policy is read.
+    r.write(".chant/trust.json", JSON.stringify({ schema: 1, runners: [{ principal: "laptop", class: "runner", key: alice.pub }] }));
+    r.commit("alice as a runner", alice);
+    const policy = policyAtBase(r.dir, resolveBase(r.dir, "main"));
+    expect(policy.runners).toEqual([]);
+    expect(policy.excludedRunners[0].reason).toMatch(/never to a signer/);
+    // A runner entry under a signer's principal is refused as well.
+    r.write(".chant/trust.json", JSON.stringify({ schema: 1, runners: [{ principal: "alice@example.test", class: "service", key: runnerKey().pub }] }));
+    r.commit("alice's name on a runner key", alice);
+    expect(policyAtBase(r.dir, resolveBase(r.dir, "main")).runners).toEqual([]);
+  });
+
+  test("attack: a runner key the change adds is not trusted until merged", async () => {
+    const { r, kind, alice } = setup("added");
+    r.git(["checkout", "-q", "-b", "change"]);
+    const rogue = runnerKey();
+    r.write(".chant/trust.json", JSON.stringify({ schema: 1, runners: [{ principal: "rogue", class: "runner", key: rogue.pub }] }));
+    r.commit("add a runner", alice);
+    const s = await sign(r, kind, rogue.pem);
+    expect("error" in s && s.error).toMatchObject({ code: "runner-key-unlisted", message: expect.stringMatching(/lists no runner with this key/) });
+    // Hand-made evidence with that key fails too.
+    const { key } = loadRunnerKey(rogue.pem);
+    const env = signEnvelope(IN_TOTO_PAYLOAD_TYPE, Buffer.from("{}"), key, rogue.pub);
+    expect(verifyEvidence(env, runners(r), r.dir, r.head())).toMatchObject({ ok: false, code: "envelope-untrusted" });
+  });
+
+  test("attack: one runner cannot put another runner's name in the statement", async () => {
+    const { r, ci, kind } = setup("impersonate");
+    const s = await sign(r, kind, ci.pem);
+    if ("error" in s) throw new Error(s.error.message);
+    const forged = { ...s.statement, predicate: { ...s.statement.predicate, runner: "release@example.test" } };
+    const { key } = loadRunnerKey(ci.pem);
+    const env = signEnvelope(IN_TOTO_PAYLOAD_TYPE, Buffer.from(canonicalJson(forged)), key, ci.pub);
+    const v = verifyEvidence(env, runners(r), r.dir, r.head());
+    expect(v.ok).toBe(false);
+    expect(!v.ok && v.reason).toMatch(/names runner/);
+    expect(!v.ok && v.code).toBe("evidence-runner-mismatch");
+  });
+
+  test("attack: a payload edited after signing does not verify", async () => {
+    const { r, ci, kind } = setup("tamper");
+    const s = await sign(r, kind, ci.pem);
+    if ("error" in s) throw new Error(s.error.message);
+    const statement = JSON.parse(Buffer.from(s.envelope.payload, "base64").toString());
+    statement.subject[0].digest.sha256 = "0".repeat(64);
+    const env = { ...s.envelope, payload: Buffer.from(JSON.stringify(statement)).toString("base64") };
+    expect(verifyEvidence(env, runners(r), r.dir, r.head())).toMatchObject({ ok: false, code: "envelope-untrusted" });
+  });
+
+  test("a removed runner key no longer verifies evidence it signed", async () => {
+    const { r, ci, kind, alice } = setup("revoked");
+    const s = await sign(r, kind, ci.pem);
+    if ("error" in s) throw new Error(s.error.message);
+    r.write(".chant/trust.json", JSON.stringify({ schema: 1 }));
+    r.commit("retire the runner", alice);
+    expect(verifyEvidence(s.envelope, runners(r), r.dir, r.head())).toMatchObject({ ok: false, code: "envelope-untrusted" });
+  });
+
+  test("attack: a statement signed by a listed runner, with a field the predicate does not define or a path outside the repository, is refused", async () => {
+    const { r, ci, kind } = setup("strict");
