@mikeargento/bitgraph 1.1.0 → 1.1.1

package/README.md

@@ -1,6 +1,6 @@
 # BitGraph
 
-**Portable cryptographic proof of construction for digital artifacts.**
+**A BitGraph gives bits a place.**
 
 [![npm @mikeargento/bitgraph](https://img.shields.io/npm/v/@mikeargento/bitgraph?label=%40mikeargento%2Fbitgraph&color=cb3837)](https://www.npmjs.com/package/@mikeargento/bitgraph)
 [![Website](https://img.shields.io/badge/bitgraph.ing-live-0065A4)](https://bitgraph.ing)
@@ -8,11 +8,11 @@
 
 ---
 
-Just as a photograph captures photons through the constraint of a single frame of film, a BitGraph captures bits through the constraint of a single mathematical slot.
+BitGraphs are not labels or metadata added after the fact. They are new computations created when your file's hash *fills* a pre-existing cryptographic slot, constraining the commitment so it cannot be retroactively constructed. This occurs entirely off-chain and produces a proof permanently bound to that exact digital state.
 
-Origin can be enforced or it can be claimed. Most digital provenance systems claim it. They produce an artifact and then attach a signature, a timestamp, or a metadata block describing where the artifact came from. The claim arrives after the artifact already exists, which is the wrong end of the timeline.
+Provenance can be enforced or it can be claimed. Most systems claim it: they bind a statement about the content to the content itself. That binding can be cryptographically strong, and it can be made at the moment of capture rather than afterward, so the weakness is not timing. The weakness is that a claim is something a trusted signer can attach to any artifact at all. The artifact does not have to satisfy any prior condition to receive one.
 
-BitGraph enforces origin. A measured trusted execution environment creates an unpredictable cryptographic slot before the artifact's hash is known. The artifact's hash arrives later and is bound into the slot. The slot is consumed and cannot be reused. What emerges is not a description of provenance but a proof of construction.
+BitGraph enforces it instead. A measured trusted execution environment creates an unpredictable cryptographic slot before the artifact's hash reaches it. The artifact's hash arrives later and is bound into the slot. The slot is consumed and cannot be reused. What emerges is not a description of provenance but a proof of placement.
 
 > This exact digital state was committed through this measured process, in this order, under these constraints.
 
@@ -20,32 +20,32 @@ BitGraph enforces origin. A measured trusted execution environment creates an un
 
 Nonce first. Hash second. Atomic binding third.
 
-The TEE generates hardware entropy inside the enclave. That entropy becomes a slot, signed with the enclave's key, with an identity no attacker could have precomputed. The slot exists as a cryptographic object before any artifact hash has been seen.
+The TEE generates hardware entropy inside the enclave. That entropy becomes a slot, signed with the enclave's key, with an identity that could not feasibly have been predicted. The slot exists as a cryptographic object before it has seen any artifact hash.
 
 The artifact hash arrives. The TEE binds the hash into the slot, signs the binding, and advances its internal order. The slot becomes consumed.
 
 > UNUSED slot exists first. Artifact hash enters later. TEE binds the hash to the slot. Slot becomes CONSUMED. Proof travels with the artifact.
 
-The atomicity is the whole guarantee. The slot is allocated and signed before the hash is known. The slot can be consumed exactly once by a single binding operation. The artifact itself can be produced anywhere, by any process, using any tools. What matters is that when the hash arrives, the slot is already there waiting.
+The atomicity is the whole guarantee, and it constrains the record rather than the artifact. The artifact itself can be produced anywhere, by any process, using any tools. What matters is that when the hash arrives, the slot is already there waiting.
 
-Most systems say: "Here is a file hash. Now let's sign it." BitGraph says: "Here is a pre-existing origin slot. Now this file hash has occupied it."
+Most systems begin with the bits. BitGraph begins with the place. They say: "Here is a file hash. Now let's sign it." BitGraph says: "Here is a pre-existing position. Now this file hash has occupied it."
 
 ## Why nonce-first matters
 
-If a nonce, timestamp, or credential is added after the hash is already witnessed, it is just a label. It can prove someone signed something. It can prove a record existed by some moment. It cannot constrain the artifact's origin, because the artifact already existed before the nonce entered the picture.
+If a nonce, timestamp, or credential is added after the hash is already witnessed, it is just a label. It can prove someone signed something. It can prove a record existed by some moment. It cannot impose a prior condition merely by being attached afterward. The credential may describe where the artifact came from, but the artifact never had to consume a pre-existing, single-use position in order to receive one.
 
