@mikeargento/bitgraph-verify 1.8.0 → 1.9.0

package/dist/index.d.ts

@@ -19,4 +19,6 @@ export type { FuseMemberCategory, FuseSetEvidence, FuseMemberOptions, FuseMember
 export { SET2_PLACEMENT_ID, SET_MEMBER_METADATA_KEY, MAX_SET2_MEMBERS, canonicalSetRow, setLeaf, sortSetMembers, buildSetTree, setMemberPath, buildSetRoot, parseSetRoot, buildSetMemberProof, parseSetMemberProof, setRootFromMember } from "./fuse.js";
 export type { SetRoot, SetMemberProof } from "./fuse.js";
 export { merkleLeafHash, merkleNodeHash, merkleRoot, merklePath, merkleRootFromPath, MerkleTree } from "./fuse-merkle.js";
+export { verifyRun, readRunAttribution, runAttribution, RUN_PROFILE, RUN_ENCODING_BASE64URL } from "./run.js";
+export type { RunCategory, RunMarker, RunVerifyResult, RunVerifyOptions } from "./run.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA;;;;;;GAMG;AAEH,YAAY,EACV,aAAa,EACb,cAAc,EACd,kBAAkB,EAClB,UAAU,EACV,eAAe,EACf,WAAW,EACX,aAAa,EACb,cAAc,EACd,aAAa,EACb,oBAAoB,EACpB,qBAAqB,EACrB,cAAc,GACf,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAE,MAAM,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AAClF,YAAY,EAAE,YAAY,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAExE,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,eAAe,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAE7G,OAAO,EAAE,YAAY,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAGvF,OAAO,EACL,YAAY,EACZ,WAAW,EACX,qBAAqB,EACrB,aAAa,EACb,cAAc,EACd,uBAAuB,EACvB,uBAAuB,EACvB,UAAU,EACV,YAAY,EACZ,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,EAChB,eAAe,EACf,iBAAiB,EACjB,qBAAqB,EACrB,sBAAsB,EACtB,qBAAqB,EACrB,gBAAgB,EAChB,gBAAgB,EAChB,eAAe,EACf,mBAAmB,EACnB,YAAY,EACZ,UAAU,EACV,UAAU,EACV,eAAe,EACf,aAAa,EACb,aAAa,EACb,UAAU,EACV,UAAU,EACV,UAAU,GACX,MAAM,WAAW,CAAC;AACnB,YAAY,EAAE,WAAW,EAAE,SAAS,EAAE,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,UAAU,EAAE,YAAY,EAAE,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvJ,OAAO,EAAE,UAAU,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AACpE,YAAY,EAAE,YAAY,EAAE,QAAQ,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACpG,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,YAAY,EAAE,kBAAkB,EAAE,eAAe,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACjH,OAAO,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,gBAAgB,EAAE,eAAe,EAAE,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,YAAY,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AACzP,YAAY,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AACzD,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,UAAU,EAAE,UAAU,EAAE,kBAAkB,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA;;;;;;GAMG;AAEH,YAAY,EACV,aAAa,EACb,cAAc,EACd,kBAAkB,EAClB,UAAU,EACV,eAAe,EACf,WAAW,EACX,aAAa,EACb,cAAc,EACd,aAAa,EACb,oBAAoB,EACpB,qBAAqB,EACrB,cAAc,GACf,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAE,MAAM,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AAClF,YAAY,EAAE,YAAY,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAExE,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,eAAe,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAE7G,OAAO,EAAE,YAAY,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAGvF,OAAO,EACL,YAAY,EACZ,WAAW,EACX,qBAAqB,EACrB,aAAa,EACb,cAAc,EACd,uBAAuB,EACvB,uBAAuB,EACvB,UAAU,EACV,YAAY,EACZ,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,EAChB,eAAe,EACf,iBAAiB,EACjB,qBAAqB,EACrB,sBAAsB,EACtB,qBAAqB,EACrB,gBAAgB,EAChB,gBAAgB,EAChB,eAAe,EACf,mBAAmB,EACnB,YAAY,EACZ,UAAU,EACV,UAAU,EACV,eAAe,EACf,aAAa,EACb,aAAa,EACb,UAAU,EACV,UAAU,EACV,UAAU,GACX,MAAM,WAAW,CAAC;AACnB,YAAY,EAAE,WAAW,EAAE,SAAS,EAAE,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,UAAU,EAAE,YAAY,EAAE,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvJ,OAAO,EAAE,UAAU,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AACpE,YAAY,EAAE,YAAY,EAAE,QAAQ,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACpG,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,YAAY,EAAE,kBAAkB,EAAE,eAAe,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACjH,OAAO,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,gBAAgB,EAAE,eAAe,EAAE,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,YAAY,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AACzP,YAAY,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AACzD,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,UAAU,EAAE,UAAU,EAAE,kBAAkB,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAM1H,OAAO,EAAE,SAAS,EAAE,kBAAkB,EAAE,cAAc,EAAE,WAAW,EAAE,sBAAsB,EAAE,MAAM,UAAU,CAAC;AAC9G,YAAY,EAAE,WAAW,EAAE,SAAS,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC"}

package/dist/index.js

@@ -8,4 +8,9 @@ export { verifyFuse, assembledAfterCommit } from "./fuse-verify.js";
 export { verifyFuseMember } from "./fuse-member.js";
 export { SET2_PLACEMENT_ID, SET_MEMBER_METADATA_KEY, MAX_SET2_MEMBERS, canonicalSetRow, setLeaf, sortSetMembers, buildSetTree, setMemberPath, buildSetRoot, parseSetRoot, buildSetMemberProof, parseSetMemberProof, setRootFromMember } from "./fuse.js";
 export { merkleLeafHash, merkleNodeHash, merkleRoot, merklePath, merkleRootFromPath, MerkleTree } from "./fuse-merkle.js";
+// BitGraph Run (profile bitgraph-run/1): an artifact MADE with its slot
+// commitment inside it, rather than wrapped around an original afterwards.
