@mikeargento/bitgraph-audit 0.1.0

package/src/validity.ts

@@ -0,0 +1,90 @@
+// Copyright (c) 2024-2026 Mike Argento. Licensed under the MIT License. See LICENSE.
+
+/**
+ * bitgraph-audit intrinsic validity (internal)
+ *
+ * Shared by reconstruction and anomaly classification to answer one
+ * question: is this proof object cryptographically sound on its own
+ * (structure, canonical signature, slot binding, epoch link shape and
+ * successor binding), independent of run-order effects and of any supplied
+ * trust policy?
+ *
+ * Sources, in order:
+ *
+ *   1. The run verification record: "verified" and "artifact-unavailable"
+ *      are intrinsically valid.
+ *   2. Anything else (status "failed", or the verification pass has not
+ *      run) gets an isolated bytes-free recheck through
+ *      verifyProofIntegrity with a fresh epoch link state and no policy.
+ *      This separates order-dependent failures (the epoch link
+ *      single-successor check fails whichever fork consumer verifies
+ *      second) and policy rejections from cryptographic unsoundness.
+ *
+ * The run verification record is never modified: a proof that failed in
+ * the run keeps that status everywhere it is reported. Intrinsic validity
+ * only decides whether the proof may stand as a competing branch in a
+ * divergence or carry a hard lineage edge.
+ *
+ * State discipline: the recheck resets the verify package's module-level
+ * epoch link state before and after each call. Callers therefore run
+ * reconstruction and classification only after verifyObservedProofs has
+ * completed; that pass resets its own state at the start of every run, so
+ * later audit runs are unaffected.
+ */
+
+import { resetEpochLinkState, verifyProofIntegrity } from "@mikeargento/bitgraph-verify";
+import type { ObservedProof } from "./types.js";
+
+const cache = new WeakMap<object, boolean>();
+
+/** See module doc. Results are cached per ObservedProof object. */
+export async function isIntrinsicallyValid(observed: ObservedProof): Promise<boolean> {
+  const status = observed.verification?.status;
+  if (status === "verified" || status === "artifact-unavailable") return true;
+
+  const cached = cache.get(observed);
+  if (cached !== undefined) return cached;
+
+  resetEpochLinkState();
+  let valid = false;
+  try {
+    valid = (await verifyProofIntegrity({ proof: observed.proof })).valid;
+  } catch {
+    valid = false;
+  }
+  resetEpochLinkState();
+
+  cache.set(observed, valid);
+  return valid;
+}
+
+/**
+ * Strict decimal counter parse for topology purposes. Accepts ASCII digit
+ * strings (leading zeros normalize through BigInt); anything else is
+ * treated as no counter evidence. The canonical verifier separately
+ * reports malformed counters on the verification dimension.
+ */
+export function parseCounter(value: string | undefined): bigint | undefined {
+  if (value === undefined || value.length === 0 || !/^[0-9]+$/.test(value)) return undefined;
+  return BigInt(value);
+}
+
+/** Deterministic member order: parseable counter ascending, then canonical hash. */
+export function byCounterThenHash(
+  a: { counter?: string; proofHash: string },
+  b: { counter?: string; proofHash: string }
+): number {
+  const ca = parseCounter(a.counter);
+  const cb = parseCounter(b.counter);
+  if (ca !== undefined && cb !== undefined && ca !== cb) return ca < cb ? -1 : 1;
+  if (ca !== undefined && cb === undefined) return -1;
+  if (ca === undefined && cb !== undefined) return 1;
+  return a.proofHash < b.proofHash ? -1 : a.proofHash > b.proofHash ? 1 : 0;
+}
+
+/** Append to a Map-of-arrays. */
+export function pushMap<K, V>(map: Map<K, V[]>, key: K, value: V): void {
+  const list = map.get(key);
+  if (list === undefined) map.set(key, [value]);
+  else list.push(value);
+}

package/src/verify-tiers.ts

@@ -0,0 +1,137 @@
+// Copyright (c) 2024-2026 Mike Argento. Licensed under the MIT License. See LICENSE.
+
+/**
+ * bitgraph-audit verification tiers
+ *
+ * Applies the canonical verification tiers to every unique observed proof
+ * in an IngestResult:
+ *
+ *   - Artifact bytes present (content-addressed match in the bundle):
+ *     full verification through verify() from @mikeargento/bitgraph-verify,
+ *     with the actual artifact bytes. Status "verified" or "failed" with
+ *     the verifier's exact reason.