-That leaves a forgery window. A malicious actor can prepare old hashes, replay prior material, backfill records, or attach fresh randomness to something never produced through the claimed path. The label looks valid. The construction was never constrained.
+That leaves a forgery window. A malicious actor can prepare old hashes, replay prior material, backfill records, or attach fresh randomness to something never produced through the claimed path. The label looks valid. Nothing had to be true before it was attached.
 
-BitGraph closes the window by requiring the slot to exist first. The slot is not evidence added afterward. It is the condition the artifact must satisfy.
+BitGraph narrows that window by requiring the slot to exist first. It does not stop an old file being committed today: the hash occupies a slot allocated today, and the position claims nothing about when the bytes were made. What it stops is a position being invented after the fact, or occupied twice. The slot is not evidence added afterward. It is the condition the artifact must satisfy.
 
 ## What a BitGraph proof contains
 
-A BitGraph proof is a portable proof object, typically JSON, that travels with the artifact. It can include:
+A BitGraph proof is a portable proof object, a JSON document, that travels with the artifact. It can include:
 
 | Component | Purpose |
 |---|---|
 | Artifact hash | Identifies the exact file or digital state |
-| Nonce | The pre-existing causal slot |
+| Nonce | Hardware entropy giving the slot an identity that cannot feasibly be predicted |
 | Slot counter | Shows the slot was allocated before the commit |
 | Commit counter | Shows the artifact consumed the slot later |
 | Epoch ID | Groups an ordered run of commitments |
@@ -56,39 +56,39 @@ A BitGraph proof is a portable proof object, typically JSON, that travels with t
 | Attestation | Shows the proof came from measured hardware |
 | Public anchor | Tethers BitGraph logical time to a public reference |
 
-The result is not "a file was signed." It is: this hash was committed into this causal slot, by this measured environment, at this position in logical order, under this signing identity.
+Taken together: this hash was committed into this causal slot, by this measured environment, at this position in logical order, under this signing identity.
 
 ## Logical time
 
 Every proof has order. Every slot and commit has a position. The system can prove that this happened after that, that this slot existed before this hash was bound, that this proof came before the next, that this epoch has an internal cryptographic history.
 
-BitGraph proves causal order first. Clock time is optional.
+BitGraph proves causal order. It does not assert a clock time.
 
-## Ethereum: the backward seal
+## Establishing wall clock time
 
-BitGraph's internal ordering does not require Ethereum. The chain creates internal order through slot allocation, consumption, counters, signatures, and chained proof history. Ethereum anchors add a different property on top: a public backward seal that any third party can independently verify.
+BitGraph's internal ordering does not require Ethereum. The chain creates internal order through slot allocation, consumption, counters, signatures, and chained proof history. What that order lacks, on its own, is a clock. The enclave keeps no trusted one; any clock reading inside a proof is advisory.
 
-An Ethereum block hash that becomes available after the artifact has been committed could not have been known at the moment of commitment. This produces an entropy sandwich:
+Ethereum is where the order meets the wall clock. An anchor is an ordinary proof on the same chain whose artifact is the hash of a recent Ethereum block. A block hash does not exist before its block is produced, so the anchor, and every proof chained after it, came after that block and its public date. Anchors recur throughout every epoch. This is the wall-clock statement every proof page shows, and it runs in one direction: provably no earlier than. The other side of the window narrows through the chain's cadence, measured enclave behavior rather than public data, which is why it is narrowed, not closed.
 
-1. Private TEE entropy before the artifact.
-2. Artifact commitment in the middle.
-3. Public blockchain entropy after it.
+The anchors also fix history backward, through content. Each anchor is hash-linked to everything before it, so once an anchor exists, the history behind it is fixed: alter any earlier proof and the chain no longer reaches the anchor. When the epoch ends, its signing key is destroyed, and the set closes.
 
