@sanning/proof 0.10.0 → 0.11.1

package/src/evidence.ts

@@ -20,6 +20,11 @@ import {
   deriveOperatorAddress,
   ed25519Verify,
   hexToBytes,
+  // The one hex-field test, which lives in `crypto.ts` beside the one hex
+  // reader (proof#146). It was a second copy here until then, with the same
+  // body: two copies of one rule is how two kernels drift apart one edit at a
+  // time, which is the whole defect class this fix is about.
+  isHexField,
   sha256Hex,
   utf8,
   verifyRsaPssSha256,
@@ -30,6 +35,7 @@ import {
   contentHashes,
   exceedsDepth,
   jcs,
+  jcsParse,
   verifyEnvelope,
 } from "./verifier.js";
 import {
@@ -673,12 +679,23 @@ function isEvidenceMajorAccepted(specVersion: unknown): boolean {
   });
 }
 
-function malformed(error: string, specVersionOk = false): EvidenceBundleResult {
+/**
+ * A bundle this kernel cannot read.
+ *
+ * `wrapperOk` is true only where the wrapper signature and `body_hash` were
+ * CHECKED and held before the body was found unreadable. It is then reported
+ * as held, because it did: `signatureOk` and `bodyHashOk` are statements about
+ * the wrapper, and a body this kernel cannot parse does not unsign it. The
+ * case reader decides whose pack a bundle is on exactly those two fields
+ * (`evidence-bundle.md` 5.5.1), so reporting `false` here let a holder who
+ * broke its own body shape read as a forger.
+ */
+function malformed(error: string, specVersionOk = false, wrapperOk = false): EvidenceBundleResult {
   return {
     status: "malformed",
     specVersionOk,
-    bodyHashOk: false,
-    signatureOk: false,
+    bodyHashOk: wrapperOk,
+    signatureOk: wrapperOk,
     bodyType: null,
     onChainChecked: false,
     checkpoints: [],
@@ -688,8 +705,79 @@ function malformed(error: string, specVersionOk = false): EvidenceBundleResult {
   };
 }
 
-function stringifyErr(e: unknown): string {
-  return e instanceof Error ? e.message : String(e);
+/**
+ * The prefixes of the exception text this kernel writes ITSELF, in the words
+ * the Python kernel writes too. Anything outside this set comes from the host:
+ * a JSON parser, a codec, a crypto library. See `thrownDetail`.
+ */
+const KERNEL_WORDING = ["hexToBytes: "];
+
+/**
+ * The detail a finding may append about a caught exception.
+ *
+ * THE RULE: a finding carries the text of a caught exception only where this
+ * kernel wrote that text. A finding travels into a case reading through `case`
+ * `reasons`, and both kernels promise one reading and one rendered sentence for
+ * one set of bytes; a host JSON parser says `Unexpected token 'h', "hello" is
+ * not valid JSON` here and `Expecting value: line 1 column 1 (char 0)` there,
+ * for one pack anyone can build (gate 4 on proof#140, finding 1).
+ *
+ * Returns `": <text>"` for this kernel's own wording and the empty string for
+ * anything else. The label at the call site already names the check that
+ * failed and both kernels agree on it character for character; what is dropped
+ * is the host's parse offset, which no reader can act on and which was never
+ * the same in the two kernels.
+ */
+function thrownDetail(e: unknown): string {
+  const text = e instanceof Error ? e.message : String(e);
+  return KERNEL_WORDING.some((w) => text.startsWith(w)) ? `: ${text}` : "";
+}
+
+/**
+ * Decode `bytes` as UTF-8 the way every other kernel does: a byte sequence that
+ * is not valid UTF-8 THROWS, and a leading byte-order mark is kept rather than
+ * eaten.
+ *
+ * ONE CALLER LEFT, and it is not a parse. `jcsParse` (`verifier.ts`) reads
+ * every set of signed bytes in this kernel now; this function survives only for
+ * the canonicality comparison on the stamp path, which needs the DECODED TEXT
+ * of bytes `jcsParse` has already accepted, to compare against `jcs(body)`. It
+ * performs exactly the decode `jcsParse` performs, so the comparison cannot
+ * read the bytes differently from the parse that produced `body`.
+ *
+ * `new TextDecoder()` alone is neither strict nor BOM-preserving: it replaces
+ * every invalid sequence with U+FFFD and strips a BOM. A stamp body carrying
+ * one raw `0x80` inside a string value read `verified` here and `failed` there
+ * because of it (gate 4 on proof#140). The symmetric claim the first version of
+ * this comment made, that "Python's `json.loads` raises on both", is FALSE and
+ * is what hid gate 5's defect for a round: `json.loads(<bytes>)` strips a BOM
+ * too. Python's strict reader is `jcs_loads`, and the rule both kernels hold to
+ * is stated once, in `jcsParse`.
+ */
+function decodeUtf8Strict(bytes: Uint8Array): string {
+  return new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(bytes);
+}
+
+/**
+ * Name an envelope `public_key` or `signature` spelled outside the hex charset
+ * or at the wrong length (proof#142). This kernel's envelope layer already
+ * fails such an envelope, and the Python one's decoder accepts ASCII
+ * whitespace (proof#135), so both bundle verifiers name it here, in the same
+ * words, and the two kernels give one reading. Only a STRING is checked: a
+ * missing or non-string field is the envelope layer's to fail, and it does.
+ */
+function envelopeHexError(what: string, envelope: unknown): string | null {
+  if (!isJsonObject(envelope)) return null;
+  for (const [name, nibbles] of [
+    ["public_key", 64],
+    ["signature", 128],
+  ] as const) {
+    const value = envelope[name];
+    if (typeof value === "string" && !isHexField(value, nibbles)) {
+      return `${what} envelope ${name} is not ${nibbles} hex characters`;
+    }
+  }
+  return null;
 }
 