+// Fuse rebuilds from an original; a run has none, so the check is that the
+// commitment the enclave signed is present in the committed bytes.
+export { verifyRun, readRunAttribution, runAttribution, RUN_PROFILE, RUN_ENCODING_BASE64URL } from "./run.js";
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,qFAAqF;AAyBrF,OAAO,EAAE,MAAM,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AAGlF,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,eAAe,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAE7G,OAAO,EAAE,YAAY,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAEvF,gFAAgF;AAChF,OAAO,EACL,YAAY,EACZ,WAAW,EACX,qBAAqB,EACrB,aAAa,EACb,cAAc,EACd,uBAAuB,EACvB,uBAAuB,EACvB,UAAU,EACV,YAAY,EACZ,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,EAChB,eAAe,EACf,iBAAiB,EACjB,qBAAqB,EACrB,sBAAsB,EACtB,qBAAqB,EACrB,gBAAgB,EAChB,gBAAgB,EAChB,eAAe,EACf,mBAAmB,EACnB,YAAY,EACZ,UAAU,EACV,UAAU,EACV,eAAe,EACf,aAAa,EACb,aAAa,EACb,UAAU,EACV,UAAU,EACV,UAAU,GACX,MAAM,WAAW,CAAC;AAEnB,OAAO,EAAE,UAAU,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAEpE,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAEpD,OAAO,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,gBAAgB,EAAE,eAAe,EAAE,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,YAAY,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAEzP,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,UAAU,EAAE,UAAU,EAAE,kBAAkB,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,qFAAqF;AAyBrF,OAAO,EAAE,MAAM,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AAGlF,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,eAAe,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAE7G,OAAO,EAAE,YAAY,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAEvF,gFAAgF;AAChF,OAAO,EACL,YAAY,EACZ,WAAW,EACX,qBAAqB,EACrB,aAAa,EACb,cAAc,EACd,uBAAuB,EACvB,uBAAuB,EACvB,UAAU,EACV,YAAY,EACZ,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,EAChB,eAAe,EACf,iBAAiB,EACjB,qBAAqB,EACrB,sBAAsB,EACtB,qBAAqB,EACrB,gBAAgB,EAChB,gBAAgB,EAChB,eAAe,EACf,mBAAmB,EACnB,YAAY,EACZ,UAAU,EACV,UAAU,EACV,eAAe,EACf,aAAa,EACb,aAAa,EACb,UAAU,EACV,UAAU,EACV,UAAU,GACX,MAAM,WAAW,CAAC;AAEnB,OAAO,EAAE,UAAU,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAEpE,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAEpD,OAAO,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,gBAAgB,EAAE,eAAe,EAAE,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,YAAY,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAEzP,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,UAAU,EAAE,UAAU,EAAE,kBAAkB,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAE1H,wEAAwE;AACxE,2EAA2E;AAC3E,2EAA2E;AAC3E,mEAAmE;AACnE,OAAO,EAAE,SAAS,EAAE,kBAAkB,EAAE,cAAc,EAAE,WAAW,EAAE,sBAAsB,EAAE,MAAM,UAAU,CAAC"}

package/dist/run.d.ts

@@ -0,0 +1,59 @@
+import type { BitGraphProof, VerificationPolicy } from "./types.js";
+import { type FuseSpan } from "./fuse-verify.js";
+/** The signed profile id: attribution.name on a run proof. */
+export declare const RUN_PROFILE = "bitgraph-run/1";
+/**
+ * The only encoding this build registers: the commitment as unpadded base64url
+ * ASCII, the form a producer pastes into a prompt, a message or a header. It is
+ * attribution.title on a run proof.