-The artifact was committed after the TEE-created slot existed and before the later Ethereum block was knowable. That bounds the commitment in adversary-resistant entropy, witnessed in a public timeline anyone can check years later.
+Ethereum is not asked to be a good source of randomness, and it is not asked to establish the artifact's position. BitGraph establishes the position. Ethereum ties the positions to the public timeline, so anyone, years later, can check the order and the earliest date each position could have existed.
 
-Ethereum is not asked to prove the artifact's origin. BitGraph does that. Ethereum provides the backward seal that makes the commitment publicly verifiable.
+## Compromise and containment
 
-## Multi-TEE breach detection
+BitGraph assumes the boundary can be compromised and bounds the damage instead of claiming it cannot happen.
 
-BitGraph's architecture supports running three independent TEEs in parallel as a tripwire, not a consensus system. Three TEEs witness the same input and produce three individual proofs with different nonces, signatures, and attestations. They agree on the meaningful result: same artifact hash, same policy decision, valid measurements, valid signatures, expected ordering behavior.
+The signing key exists only in enclave memory. Every restart destroys it and begins a new epoch with a fresh key and a fresh counter. Proofs from prior epochs were signed by keys that no longer exist, so a compromise cannot reach backward.
 
-If one diverges, the system does not need to know which one is compromised. It only needs to know something is wrong. The batch is quarantined, the affected range is marked suspect, the epoch is rotated, and downstream verification accounts for the gap.
+Forgery requires more than key theft. Every proof carries a hardware attestation whose user_data must equal the hash of that exact proof body, and only the enclave's secure module can produce one. A useful breach must execute inside the running enclave, and it dies at the next restart.
 
-This is not "trust this TEE forever." It is: compromise is assumed, silence is what gets eliminated.
+Damage control is precise. Every proof names its epoch permanently, so a suspect window is identified exactly: rotate the epoch, publish the affected epochId as quarantined, and every other epoch is untouched. Verifiers that pin measurements and track epochs account for the gap.
+
+The production deployment makes rotation routine rather than exceptional: the boundary restarts every day at 23:59 UTC, destroying the epoch key and starting a fresh one, so a normally operating epoch runs about a day. An unexpected restart ends one early and a failed rotation extends one; either way the boundary is recorded in the proofs themselves. A breach that depends on staying resident inside the enclave cannot outlive its epoch without freshly re-compromising a new one. The schedule is deliberately public: rotation times are visible on the ledger regardless, and the protection comes from the key dying, not from anyone guessing when.
 
 ## The trust model
 
-BitGraph does not depend on blind trust in any single component. Not the operator, the TEE, Ethereum, the clock, a certificate authority, or a live server. Each layer adds an independently verifiable property.
+BitGraph does not ask for blind trust in any single component. It has real dependencies, and the point is that each one is inspectable rather than assumed: the enclave's attestation chains to the AWS Nitro Attestation PKI root, and the measurement it carries is published, so both are things you check rather than things you take on faith. Each layer adds an independently verifiable property.
 
 | Layer | What it contributes |
 |---|---|
@@ -97,8 +97,7 @@ BitGraph does not depend on blind trust in any single component. Not the operato
 | Atomic binding | Prevents post-hoc attachment |
 | Counters | Internal logical order |
 | Proof chain | Historical continuity |
-| Ethereum anchor | Public backward seal |
-| Multi-TEE redundancy | Breach visibility |
+| Ethereum anchor | Public wall-clock bound |
 | Epoch rotation | Damage containment |
 | Portable verification | Independence from the original server |
 
@@ -106,11 +105,11 @@ BitGraph does not depend on blind trust in any single component. Not the operato
 
 BitGraph works on any digital state that can be hashed. The same primitive applies whether the artifact is a photograph, a contract, a model output, a dataset, or a software release.
 
-**Media.** Photos, videos, audio, edited files, generative outputs. The question shifts from "is this real?" to "what origin path does this artifact satisfy?"
+**Media.** Photos, videos, audio, edited files, generative outputs. The question shifts from "is this real?" to "what position does this exact digital state occupy?"
 
-**AI outputs.** Model results bound to authenticated identity and causal position without requiring the model to run inside an enclave.
+**AI outputs.** Model results bound to a causal position, and optionally to a key that authorized the recording, without requiring the model to run inside an enclave.
 
