@mcp-audit-gateway/core 0.1.0 → 0.4.0

package/test/vectors/generate.mjs

@@ -0,0 +1,354 @@
+import { createHash } from "node:crypto";
+import { writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+
+// Exact replica of canonicalizeRecord from src/attestation/signer.ts
+function canonicalizeRecord(record) {
+  const ordered = [
+    ["id", record.id],
+    ["timestamp", record.timestamp],
+    ["method", record.method],
+    ["toolName", record.toolName ?? null],
+    ["namespace", record.namespace ?? null],
+    ["upstream", record.upstream ?? null],
+    ["principal", record.principal ?? null],
+    ["durationMs", record.durationMs],
+    ["success", record.success],
+    ["errorCode", record.errorCode ?? null],
+    ["previousHash", record.previousHash ?? null],
+  ];
+  return JSON.stringify(ordered);
+}
+
+// Exact replica of hashRecord from src/attestation/audit-log.ts
+function hashRecord(record) {
+  const json = JSON.stringify(record);
+  return { hash: sha256Hex(json), json };
+}
+
+function sha256Hex(input) {
+  return createHash("sha256").update(input).digest("hex");
+}
+
+// --- Canonicalization test vectors ---
+
+const vectorDefs = [
+  {
+    name: "genesis_all_fields",
+    record: {
+      id: "550e8400-e29b-41d4-a716-446655440001",
+      timestamp: "2026-08-21T12:00:00.000Z",
+      method: "tools/call",
+      toolName: "weather_lookup",
+      namespace: "external-apis",
+      upstream: "weather-server",
+      principal: "user:alice@example.com",
+      durationMs: 142,
+      success: true,
+      previousHash: "genesis",
+    },
+  },
+  {
+    name: "genesis_null_optionals",
+    record: {
+      id: "550e8400-e29b-41d4-a716-446655440002",
+      timestamp: "2026-08-21T12:00:01.000Z",
+      method: "tools/list",
+      durationMs: 3,
+      success: true,
+      previousHash: "genesis",
+    },
+  },
+  {
+    name: "error_with_code",
+    record: {
+      id: "550e8400-e29b-41d4-a716-446655440003",
+      timestamp: "2026-08-21T12:00:02.500Z",
+      method: "tools/call",
+      toolName: "database_query",
+      namespace: "internal",
+      upstream: "db-server",
+      principal: "service:backend-agent",
+      durationMs: 5021,
+      success: false,
+      errorCode: -32603,
+      previousHash: "genesis",
+    },
+  },
+  {
+    name: "zero_duration",
+    record: {
+      id: "550e8400-e29b-41d4-a716-446655440004",
+      timestamp: "2026-08-21T12:00:03.000Z",
+      method: "tools/call",
+      toolName: "cache_get",
+      namespace: "infra",
+      upstream: "cache-server",
+      durationMs: 0,
+      success: true,
+      previousHash: "genesis",
+    },
+  },
+  {
+    name: "invalid_params_error",
+    record: {
+      id: "550e8400-e29b-41d4-a716-446655440005",
+      timestamp: "2026-08-21T12:00:04.000Z",
+      method: "tools/call",
+      toolName: "send_email",
+      namespace: "comms",
+      upstream: "email-server",
+      principal: "user:bob@example.com",
+      durationMs: 12,
+      success: false,
+      errorCode: -32602,
+      previousHash: "genesis",
+    },
+  },
+  {
+    name: "unicode_in_fields",
+    record: {
+      id: "550e8400-e29b-41d4-a716-446655440006",
+      timestamp: "2026-08-21T12:00:05.000Z",
+      method: "tools/call",
+      toolName: "天気検索",
+      namespace: "external-apis",
+      upstream: "weather-server-⚡",
+      principal: "user:tanaka.太郎@example.jp",
+      durationMs: 88,
+      success: true,
+      previousHash: "genesis",
+    },
+  },
+  {
+    name: "max_safe_integer_duration",
+    record: {
+      id: "550e8400-e29b-41d4-a716-446655440007",
+      timestamp: "2026-08-21T12:00:06.000Z",
+      method: "tools/call",
+      toolName: "long_running_task",
+      namespace: "compute",
+      upstream: "batch-server",