+ */
+export declare const RUN_ENCODING_BASE64URL = "base64url";
+export type RunCategory = "RUN_CONFIRMED" | "COMMITMENT_ABSENT" | "INVALID_SLOT_COMMITMENT" | "INVALID_UNDERLYING_PROOF" | "UNDETERMINED_ENCODING" | "NOT_A_RUN";
+export interface RunMarker {
+    /** attribution.title: how the commitment appears in the bytes. */
+    encoding: string | null;
+    /** attribution.message: the commitment the producer declared, as written. */
+    declaredCommitment: string | null;
+}
+export interface RunVerifyResult {
+    category: RunCategory;
+    /** The underlying bitgraph/1 verification, reported on its own. */
+    proof: {
+        valid: boolean;
+        reason?: string;
+    };
+    marker: RunMarker | null;
+    /** Recomputed from the proof's slot record; null when the proof carries none. */
+    slotCommitmentB64u: string | null;
+    /** Byte offset of the first occurrence in the artifact, or null when absent. */
+    offset: number | null;
+    /** How many times it appears. One is the ordinary case; more is not an error. */
+    occurrences: number;
+    artifactDigestB64: string;
+    fileDigestB64: string;
+    span: FuseSpan | null;
+    /** What this result establishes, bounded. */
+    statements: string[];
+    /** What it does not establish, stated so nothing has to be inferred. */
+    limits: string[];
+    reason: string | null;
+}
+export interface RunVerifyOptions {
+    proof: BitGraphProof;
+    bytes: Uint8Array;
+    trustAnchors?: VerificationPolicy;
+}
+/** The marker a run proof carries, or null when it is not a run proof. */
+export declare function readRunAttribution(proof: BitGraphProof): RunMarker | null;
+/** The attribution a producer sends when committing a run. */
+export declare function runAttribution(commitment: Uint8Array | string): {
+    name: string;
+    title: string;
+    message: string;
+};
+/**
+ * Verify a bitgraph-run/1 artifact from its own bytes. Nothing here touches the
+ * network, and nothing is rebuilt: a run has no original to rebuild from.
+ */
+export declare function verifyRun(opts: RunVerifyOptions): Promise<RunVerifyResult>;
+//# sourceMappingURL=run.d.ts.map

package/dist/run.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"run.d.ts","sourceRoot":"","sources":["../src/run.ts"],"names":[],"mappings":"AAoCA,OAAO,KAAK,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAGpE,OAAO,EAAU,KAAK,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAEzD,8DAA8D;AAC9D,eAAO,MAAM,WAAW,mBAAmB,CAAC;AAE5C;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,cAAc,CAAC;AAElD,MAAM,MAAM,WAAW,GACnB,eAAe,GACf,mBAAmB,GACnB,yBAAyB,GACzB,0BAA0B,GAC1B,uBAAuB,GACvB,WAAW,CAAC;AAEhB,MAAM,WAAW,SAAS;IACxB,kEAAkE;IAClE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,6EAA6E;IAC7E,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;CACnC;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,WAAW,CAAC;IACtB,mEAAmE;IACnE,KAAK,EAAE;QAAE,KAAK,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC3C,MAAM,EAAE,SAAS,GAAG,IAAI,CAAC;IACzB,iFAAiF;IACjF,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,gFAAgF;IAChF,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,iFAAiF;IACjF,WAAW,EAAE,MAAM,CAAC;IACpB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,aAAa,EAAE,MAAM,CAAC;IACtB,IAAI,EAAE,QAAQ,GAAG,IAAI,CAAC;IACtB,6CAA6C;IAC7C,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,wEAAwE;IACxE,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,aAAa,CAAC;IACrB,KAAK,EAAE,UAAU,CAAC;IAClB,YAAY,CAAC,EAAE,kBAAkB,CAAC;CACnC;AAKD,0EAA0E;AAC1E,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,aAAa,GAAG,SAAS,GAAG,IAAI,CAOzE;AAED,8DAA8D;AAC9D,wBAAgB,cAAc,CAAC,UAAU,EAAE,UAAU,GAAG,MAAM,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAMhH;AA0BD;;;GAGG;AACH,wBAAsB,SAAS,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,eAAe,CAAC,CA8DhF"}

package/dist/run.js

@@ -0,0 +1,147 @@
+/**
+ * BitGraph Run (profile bitgraph-run/1): an artifact that was MADE with its
+ * slot commitment inside it, rather than wrapped around an original afterwards.
+ *
+ * Fuse and Run are the two ways an artifact can carry its commitment, and they
+ * differ in what a verifier can do about it:
+ *
+ *   fuse  the commitment was written into the bytes of an existing file, in a
+ *         registered placement, so a verifier holding the ORIGINAL can rebuild
+ *         the committed artifact byte for byte. The placement is the recipe.