+ *   - Artifact bytes absent: verifyProofIntegrity(), the bytes-free
+ *     integrity API. Status "artifact-unavailable" when the checks pass;
+ *     never "verified", because digest matching was not independently
+ *     checked. Status "failed" with the exact reason otherwise.
+ *
+ * All verification semantics live in the verify package; this module only
+ * routes proofs and records results. Verification status and chain
+ * topology are separate dimensions: nothing here reads or writes chain
+ * structure, and chainless proofs (tagged at ingest) verify exactly like
+ * any other proof.
+ *
+ * Ordering and epoch link state: verifyEpochLink() in the verify package
+ * keeps module-level single-successor state, so resetEpochLinkState() is
+ * called exactly once per audit run, before any proof is verified. Within
+ * a run, proofs are verified in a deterministic order: first the
+ * artifact-matched proofs as their artifact bytes stream by (container
+ * order), then the remaining proofs in first-observation order. Re-running
+ * the pass over a re-ingested bundle therefore always reproduces the same
+ * results.
+ */
+
+import {
+  resetEpochLinkState,
+  verify,
+  verifyProofIntegrity,
+} from "@mikeargento/bitgraph-verify";
+import { streamMatchedArtifacts } from "./ingest.js";
+import type {
+  IngestResult,
+  ObservedProof,
+  ProofVerification,
+  VerificationSummary,
+  VerifyObservedOptions,
+} from "./types.js";
+
+/**
+ * Verify every unique observed proof in the ingest result, attaching a
+ * ProofVerification record to each. Idempotent per proof: records already
+ * attached (from a previous call on the same object) are left untouched;
+ * for a fresh deterministic run, re-ingest the bundle first.
+ *
+ * @returns aggregate counts. Per-proof results live on ingest.proofs.
+ */
+export async function verifyObservedProofs(
+  ingest: IngestResult,
+  options?: VerifyObservedOptions
+): Promise<VerificationSummary> {
+  // Fresh single-successor state once per audit run (verify package G7).
+  resetEpochLinkState();
+
+  const trustAnchors = options?.trustAnchors;
+
+  // Index proofs by the hex form of their artifact digest, mirroring the
+  // strict decoding used for artifact matching at ingest. Resolution goes
+  // through a proofHash map so a bundle with many artifacts stays
+  // O(proofs + artifacts + matches); ingest built matchedProofHashes in
+  // first-observation order, so the per-artifact proof order is unchanged.
+  const proofsByHash = new Map<string, ObservedProof>(
+    ingest.proofs.map((p) => [p.proofHash, p])
+  );
+  const byDigestHex = new Map<string, ObservedProof[]>();
+  for (const artifact of ingest.artifacts) {
+    if (artifact.matchedProofHashes.length === 0) continue;
+    const matched = artifact.matchedProofHashes
+      .map((hash) => proofsByHash.get(hash))
+      .filter((p): p is ObservedProof => p !== undefined);
+    byDigestHex.set(artifact.sha256Hex, matched);
+  }
+
+  // Tier 1: full verification for proofs whose artifact bytes are present.
+  for await (const artifact of streamMatchedArtifacts(ingest)) {
+    const proofs = byDigestHex.get(artifact.sha256Hex) ?? [];
+    for (const proof of proofs) {
+      if (proof.verification !== undefined) continue;
+      const result = await verify({
+        proof: proof.proof,
+        bytes: artifact.bytes,
+        ...(trustAnchors !== undefined ? { trustAnchors } : {}),
+      });
+      const record: ProofVerification = {
+        tier: "full",
+        status: result.valid ? "verified" : "failed",
+        ...(result.reason !== undefined ? { reason: result.reason } : {}),
+        artifactPath: artifact.path,
+      };
+      proof.verification = record;
+    }
+  }
+
+  // Tier 2: bytes-free integrity for everything else, in observation order.
+  for (const proof of ingest.proofs) {
+    if (proof.verification !== undefined) continue;
+    const result = await verifyProofIntegrity({
+      proof: proof.proof,
+      ...(trustAnchors !== undefined ? { trustAnchors } : {}),
+    });
+    const record: ProofVerification = {
+      tier: "integrity",
+      status: result.valid ? "artifact-unavailable" : "failed",
+      ...(result.reason !== undefined ? { reason: result.reason } : {}),
+    };
+    proof.verification = record;
+  }
+
+  // Summary.