+      principal: "service:scheduler",
+      durationMs: 9007199254740991,
+      success: true,
+      previousHash: "genesis",
+    },
+  },
+  {
+    name: "empty_string_tool_name",
+    record: {
+      id: "550e8400-e29b-41d4-a716-446655440008",
+      timestamp: "2026-08-21T12:00:07.000Z",
+      method: "tools/call",
+      toolName: "",
+      namespace: "",
+      upstream: "legacy-server",
+      principal: "user:admin",
+      durationMs: 1,
+      success: true,
+      previousHash: "genesis",
+    },
+  },
+];
+
+const canonicalizationVectors = vectorDefs.map(({ name, record }) => {
+  const canonical = canonicalizeRecord(record);
+  return {
+    name,
+    record,
+    canonical,
+    sha256_canonical: sha256Hex(canonical),
+  };
+});
+
+// --- Chain vectors: 3 linked records ---
+
+const chain1 = {
+  id: "660e8400-e29b-41d4-a716-446655440001",
+  timestamp: "2026-08-21T13:00:00.000Z",
+  method: "tools/call",
+  toolName: "search",
+  namespace: "research",
+  upstream: "search-server",
+  principal: "user:carol@example.com",
+  durationMs: 230,
+  success: true,
+  previousHash: "genesis",
+  attestation: "abc123deadbeef",
+};
+
+const { hash: chain1_hash, json: chain1_json } = hashRecord(chain1);
+
+const chain2 = {
+  id: "660e8400-e29b-41d4-a716-446655440002",
+  timestamp: "2026-08-21T13:00:01.500Z",
+  method: "tools/call",
+  toolName: "summarize",
+  namespace: "research",
+  upstream: "llm-server",
+  principal: "user:carol@example.com",
+  durationMs: 1840,
+  success: true,
+  previousHash: chain1_hash,
+  attestation: "def456cafebabe",
+};
+
+const { hash: chain2_hash, json: chain2_json } = hashRecord(chain2);
+
+const chain3 = {
+  id: "660e8400-e29b-41d4-a716-446655440003",
+  timestamp: "2026-08-21T13:00:05.000Z",
+  method: "tools/call",
+  toolName: "store_result",
+  namespace: "research",
+  upstream: "storage-server",
+  principal: "user:carol@example.com",
+  durationMs: 45,
+  success: true,
+  previousHash: chain2_hash,
+  attestation: "789abcfeedface",
+};
+
+const { hash: chain3_hash, json: chain3_json } = hashRecord(chain3);
+
+const chainVectors = {
+  description:
+    "Three linked records demonstrating hash chain verification. The chain hash covers the FULL record including the attestation field. This means the attestation (signature) is bound into the chain sequence.",
+  chain_algorithm: "sha256(JSON.stringify(fullRecord))",
+  chain_key_order: [
+    "id",
+    "timestamp",
+    "method",
+    "toolName",
+    "namespace",
+    "upstream",
+    "principal",
+    "durationMs",
+    "success",
+    "previousHash",
+    "attestation",
+  ],
+  chain_key_order_note:
+    "The chain hash uses JSON.stringify which preserves JavaScript insertion order. Verifiers in languages without ordered maps MUST serialize keys in this exact order to reproduce chain hashes. The canonical form (tuple-array) does NOT have this limitation.",
+  genesis_seed: "genesis",
+  records: [
+    {
+      record: chain1,
+      full_record_json: chain1_json,
+      record_hash: chain1_hash,
+      canonical: canonicalizeRecord(chain1),
+      sha256_canonical: sha256Hex(canonicalizeRecord(chain1)),
+    },
+    {
+      record: chain2,
+      full_record_json: chain2_json,
+      record_hash: chain2_hash,
+      canonical: canonicalizeRecord(chain2),
+      sha256_canonical: sha256Hex(canonicalizeRecord(chain2)),
+      previous_record_hash: chain1_hash,
+    },
+    {
+      record: chain3,
+      full_record_json: chain3_json,
+      record_hash: chain3_hash,
+      canonical: canonicalizeRecord(chain3),
+      sha256_canonical: sha256Hex(canonicalizeRecord(chain3)),
+      previous_record_hash: chain2_hash,
+    },
+  ],
+};
+
+// --- Dual-hash demonstration vector ---