-**Software supply chain.** Build artifacts, releases, model weights, and deployment packages bound to a measured construction path.
+**Software supply chain.** Build artifacts, releases, model weights, and deployment packages bound to a position in a measured sequence.
 
 **Legal and clinical records.** Contracts, filings, telehealth session manifests, lab results, and consent forms with independently verifiable causal ordering.
 
@@ -124,22 +123,24 @@ BitGraph is often confused with adjacent systems. The differences are structural
 |---|---|---|
 | Signatures | This key signed this data | This key was controlled by a measured environment that consumed an unused slot |
 | Timestamps | This hash existed by time T | This hash consumed a pre-existing slot at this position in causal order |
-| C2PA | Here are signed claims about this content | Here is the construction path this content satisfied |
-| Blockchains | Public ordering of shared transactions | Private origin coordinates with optional public anchoring |
+| C2PA | Here are signed claims about this content | This exact digital state occupied this pre-existing position |
+| Blockchains | Public ordering of shared transactions | Ordering established inside a measured enclave, then anchored publicly |
 
-Signatures, timestamps, content credentials, and blockchains all answer "who claimed what, when?" BitGraph answers "what construction path did this exact artifact satisfy?" They are complementary, not competing. A signature can be inside a BitGraph proof. A timestamp can decorate one. Content credentials can ride alongside one. None of them, alone, do what BitGraph does.
+Signatures, timestamps, content credentials, and blockchains all answer "who claimed what, when?" BitGraph answers "what position does this exact digital state occupy?" They are complementary, not competing. A signature can be inside a BitGraph proof. A timestamp can decorate one. Content credentials can ride alongside one. None of them, alone, do what BitGraph does.
 
-## Multiple copies of the same original
+## Every copy carries the same position
 
-Physical originality depends on singularity. There is one canvas, one negative, one signed paper. Digital files broke that because perfect copies are indistinguishable from the source.
+Physical originality depended on singularity. There was one canvas, one negative, one signed paper, and the object's uniqueness was how you knew it came from the author's hand. Digital files broke that. Perfect copies are indistinguishable from the source, so the physical anchor for originality stopped working.
 
-BitGraph introduces a different category. A digital artifact can be copied without losing its original provenance. The proof travels with the bytes or alongside them. Instead of every copy being a degraded copy, BitGraph allows multiple copies of the same original. Originality moves from physical container to causal proof. Singularity is no longer required for originality.
+BitGraph does not restore originality. It makes it unnecessary. The artifact's hash is the proof's anchor, so any exact copy of the bytes carries the same position, and no copy has to be the special one. The proof object itself can travel with the file, stay on the server that issued it, or be stored anywhere, and each of those can have copies too. Verification does not depend on where anything lives. What used to need a unique object now needs only the exact bytes.
 
 ## The simplest version
 
-A measured TEE creates a random unused slot before the artifact hash arrives. The hash arrives. The TEE binds it to the slot, consumes the slot, signs the result, and links it into an ordered chain. Three TEEs can run in parallel so silent compromise becomes visible. The same mechanism periodically commits an Ethereum block hash, sealing everything before it in a public timeline.
+A measured TEE creates a random unused slot before the artifact hash arrives. The hash arrives. The TEE binds it to the slot, consumes the slot, signs the result, and links it into an ordered chain. Every restart begins a new epoch with a new key, so a compromised boundary is bounded, never retroactive. The same mechanism periodically commits an Ethereum block hash, fixing the history behind it and giving everything after it a public date it provably followed.
+
+The result is a protocol that does not say "someone signed this."
 
-The result is a provenance system that does not say "someone signed this." It says: this exact artifact occupied this origin coordinate.
+**It proves: these exact bits occupy this position.**
 
 ---
 
@@ -164,6 +165,14 @@ if (result.ok) {
 
 See [bitgraph.ing/docs](https://bitgraph.ing/docs) for the full proof format, verification checklist, attestation handling, and self-host instructions.
 