+    const s = await sign(r, kind, ci.pem);
+    if ("error" in s) throw new Error(s.error.message);
+    const { key } = loadRunnerKey(ci.pem);
+    const extra = { ...s.statement, predicate: { ...s.statement.predicate, reused: true } };
+    const escape = { ...s.statement, subject: [{ name: "../outside.md", digest: { sha256: "0".repeat(64) } }] };
+    for (const forged of [extra, escape]) {
+      const env = signEnvelope(IN_TOTO_PAYLOAD_TYPE, Buffer.from(canonicalJson(forged)), key, ci.pub);
+      expect(verifyEvidence(env, runners(r), r.dir, r.head())).toMatchObject({ ok: false, code: "evidence-statement-invalid" });
+    }
+    const other = signEnvelope("text/plain", Buffer.from(canonicalJson(s.statement)), key, ci.pub);
+    expect(verifyEvidence(other, runners(r), r.dir, r.head())).toMatchObject({ ok: false, code: "evidence-payload-type" });
+    expect(verifyEvidence({ ...s.envelope, payload: "not base64!" }, runners(r), r.dir, r.head())).toMatchObject({ ok: false, code: "envelope-invalid" });
+  });
+
+  test("one runner key under two names, or one name with two keys, is trusted under neither", () => {
+    const { r, alice } = setup("duplicate");
+    const a = runnerKey();
+    const b = runnerKey();
+    r.write(
+      ".chant/trust.json",
+      JSON.stringify({
+        schema: 1,
+        runners: [
+          { principal: "ci@example.test", class: "runner", key: a.pub },
+          { principal: "deploy@example.test", class: "service", key: a.pub },
+          { principal: "nightly@example.test", class: "runner", key: b.pub },
+          { principal: "nightly@example.test", class: "runner", key: runnerKey().pub },
+        ],
+      }),
+    );
+    r.commit("duplicates", alice);
+    const policy = policyAtBase(r.dir, resolveBase(r.dir, "main"));
+    expect(policy.runners).toEqual([]);
+    expect(policy.excludedRunners.map((e) => e.principal)).toEqual(["ci@example.test", "deploy@example.test", "nightly@example.test", "nightly@example.test"]);
+  });
+
+  test("verify --json prints a document evidence.schema.json accepts, for a result and for each refusal", async () => {
+    const { r, ci, kind, alice } = setup("contract");
+    const { expectValid } = contract(evidenceSchema);
+    const s = await sign(r, kind, ci.pem);
+    if ("error" in s) throw new Error(s.error.message);
+    const file = join(r.dir, "evidence.json");
+    writeFileSync(file, JSON.stringify(s.envelope));
+    const good = verifyEvidenceFile(r.dir, file, { base: "main" });
+    expect(good).toMatchObject({ $schema: EVIDENCE_OUTPUT_SCHEMA_ID, contract: 1, status: "current" });
+    expectValid(good);
+
+    writeFileSync(file, "{");
+    const unreadable = verifyEvidenceFile(r.dir, file, { base: "main" });
+    expect("error" in unreadable && unreadable.error.code).toBe("envelope-unreadable");
+    expectValid(unreadable);
+
+    const refused = await sign(r, kind, readFileSync(alice.file, "utf-8"));
+    if (!("error" in refused)) throw new Error("expected a refusal");
+    expectValid({ $schema: EVIDENCE_OUTPUT_SCHEMA_ID, contract: 1, chant: "0.0.0", at: null, error: refused.error });
+
+    // A signer history that breaks at base leaves no runner key trusted.
+    r.write(".chant/allowed_signers", `alice@example.test ${alice.pub}\nmallory@example.test ${r.key("mallory").pub}\n`);
+    r.commit("signers changed with no rotation", alice);
+    writeFileSync(file, JSON.stringify(s.envelope));
+    const broken = verifyEvidenceFile(r.dir, file, { base: "main" });
+    expect("error" in broken && broken.error.code).toBe("trust-policy-unreadable");
+    expectValid(broken);
+  });
+});