+  let verified = 0;
+  let failed = 0;
+  let artifactUnavailable = 0;
+  let chainless = 0;
+  for (const proof of ingest.proofs) {
+    const status = proof.verification?.status;
+    if (status === "verified") verified++;
+    else if (status === "failed") failed++;
+    else if (status === "artifact-unavailable") artifactUnavailable++;
+    if (proof.chainless) chainless++;
+  }
+
+  return {
+    total: ingest.proofs.length,
+    verified,
+    failed,
+    artifactUnavailable,
+    chainless,
+  };
+}

package/src/witness.ts

@@ -0,0 +1,407 @@
+// Copyright (c) 2024-2026 Mike Argento. Licensed under the MIT License. See LICENSE.
+
+/**
+ * bitgraph-audit anchor witness verification
+ *
+ * Implements the mandatory procedure of docs/BUNDLE-FORMAT.md section
+ * 10.3, exactly and fully offline:
+ *
+ *   1. Hex-decode headerRlpHex and require a single well-formed RLP list.
+ *   2. Recompute the block hash locally with Keccak-256 (Ethereum's
+ *      original Keccak padding, explicitly NOT FIPS-202 SHA3-256).
+ *   3. Compare against the anchor's SIGNED attribution.message
+ *      (lowercased, full 0x string).
+ *   4. Bind the signed message to the committed artifact: SHA-256 over
+ *      the UTF-8 bytes of the exact signed message string must equal the
+ *      strictly decoded artifact.digestB64.
+ *   5. Cross-check the claimed fields: header RLP index 8 (number)
+ *      against the witness's blockNumber and, when the signed
+ *      attribution.title parses as an Etherscan block URL, against the
+ *      URL; and the witness's claimed blockHash against the recomputed
+ *      hash.
+ *   6. Only then read the timestamp from RLP index 11 as external
+ *      wall-clock evidence.
+ *
+ * Preconditions per the spec: the candidate anchor is identified by its
+ * signed attribution and its own cryptographic verification has
+ * succeeded. A witness cannot rescue an invalid proof. Intrinsic
+ * validity (validity.ts) is used for the precondition, so a run-order
+ * epoch-link artifact never disqualifies a sound anchor, and the run
+ * verification record is never modified.
+ *
+ * Any failure means the witness confers nothing: no timestamp is
+ * reported, and the anchor proof's own standing is unchanged in both
+ * directions. Failure codes are stable AnomalyCode literals.
+ *
+ * Zero network access: witnesses are inbound files, trust in them is
+ * established purely by local recomputation.
+ */
+
+import { sha256 } from "@noble/hashes/sha256";
+import { keccak_256 } from "@noble/hashes/sha3";
+import { bytesToHex0x, decodeRlpList, hexToBytes, rlpBytesToBigInt } from "./rlp.js";
+import { isIntrinsicallyValid } from "./validity.js";
+import type {
+  AnchorIdentification,
+  AnchorWitnessAnalysis,
+  AnchorWitnessFile,
+  AnchorWitnessOutcome,
+  AnomalyCode,
+  AuditFinding,
+  IngestResult,
+  ObservedProof,
+} from "./types.js";
+
+const HEADER_NUMBER_INDEX = 8;
+const HEADER_TIMESTAMP_INDEX = 11;
+const BLOCK_HASH_SHAPE = /^0x[0-9a-fA-F]{64}$/;
+const ETHERSCAN_BLOCK_URL = /^https:\/\/etherscan\.io\/block\/([0-9]+)$/;
+
+// ---------------------------------------------------------------------------
+// Public API
+// ---------------------------------------------------------------------------
+
+/**
+ * Verify every witness file in the bundle against the identified anchors.
+ *
+ * Matching is by block hash: a witness is a candidate for every anchor
+ * whose signed attribution.message equals (case-insensitively) either the
+ * locally recomputed header hash or the witness's claimed blockHash. The
+ * second route exists so a witness with a tampered header still fails
+ * loudly against its intended anchor (witness-hash-mismatch) instead of
+ * disappearing as unmatched. A witness matching no anchor is reported
+ * witness-unmatched.
+ *
+ * Deterministic: witnesses in observation order, candidate anchors in
+ * identification (observation) order. Run after verifyObservedProofs and
+ * identifyAnchors.