+## Verification and audit packages
+
+Two MIT-licensed packages in this repository make BitGraph evidence checkable without permission:
+
+**[`@mikeargento/bitgraph-verify`](https://www.npmjs.com/package/@mikeargento/bitgraph-verify)** verifies one proof. `verify()` checks a proof against the original artifact bytes: structure, canonical Ed25519 signature, slot binding, epoch link, and the digest match. `verifyProofIntegrity()` runs every check except the artifact binding for cases where the bytes are not available, and its result states explicitly that the binding was not checked.
+
+**`@mikeargento/bitgraph-audit`** audits a whole bundle of proofs, fully offline. It ingests a directory, `.tar`, or `.tar.gz`, verifies every proof through the canonical verifier, reconstructs causal order from the hash links and counters, classifies anomalies with stable machine-readable codes, and preserves divergence between valid proofs for the reader to adjudicate instead of choosing a winner. It ships a CLI (`bitgraph-audit <bundle>`) that writes machine-readable and human-readable reports. The bundle format is specified in [docs/BUNDLE-FORMAT.md](docs/BUNDLE-FORMAT.md); the recipient walkthrough is [docs/HOW-TO-AUDIT.md](docs/HOW-TO-AUDIT.md).
+
 ## License
 
 Copyright 2024-2026 Mike Argento. All rights reserved. Patent Pending.

package/dist/__tests__/audit-anchors.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=audit-anchors.test.d.ts.map

package/dist/__tests__/audit-anchors.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-anchors.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/audit-anchors.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/audit-anchors.test.js

