@mikeargento/bitgraph-player 0.4.0 → 0.5.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mikeargento/bitgraph-player",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "description": "Deterministic evaluation of causal rules over BitGraph proof bundles: a pure function from (rule, verified evidence) to a reproducible verdict.",
   "license": "MIT",
   "type": "module",
@@ -35,10 +35,11 @@
     "node": ">=20"
   },
   "dependencies": {
-    "@mikeargento/bitgraph-audit": "^0.2.0",
-    "@mikeargento/bitgraph-verify": "^1.1.2"
+    "@mikeargento/bitgraph-audit": "^0.2.1",
+    "@mikeargento/bitgraph-verify": "^1.2.0"
   },
   "devDependencies": {
+    "@noble/curves": "^2.3.0",
     "@types/node": "^20.0.0",
     "buffer": "^6.0.3",
     "esbuild": "^0.27.0",

package/src/__tests__/check.test.ts

@@ -159,6 +159,40 @@ describe("check: real export fixture (disk)", () => {
   });
 });
 
+describe("check: a DECLARED recording (agency proof)", () => {
+  /* Ledger position #12,010, the first declaration ever made on the public
+     chain (2026-08-18). It is here because these packages had no real agency
+     proof to test against, and two bugs lived in that gap at once:
+
+       1. the attestation stage compared user_data against computeProofHash,
+          the FROZEN SUBSET that excludes `actor`, instead of the hash of the
+          full signed body the enclave actually attested. Identical for every
+          proof without `actor`/`policy`, so every existing fixture passed;
+       2. the browser verifier's createVerify shim THREW on P-256 rather than
+          checking it, so verify.html reported a valid declared proof as
+          contradicting itself.
+
+     Both turned a good proof FALSE — the failure mode the three-valued rule
+     exists to prevent. Keep this fixture. */
+  const DECLARED = fileURLToPath(new URL("../../src/__tests__/fixtures/declared-12010", import.meta.url));
+
+  it("verifies: signature, attestation binding, and enclave identity all TRUE", async () => {
+    const report = await checkIngest(await ingestBundle(DECLARED));
+    const rec = report.recordings[0]!;
+    assert.equal(rec.lines.find((l) => l.name === "signature")!.result, "TRUE");
+    assert.equal(rec.lines.find((l) => l.name === "attestation")!.result, "TRUE");
+    assert.equal(rec.lines.find((l) => l.name === "enclave")!.result, "TRUE");