+ */
+export async function verifyAnchorWitnesses(
+  ingest: IngestResult,
+  identification: AnchorIdentification
+): Promise<AnchorWitnessAnalysis> {
+  const outcomes: AnchorWitnessOutcome[] = [];
+  const findings: AuditFinding[] = [];
+  const byHash = new Map<string, ObservedProof>(ingest.proofs.map((p) => [p.proofHash, p]));
+
+  for (const witnessFile of ingest.witnesses) {
+    const decoded = decodeWitness(witnessFile);
+    if (decoded.failure !== undefined) {
+      const outcome: AnchorWitnessOutcome = {
+        witnessPath: witnessFile.path,
+        verified: false,
+        reason: decoded.failure.reason,
+        detail: decoded.failure.detail,
+      };
+      outcomes.push(outcome);
+      findings.push(toFinding(outcome));
+      continue;
+    }
+
+    // Candidate anchors by recomputed hash or claimed hash.
+    const computed = decoded.computedHash as string;
+    const claimed = (decoded.claimedHash as string).toLowerCase();
+    const candidates = identification.anchors.filter((anchor) => {
+      const message = anchor.blockHash?.toLowerCase();
+      return message !== undefined && (message === computed || message === claimed);
+    });
+
+    if (candidates.length === 0) {
+      const outcome: AnchorWitnessOutcome = {
+        witnessPath: witnessFile.path,
+        verified: false,
+        reason: "witness-unmatched",
+        detail:
+          "neither the locally recomputed block hash nor the claimed blockHash matches any " +
+          "observed anchor's signed attribution.message",
+        computedBlockHash: computed,
+      };
+      outcomes.push(outcome);
+      findings.push(toFinding(outcome));
+      continue;
+    }
+
+    for (const candidate of candidates) {
+      const anchorProof = byHash.get(candidate.proofHash);
+      const anchorValid = anchorProof !== undefined && (await isIntrinsicallyValid(anchorProof));
+      const outcome = runProcedure(decoded, witnessFile.path, candidate.proofHash, anchorProof, anchorValid);
+      outcomes.push(outcome);
+      if (!outcome.verified) findings.push(toFinding(outcome));
+    }
+  }
+
+  return { outcomes, findings };
+}
+
+/**
+ * Verify one witness file against one specific anchor proof, running the
+ * full spec 10.3 procedure. Exposed for targeted use; the pipeline
+ * (verifyAnchorWitnesses) applies the same procedure with hash-based
+ * matching.
+ */
+export async function verifyAnchorWitness(
+  witnessFile: AnchorWitnessFile,
+  anchorProof: ObservedProof
+): Promise<AnchorWitnessOutcome> {
+  const decoded = decodeWitness(witnessFile);
+  if (decoded.failure !== undefined) {
+    return {
+      witnessPath: witnessFile.path,
+      anchorProofHash: anchorProof.proofHash,
+      verified: false,
+      reason: decoded.failure.reason,
+      detail: decoded.failure.detail,
+    };
+  }
+  const anchorValid = await isIntrinsicallyValid(anchorProof);
+  return runProcedure(decoded, witnessFile.path, anchorProof.proofHash, anchorProof, anchorValid);
+}
+
+// ---------------------------------------------------------------------------
+// Witness decoding (spec 10.3 steps 1 and 2, anchor-independent)
+// ---------------------------------------------------------------------------
+
+interface DecodedWitness {
+  /** Present when decoding failed at or before step 2. */
+  failure?: { reason: AnomalyCode; detail: string };
+  /** 0x + 64 lowercase hex, locally recomputed. */
+  computedHash?: string;
+  /** RLP items of the header list. */
+  items?: ReturnType<typeof decodeRlpList>;
+  claimedHash?: string;
+  claimedNumber?: bigint;
+}
+
+function decodeWitness(witnessFile: AnchorWitnessFile): DecodedWitness {
+  const w = witnessFile.witness;
+
+  // Field rules of spec 10.2.