@@ -0,0 +1,152 @@
+// Copyright (c) Mike Argento. All rights reserved. See LICENSE.
+/**
+ * Anchor identification tests (G5): the SIGNED attribution.name is the
+ * discriminator; unsigned metadata.type is corroboration only, recorded
+ * but never trusted; the block number comes only from the signed
+ * Etherscan URL; no wall-clock time is ever derived from anything here.
+ */
+import { describe, it } from "node:test";
+import * as assert from "node:assert/strict";
+import { identifyAnchors, ingestBundle, verifyObservedProofs, } from "@mikeargento/bitgraph-audit";
+import { makeAnchorProof, makeChainIdProof, makeTempDir, proofJson, writeBundleDir, } from "./audit-fixtures.js";
+const BLOCK_HASH = "0x28ed3639cd705fb8cb2b915c1991e9f808b40e775bc8eb540702942729fec2c0";
+async function ingestAndVerify(files) {
+    const dir = await makeTempDir("bg-audit-anchors-");
+    await writeBundleDir(dir, files);
+    const ingest = await ingestBundle(dir);
+    await verifyObservedProofs(ingest);
+    return ingest;
+}
+describe("audit anchors: identification by signed attribution", () => {
+    it("identifies an anchor by attribution.name and extracts the signed facts", async () => {
+        const anchor = await makeAnchorProof({
+            blockHash: BLOCK_HASH,
+            blockNumber: "24800448",
+            epochId: "EPOCH-A",
+            counter: "4",
+            slotCounter: "3",
+            chainId: "bitgraph:main",
+            metadata: {
+                type: "ethereum-anchor",
+                anchor: { blockNumber: 24800448, blockHash: BLOCK_HASH, blockTime: 1750000000 },
+            },
+        });
+        const user = await makeChainIdProof({ chainId: "bitgraph:main", counter: "6", epochId: "EPOCH-A" });
+        const ingest = await ingestAndVerify({
+            "proofs/anchor.json": proofJson(anchor.proof),
+            "proofs/user.json": proofJson(user.proof),
+        });
+        const result = identifyAnchors(ingest);
+        assert.equal(result.anchors.length, 1);
+        const record = result.anchors[0];
+        assert.equal(record.proofHash, anchor.proofHash);
+        assert.equal(record.epochId, "EPOCH-A");
+        assert.equal(record.chainId, "bitgraph:main");
+        assert.equal(record.counter, "4");
+        assert.equal(record.slotCounter, "3");
+        assert.equal(record.blockHash, BLOCK_HASH);
+        assert.equal(record.blockNumber, "24800448");
+        assert.equal(record.metadataCorroboration, "agrees");
+        // The unsigned metadata carries a blockTime; no time field of any kind
+        // may appear on the record.
+        assert.ok(!("timestamp" in record));
+        assert.ok(!("blockTime" in record));
+        assert.equal(result.findings.length, 0);
+    });
+    it("copies the run verification status onto the record", async () => {
+        const good = await makeAnchorProof({ blockHash: BLOCK_HASH, blockNumber: "1", epochId: "E", counter: "2" });
+        const bad = await makeAnchorProof({ blockHash: BLOCK_HASH.replace("28", "29"), blockNumber: "2", epochId: "E", counter: "4" });
+        // Tamper the signature after signing: identification still works (it
+        // reads the signed body fields), and the failed status is copied.
+        bad.proof.signer.signatureB64 = `AA${bad.proof.signer.signatureB64.slice(2)}`;
+        const ingest = await ingestAndVerify({
+            "proofs/good.json": proofJson(good.proof),
+            "proofs/bad.json": proofJson(bad.proof),
+        });
+        const result = identifyAnchors(ingest);
+        assert.equal(result.anchors.length, 2);
+        const goodRecord = result.anchors.find((a) => a.proofHash === good.proofHash);
+        assert.equal(goodRecord.verificationTier, "integrity");
+        assert.equal(goodRecord.verificationStatus, "artifact-unavailable");
+        const badRecord = result.anchors.find((a) => a.proofHash !== good.proofHash);
+        assert.equal(badRecord.verificationStatus, "failed");
+        assert.ok(badRecord.verificationReason !== undefined);
+    });
+    it("never identifies an anchor from unsigned metadata alone", async () => {
+        const user = await makeChainIdProof({ counter: "2", epochId: "E-META" });