+  });
+
+  it("is UNDETERMINED for want of the file, never FALSE", async () => {
+    const report = await checkIngest(await ingestBundle(DECLARED));
+    // The bundle holds no artifact, so the file line cannot decide. That is
+    // the only thing left open, and nothing here contradicts anything.
+    assert.equal(report.result, "UNDETERMINED");
+    assert.deepEqual(report.contradictions, []);
+  });
+});
+
 describe("check: disk and memory ingest produce byte-identical reports (the no-drift guarantee)", () => {
   it("ingestEntries over the same files equals ingestBundle over the directory", async () => {
     const fromDisk = await checkIngest(await ingestBundle(FIXTURE));

package/src/__tests__/fixtures/declared-12010/proof.json

@@ -0,0 +1 @@
+{"version": "bitgraph/1", "artifact": {"hashAlg": "sha256", "digestB64": "szEkIOHMuIaOXlqVG9uqKvaKtmnYmklfzOjEldzFP2E="}, "commit": {"nonceB64": "05pT2TUMA2mJ0iBsQPkOaKFIUa0i4Ta6wdNkqS3jef4=", "counter": "12010", "slotCounter": "12009", "slotHashB64": "VbOoREc4tcmNwFFYmtfenUZ04LNkjP02wQN2okIi81Y=", "epochId": "plJ+9/nhhVEvDE4X4rCjJI+zys0fIov3XT114+mQIpk=", "prevB64": "3TzjHBZWqTMte6FE0BZ0SM7hrcRhFv29Sl4NMf/ZvBs=", "chainId": "bitgraph:main"}, "signer": {"publicKeyB64": "tmp21VjPay+EhaMwmrFLfdjZo2KIjjT7VDqjmm27wHI=", "signatureB64": "96dTfH4EYq1pRvS7zAhVZuiCLsfrlur0QkA4dfkRQZtbkQ8dgebEQn85TOdvvPtk2YYh9pP0k46HWrZuOOYlBg=="}, "environment": {"enforcement": "measured-tee", "measurement": "6483cedffed74680ffb287507744a398b288c3fb943eb3f2e4fe889f8b60b3d575ad8942350360b69a1bd7bf713df27f", "attestation": {"format": "aws-nitro", "reportB64": "hEShATgioFkRI79pbW9kdWxlX2lkeCdpLTA2NTAyNzM0MjNmZjY3NTY3LWVuYzAxYTAxMjJhMTNhMjliOWRmZGlnZXN0ZlNIQTM4NGl0aW1lc3RhbXAbAAABoBasgUtkcGNyc7AAWDBkg87f/tdGgP+yh1B3RKOYsojD+5Q+s/Lk/oifi2Cz1XWtiUI1A2C2mhvXv3E98n8BWDBLTVs2YbPvwSkgkAyA4Sbkzng8Ui3mwCoqW/evOiuTJ7hndvGI5L4cHEBKEp29pJMCWDAynb/jQM5eHKp3DXM2OyH3mevEVlkkmD6tdagU/IUeRoPgtSmfqkazriLTDreBBBkDWDD+UwK5y1gm9uJGWywTP7nx46KUMZGUv4pHEWPSDdx91LwKDPm88/yRbkF8pnByVT4EWDB/NnLXYAC6yWpaRfuiml8mtOMJ0c28NmxuHHZxb2qRGqxwMMGDPYSq4Peo5aubZAIFWDAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGWDAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHWDAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIWDAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAJWDAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAKWDAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALWDAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMWDAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAANWDAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOWDAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPWDAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABrY2VydGlmaWNhdGVZAoAwggJ8MIICAaADAgECAhABoBIqE6KbnQAAAABqhK8tMAoGCCqGSM49BAMDMIGOMQswCQYDVQQGEwJVUzETMBEGA1UECAwKV2FzaGluZ3RvbjEQMA4GA1UEBwwHU2VhdHRsZTEPMA0GA1UECgwGQW1hem9uMQwwCgYDVQQLDANBV1MxOTA3BgNVBAMMMGktMDY1MDI3MzQyM2ZmNjc1NjcudXMtZWFzdC0yLmF3cy5uaXRyby1lbmNsYXZlczAeFw0yNjA4MTgxOTE0NTBaFw0yNjA4MTgyMjE0NTNaMIGTMQswCQYDVQQGEwJVUzETMBEGA1UECAwKV2FzaGluZ3RvbjEQMA4GA1UEBwwHU2VhdHRsZTEPMA0GA1UECgwGQW1hem9uMQwwCgYDVQQLDANBV1MxPjA8BgNVBAMMNWktMDY1MDI3MzQyM2ZmNjc1NjctZW5jMDFhMDEyMmExM2EyOWI5ZC51cy1lYXN0LTIuYXdzMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAExOq6NOiTVmOng2D3lsftqD9D8Z3BVyJKisT/kBoTg8ikZWXTK9mIliMO5mpANmZZ44ZOQdIFr8NdMO91J1XkYLT0HeXeLel1gKK/vC6p/wftvARdv/IRNuQAH6eCGZGaox0wGzAMBgNVHRMBAf8EAjAAMAsGA1UdDwQEAwIGwDAKBggqhkjOPQQDAwNpADBmAjEAvcuYYO03QWT7DFXkFCFLOf5sUFAGmzx73Xrdx4vAL+gdhHGpObgV6vpGb27VtOaRAjEA5iZjc9sFcnqNz0IJmi1+RKCpoKiG3pbRnpbmp//2wA+u6OGVy5xBCSHyoc8H9RXWaGNhYnVuZGxlhFkCFTCCAhEwggGWoAMCAQICEQD5MXVoG5Cv4R1GzLTk5/hWMAoGCCqGSM49BAMDMEkxCzAJBgNVBAYTAlVTMQ8wDQYDVQQKDAZBbWF6b24xDDAKBgNVBAsMA0FXUzEbMBkGA1UEAwwSYXdzLm5pdHJvLWVuY2xhdmVzMB4XDTE5MTAyODEzMjgwNVoXDTQ5MTAyODE0MjgwNVowSTELMAkGA1UEBhMCVVMxDzANBgNVBAoMBkFtYXpvbjEMMAoGA1UECwwDQVdTMRswGQYDVQQDDBJhd3Mubml0cm8tZW5jbGF2ZXMwdjAQBgcqhkjOPQIBBgUrgQQAIgNiAAT8AlTrpgjB82hw4prakL5GODKSc26JS//2ctmJREtQUeU0pLH22+PAvFgaMrexdgcO3hLWmj/qIRtm51LPfdHdCV9vE3D0FwhD2dwQASHkz2MBKAlmRIfJeWKEME3FP/SjQjBAMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFJAltQ3ZBUfnlsOW+nKdz5mp30uWMA4GA1UdDwEB/wQEAwIBhjAKBggqhkjOPQQDAwNpADBmAjEAo38vkaHJvV7nuGJ8FpjSVQOOHwND+VtjqWKMPTmAlUWhHry/LjtV2K7ucbTD1q3zAjEAovObFgWycCil3UugabUBbmW0+96P4AYdalMZf5za9dlDvGH8K+sDy2/ujSMC89/2WQLCMIICvjCCAkWgAwIBAgIRAKtsAlC6OHV9CYvTUvENcuowCgYIKoZIzj0EAwMwSTELMAkGA1UEBhMCVVMxDzANBgNVBAoMBkFtYXpvbjEMMAoGA1UECwwDQVdTMRswGQYDVQQDDBJhd3Mubml0cm8tZW5jbGF2ZXMwHhcNMjYwODE3MDE0ODA3WhcNMjYwOTA2MDI0ODA3WjBkMQswCQYDVQQGEwJVUzEPMA0GA1UECgwGQW1hem9uMQwwCgYDVQQLDANBV1MxNjA0BgNVBAMMLTQyNTI2YTFhMTRlZWI5ZDYudXMtZWFzdC0yLmF3cy5uaXRyby1lbmNsYXZlczB2MBAGByqGSM49AgEGBSuBBAAiA2IABPbYc