+  const headerRlpHex = w["headerRlpHex"];
+  if (typeof headerRlpHex !== "string") {
+    return malformed("headerRlpHex is missing or not a string");
+  }
+  const blockNumber = w["blockNumber"];
+  if (typeof blockNumber !== "number" || !Number.isInteger(blockNumber) || blockNumber < 0) {
+    return malformed("blockNumber is missing or not a non-negative integer");
+  }
+  const blockHash = w["blockHash"];
+  if (typeof blockHash !== "string" || !BLOCK_HASH_SHAPE.test(blockHash)) {
+    return malformed("blockHash is missing or not 0x followed by 64 hex characters");
+  }
+
+  // Step 1: hex-decode, then require a single well-formed RLP list.
+  const headerBytes = hexToBytes(headerRlpHex);
+  if (headerBytes === null) {
+    return malformed("headerRlpHex is not 0x-prefixed even-length hex");
+  }
+  let items: ReturnType<typeof decodeRlpList>;
+  try {
+    items = decodeRlpList(headerBytes);
+  } catch (error) {
+    return {
+      failure: {
+        reason: "witness-rlp-invalid",
+        detail: error instanceof Error ? error.message : String(error),
+      },
+    };
+  }
+
+  // Step 2: Keccak-256 over the exact decoded header bytes.
+  const computedHash = bytesToHex0x(keccak_256(headerBytes));
+
+  return {
+    computedHash,
+    items,
+    claimedHash: blockHash,
+    claimedNumber: BigInt(blockNumber),
+  };
+}
+
+function malformed(detail: string): DecodedWitness {
+  return { failure: { reason: "witness-malformed", detail } };
+}
+
+// ---------------------------------------------------------------------------
+// Steps 3 through 6 against one candidate anchor
+// ---------------------------------------------------------------------------
+
+function runProcedure(
+  decoded: DecodedWitness,
+  witnessPath: string,
+  anchorProofHash: string,
+  anchorProof: ObservedProof | undefined,
+  anchorValid: boolean
+): AnchorWitnessOutcome {
+  const computedHash = decoded.computedHash as string;
+  const base = {
+    witnessPath,
+    anchorProofHash,
+    computedBlockHash: computedHash,
+  };
+  const fail = (reason: AnomalyCode, detail: string, extra?: { blockNumber?: string }): AnchorWitnessOutcome => ({
+    ...base,
+    verified: false,
+    reason,
+    detail,
+    ...(extra?.blockNumber !== undefined ? { blockNumber: extra.blockNumber } : {}),
+  });
+
+  // Preconditions: the anchor proof's own cryptographic verification must
+  // have succeeded. A witness cannot rescue an invalid proof.
+  if (anchorProof === undefined || !anchorValid) {
+    return fail(
+      "witness-anchor-invalid",
+      "the candidate anchor proof is not cryptographically valid; the witness confers nothing"
+    );
+  }
+
+  // Step 3: recomputed hash against the SIGNED attribution.message.
+  const message = readSignedMessage(anchorProof);
+  if (message === undefined || message.toLowerCase() !== computedHash) {
+    return fail(
+      "witness-hash-mismatch",
+      message === undefined
+        ? "the anchor carries no signed attribution.message to compare against"
+        : "the locally recomputed block hash does not equal the anchor's signed attribution.message"
+    );
+  }
+
+  // Step 4: bind the signed message string to the committed artifact.
+  // SHA-256 over the exact signed string, no case normalization: the
+  // digest covers the string as signed (bitcoin-anchor.ts hashes the
+  // block-hash STRING).
+  const digest = strictBase64Decode32(readDigestB64(anchorProof));
+  if (digest === null) {
+    return fail(
+      "witness-digest-mismatch",
+      "the anchor's artifact.digestB64 does not strictly decode as base64 of 32 bytes"
+    );
+  }
+  const messageHash = sha256(new TextEncoder().encode(message));
+  if (!bytesEqual(messageHash, digest)) {
+    return fail(
+      "witness-digest-mismatch",
+      "SHA-256 of the exact signed attribution.message string does not equal the anchor's artifact digest"
+    );
+  }
+
+  // Step 5: cross-check the claimed fields.