+        user.proof["metadata"] = { type: "ethereum-anchor" };
+        const ingest = await ingestAndVerify({ "proofs/claimant.json": proofJson(user.proof) });
+        const result = identifyAnchors(ingest);
+        assert.equal(result.anchors.length, 0);
+        assert.equal(result.metadataOnlyProofHashes.length, 1);
+        const finding = result.findings.find((f) => f.code === "anchor-metadata-only-claim");
+        assert.ok(finding !== undefined);
+        assert.match(finding.message, /not treated as an anchor/);
+    });
+    it("records disagreement between the signed attribution and unsigned metadata", async () => {
+        const anchor = await makeAnchorProof({
+            blockHash: BLOCK_HASH,
+            blockNumber: "7",
+            epochId: "E-DIS",
+            counter: "2",
+            metadata: { type: "something-else" },
+        });
+        const ingest = await ingestAndVerify({ "proofs/anchor.json": proofJson(anchor.proof) });
+        const result = identifyAnchors(ingest);
+        assert.equal(result.anchors.length, 1, "the signed field governs: still an anchor");
+        assert.equal(result.anchors[0].metadataCorroboration, "disagrees");
+        assert.ok(result.findings.some((f) => f.code === "anchor-metadata-disagreement"));
+    });
+    it("treats absent metadata as absent corroboration, not disagreement", async () => {
+        const anchor = await makeAnchorProof({ blockHash: BLOCK_HASH, blockNumber: "9", epochId: "E-ABS", counter: "2" });
+        const ingest = await ingestAndVerify({ "proofs/anchor.json": proofJson(anchor.proof) });
+        const result = identifyAnchors(ingest);
+        assert.equal(result.anchors[0].metadataCorroboration, "absent");
+        assert.equal(result.findings.filter((f) => f.code === "anchor-metadata-disagreement").length, 0);
+    });
+});
+describe("audit anchors: block number from the signed title URL", () => {
+    it("parses the number only from a strict Etherscan block URL", async () => {
+        const good = await makeAnchorProof({ blockHash: BLOCK_HASH, blockNumber: "24800448", epochId: "E-URL", counter: "2" });
+        const foreign = await makeAnchorProof({
+            blockHash: BLOCK_HASH.replace("28", "30"),
+            title: "https://example.com/block/99",
+            epochId: "E-URL",
+            counter: "4",
+        });
+        const missing = await makeAnchorProof({
+            blockHash: BLOCK_HASH.replace("28", "31"),
+            noTitle: true,
+            epochId: "E-URL",
+            counter: "6",
+        });
+        const ingest = await ingestAndVerify({
+            "proofs/good.json": proofJson(good.proof),
+            "proofs/foreign.json": proofJson(foreign.proof),
+            "proofs/missing.json": proofJson(missing.proof),
+        });
+        const result = identifyAnchors(ingest);
+        const byHash = new Map(result.anchors.map((a) => [a.proofHash, a]));
+        assert.equal(byHash.get(good.proofHash).blockNumber, "24800448");
+        assert.equal(byHash.get(foreign.proofHash).blockNumber, undefined);
+        assert.equal(byHash.get(missing.proofHash).blockNumber, undefined);
+        assert.equal(result.findings.filter((f) => f.code === "anchor-title-unparseable").length, 2);
+    });
+});
+describe("audit anchors: non-anchor proofs are untouched", () => {
+    it("produces no records or findings for ordinary proofs and mutates nothing", async () => {
+        const a = await makeChainIdProof({ counter: "2", epochId: "E-PLAIN" });
+        const b = await makeChainIdProof({ counter: "4", epochId: "E-PLAIN" });
+        const ingest = await ingestAndVerify({
+            "proofs/a.json": proofJson(a.proof),
+            "proofs/b.json": proofJson(b.proof),
+        });
+        const statusesBefore = ingest.proofs.map((p) => p.verification?.status);
+        const result = identifyAnchors(ingest);
+        assert.equal(result.anchors.length, 0);
+        assert.equal(result.metadataOnlyProofHashes.length, 0);
+        assert.equal(result.findings.length, 0);
+        assert.deepEqual(ingest.proofs.map((p) => p.verification?.status), statusesBefore, "identification is read-only");
+    });
+});
+//# sourceMappingURL=audit-anchors.test.js.map