+ *   run   there is no original and no recipe. The producer asked for a slot,
+ *         put the commitment into the thing it was about to make, and committed
+ *         the digest of what came out. A model prompt, a build id, a commit
+ *         message, a signed payload: the commitment is an ingredient, not a
+ *         wrapper, so there is nothing to rebuild from.
+ *
+ * What this file checks, and only this:
+ *
+ *   1. the underlying bitgraph/1 proof verifies against these exact bytes
+ *   2. the marker is present and names an encoding this build knows
+ *   3. the commitment recomputed from the proof's own slot record equals the
+ *      one the signed marker declares
+ *   4. that commitment, in the declared encoding, appears in the artifact's
+ *      bytes, and where
+ *
+ * Together those establish that the bytes were assembled after the enclave
+ * signed the slot, because they contain a value the enclave generated and
+ * nobody could predict. They do NOT establish that the commitment was an INPUT
+ * to the production rather than inserted at the end: a producer who appends the
+ * string to a finished file passes every check here, and that producer has
+ * really just done a hand-rolled fuse. The distinction matters for how it reads
+ * to a human (an acrostic on the commitment is evidence of conditioning; a
+ * trailing line is not), and this file says so rather than implying otherwise.
+ * `statements` carries the bound; `limits` carries what is not shown.
+ */
+import { sha256 } from "@noble/hashes/sha256";
+import { verify } from "./verifier.js";
+import { computeSlotCommitment } from "./fuse.js";
+import { spanOf } from "./fuse-verify.js";
+/** The signed profile id: attribution.name on a run proof. */
+export const RUN_PROFILE = "bitgraph-run/1";
+/**
+ * The only encoding this build registers: the commitment as unpadded base64url
+ * ASCII, the form a producer pastes into a prompt, a message or a header. It is
+ * attribution.title on a run proof.
+ */
+export const RUN_ENCODING_BASE64URL = "base64url";
+const b64 = (b) => Buffer.from(b).toString("base64");
+const b64u = (b) => b64(b).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+/** The marker a run proof carries, or null when it is not a run proof. */
+export function readRunAttribution(proof) {
+    const a = proof.attribution;
+    if (a === undefined || a.name !== RUN_PROFILE)
+        return null;
+    return {
+        encoding: typeof a.title === "string" && a.title.length > 0 ? a.title : null,
+        declaredCommitment: typeof a.message === "string" && a.message.length > 0 ? a.message : null,
+    };
+}
+/** The attribution a producer sends when committing a run. */
+export function runAttribution(commitment) {
+    return {
+        name: RUN_PROFILE,
+        title: RUN_ENCODING_BASE64URL,
+        message: typeof commitment === "string" ? commitment : b64u(commitment),
+    };
+}
+/** Every byte offset at which `needle` occurs in `haystack`. */
+function findAll(haystack, needle) {
+    const out = [];
+    if (needle.length === 0 || needle.length > haystack.length)
+        return out;
+    outer: for (let i = 0; i + needle.length <= haystack.length; i++) {
+        for (let j = 0; j < needle.length; j++)
+            if (haystack[i + j] !== needle[j])
+                continue outer;
+        out.push(i);
+    }
+    return out;
+}
+function statementsFor(category, span, offset) {
+    if (span === null || category !== "RUN_CONFIRMED")
+        return [];
+    return [
+        `The enclave signed the slot at position ${span.slotCounter} before this artifact's digest reached it.`,
+        `These exact bytes contain that slot's commitment, first at byte ${offset}, so they were assembled after the slot existed and were committed at position ${span.commitCounter}.`,
+    ];
+}
+const LIMITS = [
+    "Containing the commitment does not show it was an input to the artifact's production: bytes appended to a finished file pass the same check. What the commitment was to the work is the producer's claim, not this result's.",
+    "Nothing here bounds the artifact from above in wall-clock time. The position bound is the commit position; a clock comes only from an anchor.",
+];
+/**
+ * Verify a bitgraph-run/1 artifact from its own bytes. Nothing here touches the
+ * network, and nothing is rebuilt: a run has no original to rebuild from.