 /**
@@ -764,26 +852,44 @@ async function verifyBundle(
   // --- Step 2: verify the wrapper signature + recompute body_hash ------------
   const errors: string[] = [];
 
+  // Every wrapper hex field is read STRICTLY, before any decoder sees it
+  // (proof#142). The Python decoder skipped ASCII whitespace, and the wrapper
+  // `signature` sits outside the signed scope, so one space in it, added by
+  // anyone and with no key, made a pack verify there and fail here. The same
+  // named failure in both kernels, for each field: `public_key` and
+  // `signature` are 64 and 128 hex characters in either case (proof#135,
+  // option B), and `body_hash` is 64 LOWER-case hex characters, the form it is
+  // recomputed in and compared against.
   let bodyHashOk = false;
-  try {
-    const recomputed = await sha256Hex(utf8(jcs(b.body)));
-    bodyHashOk = recomputed === b.body_hash;
-    if (!bodyHashOk) {
-      errors.push(`body_hash mismatch: bundle=${b.body_hash} recomputed=${recomputed}`);
+  if (!isHexField(b.body_hash, 64, true)) {
+    errors.push("wrapper body_hash is not 64 lowercase hex characters");
+  } else {
+    try {
+      const recomputed = await sha256Hex(utf8(jcs(b.body)));
+      bodyHashOk = recomputed === b.body_hash;
+      if (!bodyHashOk) {
+        errors.push(`body_hash mismatch: bundle=${b.body_hash} recomputed=${recomputed}`);
+      }
+    } catch (e) {
+      errors.push(`body canonicalization failed${thrownDetail(e)}`);
     }
-  } catch (e) {
-    errors.push(`body canonicalization failed: ${stringifyErr(e)}`);
   }
 
   let signatureOk = false;
-  try {
-    const { signature: _sig, co_signatures: _co, ...bundleForSig } = b as EvidenceBundle & {
-      co_signatures?: unknown;
-    };
-    signatureOk = await ed25519Verify(b.signature, utf8(jcs(bundleForSig)), b.public_key);
-    if (!signatureOk) errors.push("wrapper Ed25519 signature verification failed");
-  } catch (e) {
-    errors.push(`wrapper signature verification error: ${stringifyErr(e)}`);
+  const keyFormOk = isHexField(b.public_key, 64);
+  const signatureFormOk = isHexField(b.signature, 128);
+  if (!keyFormOk) errors.push("wrapper public_key is not 64 hex characters");
+  if (!signatureFormOk) errors.push("wrapper signature is not 128 hex characters");
+  if (keyFormOk && signatureFormOk) {
+    try {
+      const { signature: _sig, co_signatures: _co, ...bundleForSig } = b as EvidenceBundle & {
+        co_signatures?: unknown;
+      };
+      signatureOk = await ed25519Verify(b.signature, utf8(jcs(bundleForSig)), b.public_key);
+      if (!signatureOk) errors.push("wrapper Ed25519 signature verification failed");
+    } catch (e) {
+      errors.push(`wrapper signature verification error${thrownDetail(e)}`);
+    }
   }
 