+// Same logical fields, different attestation → same canonical hash, different chain hash
+
+const dualBase = {
+  id: "770e8400-e29b-41d4-a716-446655440001",
+  timestamp: "2026-08-21T14:00:00.000Z",
+  method: "tools/call",
+  toolName: "verify_identity",
+  namespace: "auth",
+  upstream: "identity-server",
+  principal: "user:dave@example.com",
+  durationMs: 55,
+  success: true,
+  previousHash: "genesis",
+};
+
+const dualA = { ...dualBase, attestation: "sig_aaa111" };
+const dualB = { ...dualBase, attestation: "sig_bbb222" };
+
+const dualHashDemo = {
+  description:
+    "Two records with identical auditable fields but different attestation values. They produce the SAME canonical hash (attestation is excluded from signing) but DIFFERENT chain hashes (attestation is included in chain). This demonstrates the dual-hash design.",
+  record_a: {
+    record: dualA,
+    canonical: canonicalizeRecord(dualA),
+    sha256_canonical: sha256Hex(canonicalizeRecord(dualA)),
+    full_record_json: JSON.stringify(dualA),
+    record_hash: sha256Hex(JSON.stringify(dualA)),
+  },
+  record_b: {
+    record: dualB,
+    canonical: canonicalizeRecord(dualB),
+    sha256_canonical: sha256Hex(canonicalizeRecord(dualB)),
+    full_record_json: JSON.stringify(dualB),
+    record_hash: sha256Hex(JSON.stringify(dualB)),
+  },
+  assertions: {
+    canonical_hashes_match:
+      sha256Hex(canonicalizeRecord(dualA)) ===
+      sha256Hex(canonicalizeRecord(dualB)),
+    chain_hashes_differ:
+      sha256Hex(JSON.stringify(dualA)) !== sha256Hex(JSON.stringify(dualB)),
+  },
+};
+
+// --- Assemble output ---
+
+const output = {
+  format_version: "1.1.0",
+  implementation: "mcp-audit-gateway",
+  canonical_form: "tuple-array",
+  description:
+    "Conformance vectors for mcp-audit-gateway's tuple-array canonicalization and SHA-256 hash chain.",
+  encoding: "utf-8",
+  hash_algorithm: "sha256",
+  hash_output: "hex-lowercase",
+  null_rule:
+    "Fields listed in field_order that are absent or undefined in the source record MUST be serialized as JSON null in the tuple-array canonical form.",
+  signing_exclusions: ["attestation"],
+  signing_note:
+    "The attestation field is excluded from the canonical form used for signing. It cannot be included because the signature IS the attestation value (including it would be circular). The canonical form contains exactly the 11 fields listed in field_order.",
+  chain_hash_note:
+    "The chain hash (record_hash) uses JSON.stringify(fullRecord) which INCLUDES the attestation field. This binds the signature into the chain sequence, preventing attestation stripping without breaking the chain. The chain hash depends on JavaScript insertion order; verifiers must serialize keys in the order specified by chain.chain_key_order.",
+  field_order: [
+    "id",
+    "timestamp",
+    "method",
+    "toolName",
+    "namespace",
+    "upstream",
+    "principal",
+    "durationMs",
+    "success",
+    "errorCode",
+    "previousHash",
+  ],
+  canonicalization: canonicalizationVectors,
+  chain: chainVectors,
+  dual_hash_demo: dualHashDemo,
+};
+
+writeFileSync(
+  join(__dirname, "canonicalization.json"),
+  JSON.stringify(output, null, 2) + "\n",
+);
+
+console.log("Generated test/vectors/canonicalization.json");
+console.log(`  ${canonicalizationVectors.length} canonicalization vectors`);
+console.log(`  ${chainVectors.records.length} chain vectors`);
+console.log(`  1 dual-hash demonstration`);

package/test/vectors/verify-checkpoint.mjs

@@ -0,0 +1,344 @@
+#!/usr/bin/env node
+/**
+ * Checkpoint conformance vector verifier (JavaScript).
+ * Verifies that checkpoint canonicalization, chain hashing, and truncation
+ * detection produce byte-identical results across implementations.