+ */
+export async function verifyRun(opts) {
+    const { proof, bytes, trustAnchors } = opts;
+    const fileDigestB64 = b64(sha256(bytes));
+    const artifactDigestB64 = proof.artifact?.digestB64 ?? "";
+    const span = spanOf(proof);
+    const marker = readRunAttribution(proof);
+    const base = (category, extra, reason) => ({
+        category,
+        proof: extra.proof ?? { valid: false, reason: "not run" },
+        marker,
+        slotCommitmentB64u: extra.slotCommitmentB64u ?? null,
+        offset: extra.offset ?? null,
+        occurrences: extra.occurrences ?? 0,
+        artifactDigestB64,
+        fileDigestB64,
+        span,
+        statements: statementsFor(category, span, extra.offset ?? null),
+        limits: category === "RUN_CONFIRMED" ? LIMITS : [],
+        reason,
+    });
+    if (marker === null) {
+        return base("NOT_A_RUN", {}, `the proof carries no ${RUN_PROFILE} attribution`);
+    }
+    let pv;
+    try {
+        pv = await verify(trustAnchors === undefined ? { proof, bytes } : { proof, bytes, trustAnchors });
+    }
+    catch (e) {
+        pv = { valid: false, reason: e.message };
+    }
+    if (!pv.valid) {
+        return base("INVALID_UNDERLYING_PROOF", { proof: pv }, pv.reason ?? "the underlying proof does not verify against these bytes");
+    }
+    if (marker.encoding !== RUN_ENCODING_BASE64URL) {
+        return base("UNDETERMINED_ENCODING", { proof: pv }, `the marker names encoding "${marker.encoding ?? "none"}", which this build does not register`);
+    }
+    const slot = proof.slotAllocation;
+    if (slot === undefined) {
+        return base("INVALID_SLOT_COMMITMENT", { proof: pv }, "the proof carries no slot record, so the commitment cannot be recomputed");
+    }
+    const slotCommitmentB64u = b64u(computeSlotCommitment(slot));
+    if (marker.declaredCommitment !== slotCommitmentB64u) {
+        return base("INVALID_SLOT_COMMITMENT", { proof: pv, slotCommitmentB64u }, `the signed marker declares commitment ${marker.declaredCommitment ?? "none"}, but this proof's slot record commits to ${slotCommitmentB64u}`);
+    }
+    const hits = findAll(bytes, new TextEncoder().encode(slotCommitmentB64u));
+    if (hits.length === 0) {
+        return base("COMMITMENT_ABSENT", { proof: pv, slotCommitmentB64u }, "the artifact's bytes do not contain the commitment in the declared encoding");
+    }
+    return base("RUN_CONFIRMED", { proof: pv, slotCommitmentB64u, offset: hits[0] ?? null, occurrences: hits.length }, null);
+}
+//# sourceMappingURL=run.js.map

package/dist/run.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"run.js","sourceRoot":"","sources":["../src/run.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAE9C,OAAO,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AACvC,OAAO,EAAE,qBAAqB,EAAE,MAAM,WAAW,CAAC;AAClD,OAAO,EAAE,MAAM,EAAiB,MAAM,kBAAkB,CAAC;AAEzD,8DAA8D;AAC9D,MAAM,CAAC,MAAM,WAAW,GAAG,gBAAgB,CAAC;AAE5C;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,WAAW,CAAC;AA4ClD,MAAM,GAAG,GAAG,CAAC,CAAa,EAAU,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AACzE,MAAM,IAAI,GAAG,CAAC,CAAa,EAAU,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAE1G,0EAA0E;AAC1E,MAAM,UAAU,kBAAkB,CAAC,KAAoB;IACrD,MAAM,CAAC,GAAG,KAAK,CAAC,WAAW,CAAC;IAC5B,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,CAAC,IAAI,KAAK,WAAW;QAAE,OAAO,IAAI,CAAC;IAC3D,OAAO;QACL,QAAQ,EAAE,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI;QAC5E,kBAAkB,EAAE,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI;KAC7F,CAAC;AACJ,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,cAAc,CAAC,UAA+B;IAC5D,OAAO;QACL,IAAI,EAAE,WAAW;QACjB,KAAK,EAAE,sBAAsB;QAC7B,OAAO,EAAE,OAAO,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC;KACxE,CAAC;AACJ,CAAC;AAED,gEAAgE;AAChE,SAAS,OAAO,CAAC,QAAoB,EAAE,MAAkB;IACvD,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM,GAAG,QAAQ,CAAC,MAAM;QAAE,OAAO,GAAG,CAAC;IACvE,KAAK,EAAE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACjE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE;YAAE,IAAI,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC;gBAAE,SAAS,KAAK,CAAC;QAC1F,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACd,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,aAAa,CAAC,QAAqB,EAAE,IAAqB,EAAE,MAAqB;IACxF,IAAI,IAAI,KAAK,IAAI,IAAI,QAAQ,KAAK,eAAe;QAAE,OAAO,EAAE,CAAC;IAC7D,OAAO;QACL,2CAA2C,IAAI,CAAC,WAAW,4CAA4C;QACvG,mEAAmE,MAAM,kFAAkF,IAAI,CAAC,aAAa,GAAG;KACjL,CAAC;AACJ,CAAC;AAED,MAAM,MAAM,GAAG;IACb,8NAA8N;IAC9N,+IAA+I;CAChJ,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,IAAsB;IACpD,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,GAAG,IAAI,CAAC;IAC5C,MAAM,aAAa,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACzC,MAAM,iBAAiB,GAAG,KAAK,CAAC,QAAQ,EAAE,SAAS,IAAI,EAAE,CAAC;IAC1D,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC3B,MAAM,MAAM,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;IAEzC,MAAM,IAAI,GAAG,CAAC,QAAqB,EAAE,KAA+B,EAAE,MAAqB,EAAmB,EAAE,CAAC,CAAC;QAChH,QAAQ;QACR,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE;QACzD,MAAM;QACN,kBAAkB,EAAE,KAAK,CAAC,kBAAkB,IAAI,IAAI;QACpD,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,IAAI;QAC5B,WAAW,EAAE,KAAK,CAAC,WAAW,IAAI,CAAC;QACnC,iBAAiB;QACjB,aAAa;QACb,IAAI;QACJ,UAAU,EAAE,aAAa,CAAC,QAAQ,EAAE,IAAI,EAAE,KAAK,CAAC,MAAM,IAAI,IAAI,CAAC;QAC/D,MAAM,EAAE,QAAQ,KAAK,eAAe,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;QAClD,MAAM;KACP,CAAC,CAAC;IAEH,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,OAAO,IAAI,CAAC,WAAW,EAAE,EAAE,EAAE,wBAAwB,WAAW,cAAc,CAAC,CAAC;IAClF,CAAC;IAED,IAAI,EAAuC,CAAC;IAC5C,IAAI,CAAC;QACH,EAAE,GAAG,MAAM,MAAM,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC;IACpG,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAG,CAAW,CAAC,OAAO,EAAE,CAAC;IACtD,CAAC;IACD,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;QACd,OAAO,IAAI,CAAC,0BAA0B,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,MAAM,IAAI,0DAA0D,CAAC,CAAC;IAClI,CAAC;IAED,IAAI,MAAM,CAAC,QAAQ,KAAK,sBAAsB,EAAE,CAAC;QAC/C,OAAO,IAAI,CAAC,uBAAuB,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,8BAA8B,MAAM,CAAC,QAAQ,IAAI,MAAM,uCAAuC,CAAC,CAAC;IACtJ,CAAC;IAED,MAAM,IAAI,GAAG,KAAK,CAAC,cAAc,CAAC;IAClC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO,IAAI,CAAC,yBAAyB,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,0EAA0E,CAAC,CAAC;IACpI,CAAC;IACD,MAAM,kBAAkB,GAAG,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC;IAC7D,IAAI,MAAM,CAAC,kBAAkB,KAAK,kBAAkB,EAAE,CAAC;QACrD,OAAO,IAAI,CACT,yBAAyB,EACzB,EAAE,KAAK,EAAE,EAAE,EAAE,kBAAkB,EAAE,EACjC,yCAAyC,MAAM,CAAC,kBAAkB,IAAI,MAAM,6CAA6C,kBAAkB,EAAE,CAC9I,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,CAAC;IAC1E,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO,IAAI,CACT,mBAAmB,EACnB,EAAE,KAAK,EAAE,EAAE,EAAE,kBAAkB,EAAE,EACjC,6EAA6E,CAC9E,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC,eAAe,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,kBAAkB,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,IAAI,CAAC,CAAC;AAC3H,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mikeargento/bitgraph-verify",
-  "version": "1.8.0",
+  "version": "1.9.0",
   "description": "Offline verification of BitGraph proofs. Permissionless by design.",
   "license": "MIT",
   "type": "module",

package/src/index.ts

@@ -72,3 +72,10 @@ export type { FuseMemberCategory, FuseSetEvidence, FuseMemberOptions, FuseMember
 export { SET2_PLACEMENT_ID, SET_MEMBER_METADATA_KEY, MAX_SET2_MEMBERS, canonicalSetRow, setLeaf, sortSetMembers, buildSetTree, setMemberPath, buildSetRoot, parseSetRoot, buildSetMemberProof, parseSetMemberProof, setRootFromMember } from "./fuse.js";
 export type { SetRoot, SetMemberProof } from "./fuse.js";
 export { merkleLeafHash, merkleNodeHash, merkleRoot, merklePath, merkleRootFromPath, MerkleTree } from "./fuse-merkle.js";
+
+// BitGraph Run (profile bitgraph-run/1): an artifact MADE with its slot
+// commitment inside it, rather than wrapped around an original afterwards.
+// Fuse rebuilds from an original; a run has none, so the check is that the
+// commitment the enclave signed is present in the committed bytes.
+export { verifyRun, readRunAttribution, runAttribution, RUN_PROFILE, RUN_ENCODING_BASE64URL } from "./run.js";
+export type { RunCategory, RunMarker, RunVerifyResult, RunVerifyOptions } from "./run.js";

package/src/run.ts

@@ -0,0 +1,206 @@
+/**
+ * BitGraph Run (profile bitgraph-run/1): an artifact that was MADE with its
+ * slot commitment inside it, rather than wrapped around an original afterwards.