   const assertedStatus = typeof b.verdict?.status === "string" ? b.verdict.status : null;
@@ -939,39 +1045,52 @@ type AnyTraceCheckpoint = Partial<TraceCheckpoint> & { tx_id?: unknown };
 async function resolveCheckpointKey(
   cp: AnyTraceCheckpoint,
   eventBytes: Uint8Array | undefined,
-): Promise<{ key: string | null; anchorRef: AnchorRef | null; errors: string[] }> {
+): Promise<{
+  key: string | null;
+  anchorRef: AnchorRef | null;
+  anchorRefMalformed: boolean;
+  errors: string[];
+}> {
   const errors: string[] = [];
+  // Every early return below leaves before `anchor_ref` is ever looked at, so
+  // nothing there is "malformed": it is unexamined, which is not the same claim.
+  const unexamined = { key: null, anchorRef: null, anchorRefMalformed: false, errors };
 
   if (cp.tx_id !== undefined) {
     errors.push(
       `${ANCHOR_TRACE_BODY_TYPE} checkpoint carries legacy tx_id -- one bundle speaks one vocabulary`,
     );
-    return { key: null, anchorRef: null, errors };
+    return unexamined;
   }
   const legacy = legacyEventBytesError(cp, "checkpoint", ANCHOR_TRACE_BODY_TYPE);
   if (legacy !== null) {
     errors.push(legacy);
-    return { key: null, anchorRef: null, errors };
+    return unexamined;
   }
   if (typeof cp.checkpoint_ref !== "string" || cp.checkpoint_ref === "") {
     errors.push("checkpoint missing checkpoint_ref");
-    return { key: null, anchorRef: null, errors };
+    return unexamined;
   }
   if (eventBytes === undefined) {
     // Without the bytes the key cannot be recomputed, so it cannot be trusted.
     errors.push("checkpoint_ref cannot be verified -- event_bytes missing or not hex");
-    return { key: null, anchorRef: null, errors };
+    return unexamined;
   }
   const derived = await sha256Hex(eventBytes);
   if (derived !== cp.checkpoint_ref.toLowerCase()) {
     errors.push(
       `checkpoint_ref does not match SHA-256(event_bytes): claimed=${cp.checkpoint_ref} derived=${derived}`,
     );
-    return { key: null, anchorRef: null, errors };
+    return unexamined;
   }
 
-  const anchorRef = parseAnchorRef(cp.anchor_ref, errors);
-  return { key: derived, anchorRef, errors };
+  const parsed = parseAnchorRef(cp.anchor_ref, errors);
+  return {
+    key: derived,
+    anchorRef: parsed.ref,
+    anchorRefMalformed: parsed.malformed,
+    errors,
+  };
 }
 
 /**
@@ -991,31 +1110,50 @@ async function resolveCheckpointKey(
  * So this validates the SHAPE and never the vocabulary. A malformed
  * `anchor_ref` is a defect in the bundle; an unknown `kind` is a defect in
  * the reader, and only the first is the bundle's fault.
+ *
+ * ── Absent and malformed are not the same null (proof#120) ──
+ *
+ * Both leave no `AnchorRef` to re-fetch, and both used to be reported the same
+ * way downstream: an all-`unreachable` on-chain result, although no gateway was
+ * asked in either case. For the ABSENT case that is at least the note
+ * `evidence-bundle.md` §5.1.1 reserves for "a checkpoint with no `anchor_ref`".
+ * For the MALFORMED case it is a manufactured outage: the bundle named a
+ * witness, the name was unreadable, and the reader was told the public record
+ * could not be reached. So the two come back as different facts, and `malformed`
+ * carries the difference.
  */
-function parseAnchorRef(raw: unknown, errors: string[]): AnchorRef | null {
-  if (raw === undefined || raw === null) return null; // placed, not yet witnessed
+function parseAnchorRef(
+  raw: unknown,
+  errors: string[],
+): { ref: AnchorRef | null; malformed: boolean } {
+  if (raw === undefined || raw === null) {
+    return { ref: null, malformed: false }; // placed, not yet witnessed
+  }
   if (typeof raw !== "object" || Array.isArray(raw)) {
     errors.push("anchor_ref must be an object");
-    return null;
+    return { ref: null, malformed: true };
   }
   const o = raw as Record<string, unknown>;
   if (typeof o.kind !== "string" || !/^[a-z0-9][a-z0-9._-]*$/.test(o.kind)) {
     errors.push(`anchor_ref.kind is missing or malformed: ${JSON.stringify(o.kind)}`);
-    return null;
+    return { ref: null, malformed: true };
   }
   if (typeof o.id !== "string" || o.id === "") {
     errors.push("anchor_ref.id is missing or empty");
-    return null;
+    return { ref: null, malformed: true };
   }
   const ref = o.ref;
   if (ref !== undefined && (typeof ref !== "object" || ref === null || Array.isArray(ref))) {
     errors.push("anchor_ref.ref must be an object when present");
-    return null;
+    return { ref: null, malformed: true };
   }
   return {
-    kind: o.kind,
-    id: o.id,
-    ...(ref === undefined ? {} : { ref: ref as Record<string, unknown> }),
+    ref: {
+      kind: o.kind,
+      id: o.id,
+      ...(ref === undefined ? {} : { ref: ref as Record<string, unknown> }),
+    },
+    malformed: false,
   };
 }
 