package/dist/__tests__/audit-anchors.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-anchors.test.js","sourceRoot":"","sources":["../../src/__tests__/audit-anchors.test.ts"],"names":[],"mappings":"AAAA,gEAAgE;AAEhE;;;;;GAKG;AAEH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,KAAK,MAAM,MAAM,oBAAoB,CAAC;AAC7C,OAAO,EACL,eAAe,EACf,YAAY,EACZ,oBAAoB,GACrB,MAAM,6BAA6B,CAAC;AAErC,OAAO,EACL,eAAe,EACf,gBAAgB,EAChB,WAAW,EACX,SAAS,EACT,cAAc,GACf,MAAM,qBAAqB,CAAC;AAE7B,MAAM,UAAU,GAAG,oEAAoE,CAAC;AAExF,KAAK,UAAU,eAAe,CAAC,KAA0C;IACvE,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,mBAAmB,CAAC,CAAC;IACnD,MAAM,cAAc,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACjC,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,CAAC;IACvC,MAAM,oBAAoB,CAAC,MAAM,CAAC,CAAC;IACnC,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,QAAQ,CAAC,qDAAqD,EAAE,GAAG,EAAE;IACnE,EAAE,CAAC,wEAAwE,EAAE,KAAK,IAAI,EAAE;QACtF,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC;YACnC,SAAS,EAAE,UAAU;YACrB,WAAW,EAAE,UAAU;YACvB,OAAO,EAAE,SAAS;YAClB,OAAO,EAAE,GAAG;YACZ,WAAW,EAAE,GAAG;YAChB,OAAO,EAAE,eAAe;YACxB,QAAQ,EAAE;gBACR,IAAI,EAAE,iBAAiB;gBACvB,MAAM,EAAE,EAAE,WAAW,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE;aAChF;SACF,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,EAAE,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC;QAEpG,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC;YACnC,oBAAoB,EAAE,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC;YAC7C,kBAAkB,EAAE,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC;SAC1C,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;QAEvC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QACvC,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAE,CAAC;QAClC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;QACjD,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QACxC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;QAC9C,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QAClC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;QACtC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;QAC3C,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;QAC7C,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,qBAAqB,EAAE,QAAQ,CAAC,CAAC;QACrD,uEAAuE;QACvE,4BAA4B;QAC5B,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,IAAI,MAAM,CAAC,CAAC,CAAC;QACpC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,IAAI,MAAM,CAAC,CAAC,CAAC;QACpC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oDAAoD,EAAE,KAAK,IAAI,EAAE;QAClE,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,EAAE,SAAS,EAAE,UAAU,EAAE,WAAW,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;QAC5G,MAAM,GAAG,GAAG,MAAM,eAAe,CAAC,EAAE,SAAS,EAAE,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;QAC/H,qEAAqE;QACrE,kEAAkE;QAClE,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,YAAY,GAAG,KAAK,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QAE9E,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC;YACnC,kBAAkB,EAAE,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC;YACzC,iBAAiB,EAAE,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC;SACxC,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;QAEvC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QACvC,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,IAAI,CAAC,SAAS,CAAE,CAAC;QAC/E,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,gBAAgB,EAAE,WAAW,CAAC,CAAC;QACvD,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,kBAAkB,EAAE,sBAAsB,CAAC,CAAC;QACpE,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,IAAI,CAAC,SAAS,CAAE,CAAC;QAC9E,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,kBAAkB,EAAE,QAAQ,CAAC,CAAC;QACrD,MAAM,CAAC,EAAE,CAAC,SAAS,CAAC,kBAAkB,KAAK,SAAS,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yDAAyD,EAAE,KAAK,IAAI,EAAE;QACvE,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC;QACxE,IAAI,CAAC,KAA4C,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC;QAE7F,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,EAAE,sBAAsB,EAAE,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACxF,MAAM,MAAM,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;QAEvC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QACvC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,uBAAuB,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QACvD,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,4BAA4B,CAAC,CAAC;QACrF,MAAM,CAAC,EAAE,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC;QACjC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,0BAA0B,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2EAA2E,EAAE,KAAK,IAAI,EAAE;QACzF,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC;YACnC,SAAS,EAAE,UAAU;YACrB,WAAW,EAAE,GAAG;YAChB,OAAO,EAAE,OAAO;YAChB,OAAO,EAAE,GAAG;YACZ,QAAQ,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE;SACrC,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,EAAE,oBAAoB,EAAE,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACxF,MAAM,MAAM,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;QAEvC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,2CAA2C,CAAC,CAAC;QACpF,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAE,CAAC,qBAAqB,EAAE,WAAW,CAAC,CAAC;QACpE,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,8BAA8B,CAAC,CAAC,CAAC;IACpF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kEAAkE,EAAE,KAAK,IAAI,EAAE;QAChF,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,EAAE,SAAS,EAAE,UAAU,EAAE,WAAW,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;QAClH,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,EAAE,oBAAoB,EAAE,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACxF,MAAM,MAAM,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;QACvC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAE,CAAC,qBAAqB,EAAE,QAAQ,CAAC,CAAC;QACjE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,8BAA8B,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACnG,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,uDAAuD,EAAE,GAAG,EAAE;IACrE,EAAE,CAAC,0DAA0D,EAAE,KAAK,IAAI,EAAE;QACxE,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,EAAE,SAAS,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;QACvH,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC;YACpC,SAAS,EAAE,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC;YACzC,KAAK,EAAE,8BAA8B;YACrC,OAAO,EAAE,OAAO;YAChB,OAAO,EAAE,GAAG;SACb,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC;YACpC,SAAS,EAAE,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC;YACzC,OAAO,EAAE,IAAI;YACb,OAAO,EAAE,OAAO;YAChB,OAAO,EAAE,GAAG;SACb,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC;YACnC,kBAAkB,EAAE,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC;YACzC,qBAAqB,EAAE,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC;YAC/C,qBAAqB,EAAE,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC;SAChD,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;QAEvC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACpE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAE,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;QAClE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAE,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;QACpE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAE,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;QACpE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,0BAA0B,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAC/F,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,gDAAgD,EAAE,GAAG,EAAE;IAC9D,EAAE,CAAC,yEAAyE,EAAE,KAAK,IAAI,EAAE;QACvF,MAAM,CAAC,GAAG,MAAM,gBAAgB,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC;QACvE,MAAM,CAAC,GAAG,MAAM,gBAAgB,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC;QACvE,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC;YACnC,eAAe,EAAE,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC;YACnC,eAAe,EAAE,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC;SACpC,CAAC,CAAC;QACH,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;QAExE,MAAM,MAAM,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;QAEvC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QACvC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,uBAAuB,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QACvD,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QACxC,MAAM,CAAC,SAAS,CACd,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,EAAE,MAAM,CAAC,EAChD,cAAc,EACd,6BAA6B,CAC9B,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/__tests__/audit-anomalies.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=audit-anomalies.test.d.ts.map

package/dist/__tests__/audit-anomalies.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-anomalies.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/audit-anomalies.test.ts"],"names":[],"mappings":""}