+ *
+ * Fuse and Run are the two ways an artifact can carry its commitment, and they
+ * differ in what a verifier can do about it:
+ *
+ *   fuse  the commitment was written into the bytes of an existing file, in a
+ *         registered placement, so a verifier holding the ORIGINAL can rebuild
+ *         the committed artifact byte for byte. The placement is the recipe.
+ *   run   there is no original and no recipe. The producer asked for a slot,
+ *         put the commitment into the thing it was about to make, and committed
+ *         the digest of what came out. A model prompt, a build id, a commit
+ *         message, a signed payload: the commitment is an ingredient, not a
+ *         wrapper, so there is nothing to rebuild from.
+ *
+ * What this file checks, and only this:
+ *
+ *   1. the underlying bitgraph/1 proof verifies against these exact bytes
+ *   2. the marker is present and names an encoding this build knows
+ *   3. the commitment recomputed from the proof's own slot record equals the
+ *      one the signed marker declares
+ *   4. that commitment, in the declared encoding, appears in the artifact's
+ *      bytes, and where
+ *
+ * Together those establish that the bytes were assembled after the enclave
+ * signed the slot, because they contain a value the enclave generated and
+ * nobody could predict. They do NOT establish that the commitment was an INPUT
+ * to the production rather than inserted at the end: a producer who appends the
+ * string to a finished file passes every check here, and that producer has
+ * really just done a hand-rolled fuse. The distinction matters for how it reads
+ * to a human (an acrostic on the commitment is evidence of conditioning; a
+ * trailing line is not), and this file says so rather than implying otherwise.
+ * `statements` carries the bound; `limits` carries what is not shown.
+ */
+import { sha256 } from "@noble/hashes/sha256";
+import type { BitGraphProof, VerificationPolicy } from "./types.js";
+import { verify } from "./verifier.js";
+import { computeSlotCommitment } from "./fuse.js";
+import { spanOf, type FuseSpan } from "./fuse-verify.js";
+
+/** The signed profile id: attribution.name on a run proof. */
+export const RUN_PROFILE = "bitgraph-run/1";
+
+/**
+ * The only encoding this build registers: the commitment as unpadded base64url
+ * ASCII, the form a producer pastes into a prompt, a message or a header. It is
+ * attribution.title on a run proof.
+ */
+export const RUN_ENCODING_BASE64URL = "base64url";
+
+export type RunCategory =
+  | "RUN_CONFIRMED"
+  | "COMMITMENT_ABSENT"
+  | "INVALID_SLOT_COMMITMENT"
+  | "INVALID_UNDERLYING_PROOF"
+  | "UNDETERMINED_ENCODING"
+  | "NOT_A_RUN";
+
+export interface RunMarker {
+  /** attribution.title: how the commitment appears in the bytes. */
+  encoding: string | null;
+  /** attribution.message: the commitment the producer declared, as written. */
+  declaredCommitment: string | null;
+}
+
+export interface RunVerifyResult {
+  category: RunCategory;
+  /** The underlying bitgraph/1 verification, reported on its own. */
+  proof: { valid: boolean; reason?: string };
+  marker: RunMarker | null;
+  /** Recomputed from the proof's slot record; null when the proof carries none. */
+  slotCommitmentB64u: string | null;
+  /** Byte offset of the first occurrence in the artifact, or null when absent. */
+  offset: number | null;
+  /** How many times it appears. One is the ordinary case; more is not an error. */
+  occurrences: number;
+  artifactDigestB64: string;
+  fileDigestB64: string;
+  span: FuseSpan | null;
+  /** What this result establishes, bounded. */
+  statements: string[];
+  /** What it does not establish, stated so nothing has to be inferred. */
+  limits: string[];
+  reason: string | null;
+}
+
+export interface RunVerifyOptions {
+  proof: BitGraphProof;
+  bytes: Uint8Array;
+  trustAnchors?: VerificationPolicy;
+}
+
+const b64 = (b: Uint8Array): string => Buffer.from(b).toString("base64");
+const b64u = (b: Uint8Array): string => b64(b).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+
+/** The marker a run proof carries, or null when it is not a run proof. */
+export function readRunAttribution(proof: BitGraphProof): RunMarker | null {
+  const a = proof.attribution;
+  if (a === undefined || a.name !== RUN_PROFILE) return null;
+  return {
+    encoding: typeof a.title === "string" && a.title.length > 0 ? a.title : null,
+    declaredCommitment: typeof a.message === "string" && a.message.length > 0 ? a.message : null,