@@ -1029,7 +1167,7 @@ async function verifyAnchorTrace(
   const body = b.body as AnchorTraceBody;
   const bodyType = ANCHOR_TRACE_BODY_TYPE;
   if (!Array.isArray(body.checkpoints) || !Array.isArray(body.events)) {
-    return malformed(`${bodyType} body must have checkpoints[] and events[]`, true);
+    return malformed(`${bodyType} body must have checkpoints[] and events[]`, true, true);
   }
 
   const gateways = options.gateways ?? [];
@@ -1046,6 +1184,11 @@ async function verifyAnchorTrace(
   const byKey = new Map<string, AnyTraceCheckpoint>();
   const anchorByKey = new Map<string, AnchorRef | null>();
   const checkpointResults: CheckpointResult[] = [];
+  // proof#120. Kept beside the results rather than on them: "the bundle named
+  // a witness we could not read" is an input defect the checkpoint's own
+  // `errors` already states, not a new dimension of the published verdict, and
+  // `CheckpointResult` is a shape downstream surfaces render.
+  const malformedAnchorRef = new Set<CheckpointResult>();
   for (const rawCp of body.checkpoints as unknown[]) {
     // `checkpoints[]` is attacker-shaped, and a verifier must never raise on
     // adversarial input: a null entry used to reach `cp.tx_id` and hand the
@@ -1079,7 +1222,7 @@ async function verifyAnchorTrace(
     try {
       if (typeof cp.event_bytes === "string") eventBytes = hexToBytes(cp.event_bytes);
     } catch (e) {
-      cpErrors.push(`checkpoint event_bytes is not hex: ${stringifyErr(e)}`);
+      cpErrors.push(`checkpoint event_bytes is not hex${thrownDetail(e)}`);
     }
 
     const keyed = await resolveCheckpointKey(cp, eventBytes);
@@ -1114,11 +1257,14 @@ async function verifyAnchorTrace(
       // A checkpoint must fully bind: signature + the committed record matching
       // payload_hash. An undetermined binding (no record) is not enough to
       // anchor the events' inclusion claims to a trustworthy root.
-      envelopeOk = res.ok && res.payloadHashOk === true;
+      const hexError = envelopeHexError("checkpoint", cp.envelope);
+      envelopeOk = res.ok && res.payloadHashOk === true && hexError === null;
       // See the event loop below: a degenerate envelope is a malformed input,
       // not a failed check (proof#76).
       if (!isJsonObject(cp.envelope)) {
         cpErrors.push("checkpoint envelope is not a JSON object");
+      } else if (hexError !== null) {
+        cpErrors.push(hexError);
       } else if (!res.signatureOk) {
         cpErrors.push("checkpoint envelope signature failed");
       }
@@ -1141,14 +1287,14 @@ async function verifyAnchorTrace(
         );
       }
     } catch (e) {
-      cpErrors.push(`checkpoint envelope verify error: ${stringifyErr(e)}`);
+      cpErrors.push(`checkpoint envelope verify error${thrownDetail(e)}`);
     }
 