+  const items = decoded.items as ReturnType<typeof decodeRlpList>;
+  const numberItem = items[HEADER_NUMBER_INDEX];
+  if (numberItem === undefined || !(numberItem instanceof Uint8Array)) {
+    return fail(
+      "witness-header-shape",
+      `header RLP item ${HEADER_NUMBER_INDEX} (block number) is missing or not a byte string`
+    );
+  }
+  const headerNumber = rlpBytesToBigInt(numberItem);
+  if (headerNumber !== decoded.claimedNumber) {
+    return fail(
+      "witness-block-number-mismatch",
+      `the witness claims blockNumber ${decoded.claimedNumber}, but the header's number field is ${headerNumber}`,
+      { blockNumber: String(headerNumber) }
+    );
+  }
+  const title = readSignedTitle(anchorProof);
+  if (title !== undefined) {
+    const urlNumber = ETHERSCAN_BLOCK_URL.exec(title)?.[1];
+    if (urlNumber !== undefined && BigInt(urlNumber) !== headerNumber) {
+      return fail(
+        "witness-block-number-mismatch",
+        `the anchor's signed Etherscan URL names block ${urlNumber}, but the header's number field is ${headerNumber}`,
+        { blockNumber: String(headerNumber) }
+      );
+    }
+  }
+  if ((decoded.claimedHash as string).toLowerCase() !== computedHash) {
+    return fail(
+      "witness-claimed-hash-mismatch",
+      "the witness's claimed blockHash does not equal the locally recomputed block hash",
+      { blockNumber: String(headerNumber) }
+    );
+  }
+
+  // Step 6: only now, read the timestamp.
+  const timestampItem = items[HEADER_TIMESTAMP_INDEX];
+  if (timestampItem === undefined || !(timestampItem instanceof Uint8Array)) {
+    return fail(
+      "witness-header-shape",
+      `header RLP item ${HEADER_TIMESTAMP_INDEX} (timestamp) is missing or not a byte string`,
+      { blockNumber: String(headerNumber) }
+    );
+  }
+  const timestamp = rlpBytesToBigInt(timestampItem);
+  if (timestamp > BigInt(Number.MAX_SAFE_INTEGER)) {
+    return fail(
+      "witness-header-shape",
+      "header timestamp does not fit a safe integer",
+      { blockNumber: String(headerNumber) }
+    );
+  }
+
+  return {
+    ...base,
+    verified: true,
+    blockNumber: String(headerNumber),
+    timestamp: Number(timestamp),
+  };
+}
+
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+
+function readSignedMessage(proof: ObservedProof): string | undefined {
+  return readAttribution(proof, "message");
+}
+
+function readSignedTitle(proof: ObservedProof): string | undefined {
+  return readAttribution(proof, "title");
+}
+
+function readAttribution(proof: ObservedProof, field: string): string | undefined {
+  const attribution = (proof.proof as unknown as Record<string, unknown>)["attribution"];
+  if (attribution === null || typeof attribution !== "object" || Array.isArray(attribution)) {
+    return undefined;
+  }
+  const value = (attribution as Record<string, unknown>)[field];
+  return typeof value === "string" ? value : undefined;
+}
+
+function readDigestB64(proof: ObservedProof): string | undefined {
+  const artifact = (proof.proof as unknown as Record<string, unknown>)["artifact"];
+  if (artifact === null || typeof artifact !== "object" || Array.isArray(artifact)) {
+    return undefined;
+  }
+  const value = (artifact as Record<string, unknown>)["digestB64"];
+  return typeof value === "string" ? value : undefined;
+}
+
+/** Strict standard base64 of exactly 32 bytes (spec 6.3 rules), or null. */
+function strictBase64Decode32(value: string | undefined): Uint8Array | null {
+  if (value === undefined || value.length === 0) return null;
+  const decoded = Buffer.from(value, "base64");
+  if (decoded.length !== 32 || decoded.toString("base64") !== value) return null;
+  return new Uint8Array(decoded);
+}
+
+function bytesEqual(a: Uint8Array, b: Uint8Array): boolean {
+  if (a.length !== b.length) return false;
+  let diff = 0;
+  for (let i = 0; i < a.length; i++) diff |= (a[i] as number) ^ (b[i] as number);
+  return diff === 0;
+}
+
+function toFinding(outcome: AnchorWitnessOutcome): AuditFinding {
+  return {
+    code: outcome.reason as AnomalyCode,
+    path: outcome.witnessPath,
+    message: `anchor witness rejected: ${outcome.detail ?? "verification failed"}. The witness confers nothing; the anchor proof's own standing is unchanged.`,
+    details: {
+      ...(outcome.anchorProofHash !== undefined ? { anchorProofHash: outcome.anchorProofHash } : {}),
+      ...(outcome.computedBlockHash !== undefined
+        ? { computedBlockHash: outcome.computedBlockHash }
+        : {}),
+    },
+  };
+}