+ */
+
+import { createHash } from "node:crypto";
+import { readFile } from "node:fs/promises";
+import { fileURLToPath } from "node:url";
+import { dirname, join } from "node:path";
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const vectors = JSON.parse(await readFile(join(__dirname, "checkpoint.json"), "utf-8"));
+
+let passed = 0;
+let failed = 0;
+
+function sha256(input) {
+  return createHash("sha256").update(input).digest("hex");
+}
+
+function canonicalizeCheckpoint(record) {
+  const ordered = [
+    ["id", record.id],
+    ["type", "checkpoint"],
+    ["timestamp", record.timestamp],
+    ["sequence", record.sequence],
+    ["recordCount", record.recordCount],
+    ["previousHash", record.previousHash],
+  ];
+  if (record.parties != null) {
+    ordered.push(["parties", record.parties]);
+  }
+  return JSON.stringify(ordered);
+}
+
+function hashRecord(record) {
+  return createHash("sha256").update(JSON.stringify(record)).digest("hex");
+}
+
+function assert(condition, name, detail) {
+  if (condition) {
+    passed++;
+    console.log(`  PASS: ${name}`);
+  } else {
+    failed++;
+    console.log(`  FAIL: ${name}`);
+    if (detail) console.log(`        ${detail}`);
+  }
+}
+
+// --- Checkpoint Canonicalization ---
+console.log("\n=== Checkpoint Canonicalization ===");
+for (const vec of vectors.checkpoint_canonicalization) {
+  const canonical = canonicalizeCheckpoint(vec.record);
+  assert(
+    canonical === vec.canonical,
+    `${vec.name} canonical form`,
+    `expected: ${vec.canonical}\n        got:      ${canonical}`
+  );
+  const hash = sha256(canonical);
+  assert(
+    hash === vec.sha256_canonical,
+    `${vec.name} SHA-256`,
+    `expected: ${vec.sha256_canonical}\n        got:      ${hash}`
+  );
+}
+
+// --- Checkpoint Chain ---
+console.log("\n=== Checkpoint Chain ===");
+const chainRecords = vectors.checkpoint_chain.records;
+for (let i = 0; i < chainRecords.length; i++) {
+  const entry = chainRecords[i];
+  const computedHash = hashRecord(entry.record);
+  assert(
+    computedHash === entry.record_hash,
+    `chain record ${i} hash`,
+    `expected: ${entry.record_hash}\n        got:      ${computedHash}`
+  );
+
+  if (i > 0) {
+    assert(
+      entry.record.previousHash === chainRecords[i - 1].record_hash,
+      `chain record ${i} previousHash links to record ${i - 1}`,
+      `expected: ${chainRecords[i - 1].record_hash}\n        got:      ${entry.record.previousHash}`
+    );
+  }
+}
+
+// --- Truncation Detection ---
+console.log("\n=== Truncation Detection ===");
+const truncVec = vectors.truncation_detection;
+const extCkpt = truncVec.external_checkpoint;
+
+// Full chain should contain the checkpoint
+const fullChain = chainRecords.map(e => e.record);
+let foundInFull = false;
+for (const rec of fullChain) {
+  if (rec.type === "checkpoint" &&
+      rec.previousHash === extCkpt.previousHash &&
+      rec.sequence === extCkpt.sequence &&
+      rec.recordCount === extCkpt.recordCount) {
+    foundInFull = true;
+  }
+}
+assert(foundInFull, "full chain contains externalized checkpoint");
+
+// Truncated chain should NOT contain the checkpoint
+const truncatedChain = truncVec.truncated_chain.records_delivered;
+let foundInTruncated = false;
+let hasDescendant = false;
+for (const rec of truncatedChain) {
+  if (rec.type === "checkpoint") {
+    if (rec.previousHash === extCkpt.previousHash &&
+        rec.sequence === extCkpt.sequence &&
+        rec.recordCount === extCkpt.recordCount) {
+      foundInTruncated = true;
+    }
+    if (rec.sequence > extCkpt.sequence) {
+      hasDescendant = true;
+    }
+  }
+}
+assert(!foundInTruncated && !hasDescendant, "truncated chain missing checkpoint (truncation detected)");
+
+// --- canonicalizeValue ---
+console.log("\n=== canonicalizeValue ===");
+
+function canonicalizeValue(value) {
+  if (value === null || value === undefined) return null;
+  switch (typeof value) {
+    case "string":
+      for (let i = 0; i < value.length; i++) {
+        const code = value.charCodeAt(i);
+        if (code >= 0xD800 && code <= 0xDBFF) {
+          const next = i + 1 < value.length ? value.charCodeAt(i + 1) : 0;