     // The committed record's merkle_root must equal the checkpoint's claimed
     // merkle_root (recompute, don't trust the bundle's top-level claim).
     if (eventBytes !== undefined) {
       try {
-        const record = JSON.parse(new TextDecoder().decode(eventBytes)) as {
+        const record = jcsParse(eventBytes) as {
           event?: { merkle_root?: unknown };
         };
         const committedRoot = record.event?.merkle_root;
@@ -1160,7 +1306,7 @@ async function verifyAnchorTrace(
           );
         }
       } catch (e) {
-        cpErrors.push(`checkpoint record is not JSON: ${stringifyErr(e)}`);
+        cpErrors.push(`checkpoint record is not JSON${thrownDetail(e)}`);
       }
     }
 
@@ -1180,6 +1326,9 @@ async function verifyAnchorTrace(
       ok: envelopeOk && merkleRootOk && keyed.errors.length === 0 && !duplicateKey,
       errors: cpErrors,
     });
+    if (keyed.anchorRefMalformed) {
+      malformedAnchorRef.add(checkpointResults[checkpointResults.length - 1]);
+    }
   }
 
   // --- Step 4: per-event ------------------------------------------------------
@@ -1212,18 +1361,37 @@ async function verifyAnchorTrace(
     const legacyError = legacyEventBytesError(ev, "event", bodyType);
     if (legacyError !== null) evErrors.push(legacyError);
 
+    // MALFORMED IS A FAILURE; ABSENT IS UNDETERMINED (proof#85).
+    //
+    // `event_bytes` that will not decode leaves `eventBytes` undefined, and an
+    // undefined `eventBytes` is exactly how a WITHHELD record is spelled one
+    // line down. So an event carrying garbage in place of its record used to
+    // reach the same tri-state as an event carrying nothing: `payloadHashOk`
+    // null, `ok` true, a leading tick on the line, and a `verified` rollup over
+    // a record nobody could read. The only thing wrong with the pack was the
+    // bytes, and it was the one thing the verdict did not say.
+    //
+    // A record the producer chose not to disclose is the customer exercising
+    // minimum disclosure. A record that is present and unreadable is a defect
+    // in the artifact, and this kernel's standing rule (the same one
+    // `checkpoints[]` already applies through `keyed.errors`) is that a defect
+    // we can see fails.
     let eventBytes: Uint8Array | undefined;
+    let eventBytesMalformed = false;
     try {
       if (typeof ev.event_bytes === "string") eventBytes = hexToBytes(ev.event_bytes);
     } catch (e) {
-      evErrors.push(`event event_bytes is not hex: ${stringifyErr(e)}`);
+      eventBytesMalformed = true;
+      evErrors.push(`event event_bytes is not hex${thrownDetail(e)}`);
     }
     try {
       const res = await verifyEnvelope(
         ev.envelope,
         eventBytes !== undefined ? { payloadBytes: eventBytes } : {},
       );
-      envelopeOk = res.ok; // ok tolerates an undetermined binding (withheld record)
+      const hexError = envelopeHexError("event", ev.envelope);
+      // ok tolerates an undetermined binding (withheld record)
+      envelopeOk = res.ok && hexError === null;
       payloadBindingOk = res.payloadHashOk;
       // P-10: report what could not be determined, never a fault that was never
       // observed. There is no envelope here, so no signature was checked and no
@@ -1234,6 +1402,8 @@ async function verifyAnchorTrace(
       // the producer at all (proof#76).
       if (!isJsonObject(ev.envelope)) {
         evErrors.push("event envelope is not a JSON object");
+      } else if (hexError !== null) {
+        evErrors.push(hexError);
       } else if (!res.signatureOk) {
         evErrors.push("event envelope signature failed");
       }
@@ -1244,7 +1414,7 @@ async function verifyAnchorTrace(
       const specFinding = specVersionFinding("event", ev.envelope, res);
       if (specFinding !== null) evErrors.push(specFinding);
     } catch (e) {
-      evErrors.push(`event envelope verify error: ${stringifyErr(e)}`);
+      evErrors.push(`event envelope verify error${thrownDetail(e)}`);
     }
 
     // Bind the event to exactly one checkpoint in the bundle, then verify
@@ -1307,7 +1477,7 @@ async function verifyAnchorTrace(
           );
         }
       } catch (e) {
-        evErrors.push(`inclusion verify error: ${stringifyErr(e)}`);
+        evErrors.push(`inclusion verify error${thrownDetail(e)}`);
       }
     }
 