6802oihPW8f7SrOpe6bX/VEqImWkwKuGdiCNIJw8ODlvV/g/vnbQ6iyc2D/Qso2aFsXnD0xCZKfL4gKXBgYYaIlqyw0FMzFcObLTV02DL6qoZKsRBQy57WBckcWCKOB1TCB0jASBgNVHRMBAf8ECDAGAQH/AgECMB8GA1UdIwQYMBaAFJAltQ3ZBUfnlsOW+nKdz5mp30uWMB0GA1UdDgQWBBTcEEqnhqdhAHqna/UTkRWpDZhoGjAOBgNVHQ8BAf8EBAMCAYYwbAYDVR0fBGUwYzBhoF+gXYZbaHR0cDovL2F3cy1uaXRyby1lbmNsYXZlcy1jcmwuczMuYW1hem9uYXdzLmNvbS9jcmwvYWI0OTYwY2MtN2Q2My00MmJkLTllOWYtNTkzMzhjYjY3Zjg0LmNybDAKBggqhkjOPQQDAwNnADBkAjBkm1yPVIGwMMvdEiKszwMBbivMAY2z6CKOYZucu1XvU377ZjBIPzoJUeFUaXC3HKMCMGVHmmEb5Lp4yrdECCvcjFTTb8orl3Fq/VDpQTxONuTKhjXz/RV9eTCGNsDAKKd341kDGDCCAxQwggKaoAMCAQICEBuJDj5cT8G2aNWhsnOjdNEwCgYIKoZIzj0EAwMwZDELMAkGA1UEBhMCVVMxDzANBgNVBAoMBkFtYXpvbjEMMAoGA1UECwwDQVdTMTYwNAYDVQQDDC00MjUyNmExYTE0ZWViOWQ2LnVzLWVhc3QtMi5hd3Mubml0cm8tZW5jbGF2ZXMwHhcNMjYwODE4MTEwMjA5WhcNMjYwODI0MDUwMjA5WjCBiTE8MDoGA1UEAwwzNDk2MGY5YTZkMWYxZDQ3OS56b25hbC51cy1lYXN0LTIuYXdzLm5pdHJvLWVuY2xhdmVzMQwwCgYDVQQLDANBV1MxDzANBgNVBAoMBkFtYXpvbjELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAldBMRAwDgYDVQQHDAdTZWF0dGxlMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEp5Ii0Fy/Dj72R42Umc1v26GE4a2HVU/O60BaM8vPs/Nhub4NiKvD9BRfqxcxEI3CHvEjLvYCHWsGteFWHAj8BTgo6JaAwHrAVGFvolvlfJmcbzO++0d40g4zGWmTRytVo4HqMIHnMBIGA1UdEwEB/wQIMAYBAf8CAQEwHwYDVR0jBBgwFoAU3BBKp4anYQB6p2v1E5EVqQ2YaBowHQYDVR0OBBYEFOTavrlRQIzZ1jeuQeOiXwEne9+VMA4GA1UdDwEB/wQEAwIBhjCBgAYDVR0fBHkwdzB1oHOgcYZvaHR0cDovL2NybC11cy1lYXN0LTItYXdzLW5pdHJvLWVuY2xhdmVzLnMzLnVzLWVhc3QtMi5hbWF6b25hd3MuY29tL2NybC9iMWJmZTkxYi0xMzc2LTRhOTgtYjcwNy1iMTdmYjgwN2RmNTkuY3JsMAoGCCqGSM49BAMDA2gAMGUCMCZcHgX7NUZTU9ruzZMTpr3LTVrhrqJFGv0l49i9NKW4OR/cyb5K1ik5i0dE5xASagIxALxRwuhFvuCSd7PLcbvvT553iopsomUc49zKqKx8eU8EwaHfIHxfoZMhJ6h50eEuElkCxDCCAsAwggJFoAMCAQICFQDZZTj6v+haQMmAYEs+3bFjha7AkzAKBggqhkjOPQQDAzCBiTE8MDoGA1UEAwwzNDk2MGY5YTZkMWYxZDQ3OS56b25hbC51cy1lYXN0LTIuYXdzLm5pdHJvLWVuY2xhdmVzMQwwCgYDVQQLDANBV1MxDzANBgNVBAoMBkFtYXpvbjELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAldBMRAwDgYDVQQHDAdTZWF0dGxlMB4XDTI2MDgxODE1MDg1MloXDTI2MDgxOTE1MDg1MlowgY4xCzAJBgNVBAYTAlVTMRMwEQYDVQQIDApXYXNoaW5ndG9uMRAwDgYDVQQHDAdTZWF0dGxlMQ8wDQYDVQQKDAZBbWF6b24xDDAKBgNVBAsMA0FXUzE5MDcGA1UEAwwwaS0wNjUwMjczNDIzZmY2NzU2Ny51cy1lYXN0LTIuYXdzLm5pdHJvLWVuY2xhdmVzMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEOGgwVRxvxs/kLVPc3+gCNbkCR1gXXibNxxAX3RINRZ4Lp3a1dGgyb1VdCEfSlbDwd/d2Xgcimi6Mo/d0c0MFxwnwHh0p99vBTKfb0JZk2DhtVcCS6LlpVrbs3f/oZLOco2YwZDASBgNVHRMBAf8ECDAGAQH/AgEAMA4GA1UdDwEB/wQEAwICBDAdBgNVHQ4EFgQUjcTPlUParxYbGA+mJ8bQtz8zTbMwHwYDVR0jBBgwFoAU5Nq+uVFAjNnWN65B46JfASd735UwCgYIKoZIzj0EAwMDaQAwZgIxALMlDm28+2LXsTI+vRIhxHnkiHS2Rwz+kcbbTq/8d/z00mDPAQWFa2or/5M90jsRhQIxAIlvUaKMy704VlQUXVH+vc/tkSXApqj8CoE2gKyRtHLi3JcidkykZ5wvFAqeGKIVgWpwdWJsaWNfa2V59ml1c2VyX2RhdGFYINhJ8ktMcdQVPTfz83OD2U38o0F/VIsxE4P/hR0WwtKuZW5vbmNl9v9YYFzC4t3/xAvXSMRAe4CgqOwHvm001y2bjOWlvXpELp1b6qQM3qLuK2EECbp82/x7z3RoJoWv8VgR9Ch+1K1lA80rgo7vdSPAuK59rfpvHAKPmWbuom8pSdgk7gXY2/wRmg=="}}, "slotAllocation": {"version": "bitgraph/slot/1", "nonceB64": "05pT2TUMA2mJ0iBsQPkOaKFIUa0i4Ta6wdNkqS3jef4=", "counter": "12009", "epochId": "plJ+9/nhhVEvDE4X4rCjJI+zys0fIov3XT114+mQIpk=", "publicKeyB64": "tmp21VjPay+EhaMwmrFLfdjZo2KIjjT7VDqjmm27wHI=", "chainId": "bitgraph:main", "signatureB64": "LlqN1udFVXP9IFxsjwdF6//NMJZbm/IvBmlzDWJ7sfDAqCHD9fSH24w5AM4thFtf0YxMT/n5FedunYYwUQRgCA=="}, "agency": {"actor": {"keyId": "ee0c65174625e065c18e732a226b649a138625ba49c3d7dde026957082035cde", "publicKeyB64": "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEVXEkwZppHxU13Ew9Ap+BQnxQcNXuMvH6KPepQe3t8t1Jh2/aEguB0Ttrzxw9WGxmB8a3AdVVv+ybchgrL8XIRg==", "algorithm": "ES256", "provider": "passkey"}, "authorization": {"purpose": "bitgraph/commit-authorize/v1", "format": "webauthn", "actorKeyId": "ee0c65174625e065c18e732a226b649a138625ba49c3d7dde026957082035cde", "artifactHash": "szEkIOHMuIaOXlqVG9uqKvaKtmnYmklfzOjEldzFP2E=", "challenge": "WzE2FoHLFBQhiwQCpdR8xXA0g1FfOcRCcTEG+1iOJa4=", "timestamp": 1787086799013, "authenticatorDataB64": "Gv0914qYXymsoynDxplniUKsvF16m3HSkeyxwvtTjnsdAAAAAA==", "clientDataJSON": "{\"type\":\"webauthn.get\",\"challenge\":\"WzE2FoHLFBQhiwQCpdR8xXA0g1FfOcRCcTEG-1iOJa4\",\"origin\":\"https://bitgraph.ing\",\"crossOrigin\":false}", "signatureB64": "MEUCIQDBAxBn+pAZcq9YTCVnGcoV6TX+dC1sR1R/0ufz5GSf8gIgMrlaLEPP8f4uFLfTXHT0EA+m85x1LcQNDYqf3557Ktk="}}, "proofHash": "gpbq9mzjkjy9xz7wZAsV+eLk1kwTeOtHogysF5rYS2w="}

package/src/verdict.ts

@@ -31,7 +31,7 @@ import type { DeclaredEntry, Resolution, Rule, Verdict } from "./types.js";
  * A unit test asserts this equals package.json's version, so the
  * constant cannot drift silently across releases.
  */
-export const PLAYER_VERSION = "0.4.0";
+export const PLAYER_VERSION = "0.5.0";
 
 /** The player package's own version. */
 export function playerVersion(): string {