+  };
+}
+
+/** The attribution a producer sends when committing a run. */
+export function runAttribution(commitment: Uint8Array | string): { name: string; title: string; message: string } {
+  return {
+    name: RUN_PROFILE,
+    title: RUN_ENCODING_BASE64URL,
+    message: typeof commitment === "string" ? commitment : b64u(commitment),
+  };
+}
+
+/** Every byte offset at which `needle` occurs in `haystack`. */
+function findAll(haystack: Uint8Array, needle: Uint8Array): number[] {
+  const out: number[] = [];
+  if (needle.length === 0 || needle.length > haystack.length) return out;
+  outer: for (let i = 0; i + needle.length <= haystack.length; i++) {
+    for (let j = 0; j < needle.length; j++) if (haystack[i + j] !== needle[j]) continue outer;
+    out.push(i);
+  }
+  return out;
+}
+
+function statementsFor(category: RunCategory, span: FuseSpan | null, offset: number | null): string[] {
+  if (span === null || category !== "RUN_CONFIRMED") return [];
+  return [
+    `The enclave signed the slot at position ${span.slotCounter} before this artifact's digest reached it.`,
+    `These exact bytes contain that slot's commitment, first at byte ${offset}, so they were assembled after the slot existed and were committed at position ${span.commitCounter}.`,
+  ];
+}
+
+const LIMITS = [
+  "Containing the commitment does not show it was an input to the artifact's production: bytes appended to a finished file pass the same check. What the commitment was to the work is the producer's claim, not this result's.",
+  "Nothing here bounds the artifact from above in wall-clock time. The position bound is the commit position; a clock comes only from an anchor.",
+];
+
+/**
+ * Verify a bitgraph-run/1 artifact from its own bytes. Nothing here touches the
+ * network, and nothing is rebuilt: a run has no original to rebuild from.
+ */
+export async function verifyRun(opts: RunVerifyOptions): Promise<RunVerifyResult> {
+  const { proof, bytes, trustAnchors } = opts;
+  const fileDigestB64 = b64(sha256(bytes));
+  const artifactDigestB64 = proof.artifact?.digestB64 ?? "";
+  const span = spanOf(proof);
+  const marker = readRunAttribution(proof);
+
+  const base = (category: RunCategory, extra: Partial<RunVerifyResult>, reason: string | null): RunVerifyResult => ({
+    category,
+    proof: extra.proof ?? { valid: false, reason: "not run" },
+    marker,
+    slotCommitmentB64u: extra.slotCommitmentB64u ?? null,
+    offset: extra.offset ?? null,
+    occurrences: extra.occurrences ?? 0,
+    artifactDigestB64,
+    fileDigestB64,
+    span,
+    statements: statementsFor(category, span, extra.offset ?? null),
+    limits: category === "RUN_CONFIRMED" ? LIMITS : [],
+    reason,
+  });
+
+  if (marker === null) {
+    return base("NOT_A_RUN", {}, `the proof carries no ${RUN_PROFILE} attribution`);
+  }
+
+  let pv: { valid: boolean; reason?: string };
+  try {
+    pv = await verify(trustAnchors === undefined ? { proof, bytes } : { proof, bytes, trustAnchors });
+  } catch (e) {
+    pv = { valid: false, reason: (e as Error).message };
+  }
+  if (!pv.valid) {
+    return base("INVALID_UNDERLYING_PROOF", { proof: pv }, pv.reason ?? "the underlying proof does not verify against these bytes");
+  }
+
+  if (marker.encoding !== RUN_ENCODING_BASE64URL) {
+    return base("UNDETERMINED_ENCODING", { proof: pv }, `the marker names encoding "${marker.encoding ?? "none"}", which this build does not register`);
+  }
+
+  const slot = proof.slotAllocation;
+  if (slot === undefined) {
+    return base("INVALID_SLOT_COMMITMENT", { proof: pv }, "the proof carries no slot record, so the commitment cannot be recomputed");
+  }
+  const slotCommitmentB64u = b64u(computeSlotCommitment(slot));
+  if (marker.declaredCommitment !== slotCommitmentB64u) {
+    return base(
+      "INVALID_SLOT_COMMITMENT",
+      { proof: pv, slotCommitmentB64u },
+      `the signed marker declares commitment ${marker.declaredCommitment ?? "none"}, but this proof's slot record commits to ${slotCommitmentB64u}`,
+    );
+  }
+
+  const hits = findAll(bytes, new TextEncoder().encode(slotCommitmentB64u));
+  if (hits.length === 0) {
+    return base(
+      "COMMITMENT_ABSENT",
+      { proof: pv, slotCommitmentB64u },
+      "the artifact's bytes do not contain the commitment in the declared encoding",
+    );
+  }
+  return base("RUN_CONFIRMED", { proof: pv, slotCommitmentB64u, offset: hits[0] ?? null, occurrences: hits.length }, null);
+}