+          if (next < 0xDC00 || next > 0xDFFF)
+            throw new Error(`unpaired surrogate at index ${i}`);
+          i++;
+        } else if (code >= 0xDC00 && code <= 0xDFFF) {
+          throw new Error(`unpaired surrogate at index ${i}`);
+        }
+      }
+      return value;
+    case "boolean":
+      return value;
+    case "number":
+      if (!Number.isSafeInteger(value))
+        throw new Error(`unsafe number ${value}`);
+      return value;
+    case "object":
+      if (Array.isArray(value)) return ["L", value.map(canonicalizeValue)];
+      const keys = Object.keys(value).sort().filter(k => value[k] !== undefined);
+      return ["M", keys.map(k => [k, canonicalizeValue(value[k])])];
+    default:
+      throw new Error(`unsupported type ${typeof value}`);
+  }
+}
+
+function computeExtensionsDigest(extensions) {
+  const canonicalized = canonicalizeValue(extensions);
+  const canonical = JSON.stringify(canonicalized);
+  return { canonical, digest: sha256(canonical) };
+}
+
+const cvVectors = vectors.canonicalize_value.vectors;
+for (const vec of cvVectors) {
+  if (vec.expected_error) {
+    if (vec.construct) {
+      // Programmatic construction (e.g. lone surrogate can't be in JSON)
+      let threw = false;
+      try { canonicalizeValue(String.fromCharCode(0xD800)); } catch { threw = true; }
+      assert(threw, `${vec.name} throws on invalid input`);
+    } else {
+      let threw = false;
+      try { canonicalizeValue(vec.input); } catch { threw = true; }
+      assert(threw, `${vec.name} throws on invalid input`);
+    }
+    continue;
+  }
+  if (vec.input_a && vec.input_b && vec.canonical_form) {
+    // Same content different order -> same digest
+    const ra = computeExtensionsDigest(vec.input_a);
+    const rb = computeExtensionsDigest(vec.input_b);
+    assert(ra.canonical === vec.canonical_form, `${vec.name} canonical form`,
+      `expected: ${vec.canonical_form}\n        got:      ${ra.canonical}`);
+    assert(ra.digest === vec.digest, `${vec.name} digest`, `expected: ${vec.digest}\n        got:      ${ra.digest}`);
+    assert(ra.digest === rb.digest, `${vec.name} both inputs produce same digest`);
+  } else if (vec.input_a && vec.input_b && vec.canonical_a) {
+    // Array order matters
+    const ra = computeExtensionsDigest(vec.input_a);
+    const rb = computeExtensionsDigest(vec.input_b);
+    assert(ra.canonical === vec.canonical_a, `${vec.name} canonical_a`);
+    assert(ra.digest === vec.digest_a, `${vec.name} digest_a`);
+    assert(rb.canonical === vec.canonical_b, `${vec.name} canonical_b`);
+    assert(rb.digest === vec.digest_b, `${vec.name} digest_b`);
+    assert(ra.digest !== rb.digest, `${vec.name} digests differ`);
+  } else if (vec.input) {
+    // Unicode keys
+    const r = computeExtensionsDigest(vec.input);
+    assert(r.canonical === vec.canonical_form, `${vec.name} canonical form`,
+      `expected: ${vec.canonical_form}\n        got:      ${r.canonical}`);
+    assert(r.digest === vec.digest, `${vec.name} digest`,
+      `expected: ${vec.digest}\n        got:      ${r.digest}`);
+  }
+}
+
+// --- Extensions Digest ---
+console.log("\n=== Extensions Digest ===");
+const extVectors = vectors.extensions_digest.vectors;
+
+for (const vec of extVectors) {
+  const { canonical, digest } = computeExtensionsDigest(vec.extensions);
+  assert(
+    canonical === vec.canonical_form,
+    `${vec.name} canonical form`,
+    `expected: ${vec.canonical_form}\n        got:      ${canonical}`
+  );
+  assert(
+    digest === vec.digest,
+    `${vec.name} digest`,
+    `expected: ${vec.digest}\n        got:      ${digest}`
+  );
+}
+
+// Record canonicalization with extensionsDigest
+function canonicalizeRecord(record) {
+  const ordered = [
+    ["id", record.id],
+    ["timestamp", record.timestamp],
+    ["method", record.method],
+    ["toolName", record.toolName ?? null],
+    ["namespace", record.namespace ?? null],
+    ["upstream", record.upstream ?? null],
+    ["principal", record.principal ?? null],
+    ["durationMs", record.durationMs],
+    ["success", record.success],
+    ["errorCode", record.errorCode ?? null],