@@ -1328,7 +1498,15 @@ async function verifyAnchorTrace(
       // present checkpoint, and its disclosed content did not MISMATCH. A
       // withheld record or undisclosed content (binding/content null) does not
       // fail it.
-      ok: envelopeOk && inclusionOk && checkpointBound && contentOk !== false && legacyError === null,
+      // `!eventBytesMalformed`: present-and-unreadable record bytes are a
+      // defect in the artifact, never a disclosure choice (proof#85).
+      ok:
+        envelopeOk &&
+        inclusionOk &&
+        checkpointBound &&
+        contentOk !== false &&
+        legacyError === null &&
+        !eventBytesMalformed,
       errors: evErrors,
     });
   }
@@ -1352,6 +1530,20 @@ async function verifyAnchorTrace(
         // the run to partial) and NEVER as a mismatch. Treating "we never
         // anchored it yet" as "the chain disagrees" would be the same false
         // accusation this whole change is removing.
+        // proof#120. An `anchor_ref` that failed structural validation is not
+        // an absent one. Nothing was fetched, so the witness dimension is NOT
+        // CHECKED — `onChain: null`, exactly as when the caller supplied no
+        // adapter — and it must not raise `gatewayUnavailable`, which is what
+        // puts "could not be re-fetched from the supplied gateways" on the
+        // bundle. Reporting an outage nobody observed is a claim about the
+        // public record made out of a defect in the artifact, and verify-page
+        // renders it word for word. The run still fails: the structural error
+        // is already in `cpr.errors` and already in `ok` above.
+        if (cpr.anchorRef === null && malformedAnchorRef.has(cpr)) {
+          cpr.onChain = null;
+          cpr.onChainOk = null;
+          continue;
+        }
         if (cpr.anchorRef === null) {
           gatewayUnavailable = true;
           cpr.onChain = {
@@ -1523,7 +1715,7 @@ async function verifyDisclosedContent(
   let recordContentHash: string | undefined;
   if (eventBytes !== undefined) {
     try {
-      const record = JSON.parse(new TextDecoder().decode(eventBytes)) as {
+      const record = jcsParse(eventBytes) as {
         event?: { content_hash?: unknown };
       };
       const ch = record.event?.content_hash;
@@ -1632,7 +1824,7 @@ async function verifyStampEntry(
   try {
     bytes = hexToBytes(e.stamp_bytes);
   } catch (err) {
-    errors.push(`stamp_bytes is not hex: ${stringifyErr(err)}`);
+    errors.push(`stamp_bytes is not hex${thrownDetail(err)}`);
     return { result: base };
   }
   // Gated by `isLowerHex` above, so this is already the exact lowercase hex of
@@ -1665,7 +1857,7 @@ async function verifyStampEntry(
   // --- the body itself ------------------------------------------------------
   let body: StampBody;
   try {
-    const parsed: unknown = JSON.parse(new TextDecoder().decode(bytes));
+    const parsed: unknown = jcsParse(bytes);
     if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
       errors.push("stamp body is not a JSON object");
       return { result: base, witnessedHex };
@@ -1675,12 +1867,12 @@ async function verifyStampEntry(
     // every submit attempt for exactly this reason: a non-canonical body makes
     // a retry a DIFFERENT submission, and makes every independent re-derivation
     // of the stamp disagree with the one that was witnessed.
-    if (jcs(body as unknown as Record<string, unknown>) !== new TextDecoder().decode(bytes)) {
+    if (jcs(body as unknown as Record<string, unknown>) !== decodeUtf8Strict(bytes)) {
       errors.push("stamp_bytes are not JCS-canonical (RFC 8785)");
       return { result: base, witnessedHex };
     }
   } catch (err) {
-    errors.push(`stamp body is not JSON: ${stringifyErr(err)}`);
+    errors.push(`stamp body is not JSON${thrownDetail(err)}`);
     return { result: base, witnessedHex };
   }
 
@@ -1723,7 +1915,10 @@ async function verifyStampEntry(
   // --- the sub-tree ranges --------------------------------------------------
   base.subtreesOk = checkSubtrees(body, base, errors);
 
-  base.anchorRef = parseAnchorRef(e.anchor_ref, errors);
+  // A stamp needs no malformed/absent split: the §5.2 re-fetch path already
+  // leaves `onChain` null whenever there is no `AnchorRef`, so it never
+  // synthesised the outage proof#120 is about.
+  base.anchorRef = parseAnchorRef(e.anchor_ref, errors).ref;
 
   base.ok =
     base.stampRefOk && base.bodyOk && base.subtreesOk && errors.length === 0;
@@ -1819,7 +2014,7 @@ async function verifyStampTrace(
 ): Promise<EvidenceBundleResult> {
   const body = b.body as StampTraceBody;
   if (!Array.isArray(body?.stamps)) {
-    return malformed(`${STAMP_TRACE_BODY_TYPE} body must have stamps[]`, true);
+    return malformed(`${STAMP_TRACE_BODY_TYPE} body must have stamps[]`, true, true);
   }
 
   const seen = new Set<string>();
@@ -1922,7 +2117,11 @@ async function verifyStampEvidence(
 ): Promise<EvidenceBundleResult> {
   const body = b.body as StampEvidenceBody;
   if (!Array.isArray(body?.stamps) || !Array.isArray(body?.events)) {
-    return malformed(`${STAMP_EVIDENCE_BODY_TYPE} body must have stamps[] and events[]`, true);
+    return malformed(
+      `${STAMP_EVIDENCE_BODY_TYPE} body must have stamps[] and events[]`,
+      true,
+      true,
+    );
   }
 
   // --- The stamp half: §5.2's rules, §5.2's code ----------------------------
@@ -1982,18 +2181,37 @@ async function verifyStampEvidence(
     const legacyError = legacyEventBytesError(ev, "event", STAMP_EVIDENCE_BODY_TYPE);
     if (legacyError !== null) evErrors.push(legacyError);
 
+    // MALFORMED IS A FAILURE; ABSENT IS UNDETERMINED (proof#85).
+    //
+    // `event_bytes` that will not decode leaves `eventBytes` undefined, and an
+    // undefined `eventBytes` is exactly how a WITHHELD record is spelled one
+    // line down. So an event carrying garbage in place of its record used to
+    // reach the same tri-state as an event carrying nothing: `payloadHashOk`
+    // null, `ok` true, a leading tick on the line, and a `verified` rollup over
+    // a record nobody could read. The only thing wrong with the pack was the
+    // bytes, and it was the one thing the verdict did not say.
+    //
+    // A record the producer chose not to disclose is the customer exercising
+    // minimum disclosure. A record that is present and unreadable is a defect
+    // in the artifact, and this kernel's standing rule (the same one
+    // `checkpoints[]` already applies through `keyed.errors`) is that a defect
+    // we can see fails.
     let eventBytes: Uint8Array | undefined;
+    let eventBytesMalformed = false;
     try {
       if (typeof ev.event_bytes === "string") eventBytes = hexToBytes(ev.event_bytes);
     } catch (e) {
-      evErrors.push(`event event_bytes is not hex: ${stringifyErr(e)}`);
+      eventBytesMalformed = true;
+      evErrors.push(`event event_bytes is not hex${thrownDetail(e)}`);
     }
     try {
       const res = await verifyEnvelope(
         ev.envelope,
         eventBytes !== undefined ? { payloadBytes: eventBytes } : {},
       );
-      envelopeOk = res.ok; // tolerates an undetermined binding (withheld record)
+      const hexError = envelopeHexError("event", ev.envelope);
+      // tolerates an undetermined binding (withheld record)
+      envelopeOk = res.ok && hexError === null;
       payloadBindingOk = res.payloadHashOk;
       // P-10: report what could not be determined, never a fault that was never
       // observed. There is no envelope here, so no signature was checked and no
@@ -2004,6 +2222,8 @@ async function verifyStampEvidence(
       // the producer at all (proof#76).
       if (!isJsonObject(ev.envelope)) {
         evErrors.push("event envelope is not a JSON object");
+      } else if (hexError !== null) {
+        evErrors.push(hexError);
       } else if (!res.signatureOk) {
         evErrors.push("event envelope signature failed");
       }
@@ -2014,7 +2234,7 @@ async function verifyStampEvidence(
       const specFinding = specVersionFinding("event", ev.envelope, res);
       if (specFinding !== null) evErrors.push(specFinding);
     } catch (e) {
-      evErrors.push(`event envelope verify error: ${stringifyErr(e)}`);
+      evErrors.push(`event envelope verify error${thrownDetail(e)}`);
     }
 