+    ["previousHash", record.previousHash ?? null],
+  ];
+  let insertAt = 11;
+  if (record.decisionContextDigest != null) {
+    ordered.splice(10, 0, ["decisionContextDigest", record.decisionContextDigest]);
+    insertAt = 12;
+  }
+  if (record.extensionsDigest != null) {
+    ordered.splice(insertAt, 0, ["extensionsDigest", record.extensionsDigest]);
+    insertAt++;
+  }
+  if (record.aiInvocation != null) {
+    ordered.splice(insertAt, 0, ["aiInvocation", canonicalizeValue(record.aiInvocation)]);
+    insertAt++;
+  }
+  if (record.parties != null) {
+    ordered.splice(insertAt, 0, ["parties", record.parties]);
+  }
+  return JSON.stringify(ordered);
+}
+
+const withExt = vectors.extensions_digest.record_canonicalization.with_extensions_digest;
+const withExtCanonical = canonicalizeRecord(withExt.record);
+assert(
+  withExtCanonical === withExt.canonical,
+  "record with extensionsDigest canonical form",
+  `expected: ${withExt.canonical}\n        got:      ${withExtCanonical}`
+);
+assert(
+  sha256(withExtCanonical) === withExt.sha256_canonical,
+  "record with extensionsDigest SHA-256",
+  `expected: ${withExt.sha256_canonical}\n        got:      ${sha256(withExtCanonical)}`
+);
+
+const withoutExt = vectors.extensions_digest.record_canonicalization.without_extensions_digest;
+const withoutExtCanonical = canonicalizeRecord(withoutExt.record);
+assert(
+  withoutExtCanonical === withoutExt.canonical,
+  "record without extensionsDigest canonical form (backward compat)",
+  `expected: ${withoutExt.canonical}\n        got:      ${withoutExtCanonical}`
+);
+assert(
+  sha256(withoutExtCanonical) === withoutExt.sha256_canonical,
+  "record without extensionsDigest SHA-256",
+  `expected: ${withoutExt.sha256_canonical}\n        got:      ${sha256(withoutExtCanonical)}`
+);
+
+// --- Rotation Boundary ---
+console.log("\n=== Rotation Boundary ===");
+const rotation = vectors.rotation_boundary;
+
+// Verify file 1 hashes
+for (let i = 0; i < rotation.file_1_records.length; i++) {
+  const entry = rotation.file_1_records[i];
+  const h = hashRecord(entry.record);
+  assert(h === entry.record_hash, `rotation file1 record ${i} hash`,
+    `expected: ${entry.record_hash}\n        got:      ${h}`);
+}
+
+// Verify file 2 chains to file 1's last record
+const file1LastHash = rotation.file_1_records[rotation.file_1_records.length - 1].record_hash;
+const file2First = rotation.file_2_records[0];
+assert(
+  file2First.record.previousHash === file1LastHash,
+  "rotation: file2 first record chains to file1 last hash",
+  `expected: ${file1LastHash}\n        got:      ${file2First.record.previousHash}`
+);
+const file2Hash = hashRecord(file2First.record);
+assert(file2Hash === file2First.record_hash, "rotation file2 record 0 hash",
+  `expected: ${file2First.record_hash}\n        got:      ${file2Hash}`);
+
+// --- Sequence Regression ---
+console.log("\n=== Sequence Regression ===");
+const seqReg = vectors.sequence_regression;
+const checkpoints = seqReg.chain.filter(e => e.record.type === "checkpoint");
+let regressionDetected = false;
+for (let i = 1; i < checkpoints.length; i++) {
+  if (checkpoints[i].record.sequence <= checkpoints[i - 1].record.sequence) {
+    regressionDetected = true;
+  }
+}
+assert(regressionDetected, "sequence regression detected in chain");
+assert(
+  seqReg.detection_result.failureCode === "sequence_regression",
+  "failure code is sequence_regression"
+);
+
+// --- Chain Break ---
+console.log("\n=== Chain Break ===");
+const chainBreak = vectors.chain_break;
+for (let i = 0; i < chainBreak.records.length; i++) {
+  const entry = chainBreak.records[i];
+  const h = hashRecord(entry.record);
+  assert(h === entry.record_hash, `chain_break record ${i} hash`,
+    `expected: ${entry.record_hash}\n        got:      ${h}`);
+}
+// Verify chaining: second record's previousHash = first record's hash
+assert(
+  chainBreak.records[1].record.previousHash === chainBreak.records[0].record_hash,
+  "record after chain_break chains from break record hash"
+);
+
+// --- Summary ---
+console.log(`\n=== Results: ${passed} passed, ${failed} failed (${passed + failed} total) ===`);
+process.exit(failed > 0 ? 1 : 0);