     // --- The join (§5.3.3 rule 1) -------------------------------------------
@@ -2077,7 +2297,7 @@ async function verifyStampEvidence(
             );
           }
         } catch (e) {
-          evErrors.push(`inclusion verify error: ${stringifyErr(e)}`);
+          evErrors.push(`inclusion verify error${thrownDetail(e)}`);
         }
       }
     }
@@ -2094,7 +2314,15 @@ async function verifyStampEvidence(
       // Named for §5.1's join; here it reports whether `stamp_ref` resolved.
       checkpointBound: stampBound,
       contentOk,
-      ok: envelopeOk && inclusionOk && stampBound && contentOk !== false && legacyError === null,
+      // `!eventBytesMalformed`: present-and-unreadable record bytes are a
+      // defect in the artifact, never a disclosure choice (proof#85).
+      ok:
+        envelopeOk &&
+        inclusionOk &&
+        stampBound &&
+        contentOk !== false &&
+        legacyError === null &&
+        !eventBytesMalformed,
       errors: evErrors,
     });
   }
@@ -2574,7 +2802,7 @@ async function verifyExportBody(
       );
     }
   } catch (e) {
-    errors.push(`source_bundle canonicalization failed: ${stringifyErr(e)}`);
+    errors.push(`source_bundle canonicalization failed${thrownDetail(e)}`);
   }
 
   // --- Step 4: recompute the source verdict ---------------------------------
@@ -2622,7 +2850,7 @@ async function verifyExportBody(
       );
     }
   } catch (e) {
-    errors.push(`verdict agreement comparison failed: ${stringifyErr(e)}`);
+    errors.push(`verdict agreement comparison failed${thrownDetail(e)}`);
   }
 
   // --- Step 7 already folded in by the source recompute ---------------------
@@ -2867,13 +3095,20 @@ async function verifyAttestation(
   try {
     payloadBytes = utf8(jcs(payload));
   } catch (e) {
-    return { result, malformed: `attestation payload canonicalization failed: ${stringifyErr(e)}` };
+    return { result, malformed: `attestation payload canonicalization failed${thrownDetail(e)}` };
   }
   try {
     result.signatureOk = await verifyRsaPssSha256(payloadBytes, rec.signature, rsaKey);
     if (!result.signatureOk) errs.push("attestation RSA-PSS signature verification failed");
-  } catch (e) {
-    return { result, malformed: `attestation ${stringifyErr(e)}` };
+  } catch {
+    // A FIXED sentence, not the library's. This kernel throws
+    // `verifyRsaPssSha256: malformed signature hex: ...` and the Python kernel
+    // raises `malformed signature hex: ...`, so quoting either one split the
+    // two kernels on a finding a holder can put in an export body it signs,
+    // and an export pack's findings reach a case reading through `reasons`
+    // (gate 4 on proof#140, finding 1). Callers of `verifyRsaPssSha256` still
+    // get this kernel's own words.
+    return { result, malformed: "attestation signature or key is malformed" };
   }
 
   // (b) operator-address binding: base64url(SHA-256(modulus)) == payload.operator.
@@ -2886,7 +3121,7 @@ async function verifyAttestation(
       );
     }
   } catch (e) {
-    return { result, malformed: `attestation operator key: ${stringifyErr(e)}` };
+    return { result, malformed: `attestation operator key${thrownDetail(e)}` };
   }
 
   // (c) checkpoint resolution + data_hash binding. The checkpoint tx data IS the
@@ -2911,7 +3146,7 @@ async function verifyAttestation(
         );
       }
     } catch (e) {
-      errs.push(`cannot recompute checkpoint content hash: ${stringifyErr(e)}`);
+      errs.push(`cannot recompute checkpoint content hash${thrownDetail(e)}`);
     }
   }
 
@@ -3278,7 +3513,7 @@ async function probeGateway(
   // the load-bearing check.
   if (toHex(onChainBytes) === expectedHex) return "confirm";
   try {
-    const parsed = JSON.parse(new TextDecoder().decode(onChainBytes));
+    const parsed = jcsParse(onChainBytes);
     if (toHex(utf8(jcs(parsed))) === expectedHex) return "confirm";
   } catch {
     // not JSON / not parseable — a genuine mismatch
@@ -3344,7 +3579,7 @@ function selectDisclosedBytes(
     try {
       inBody = hexToBytes(ev.content);
     } catch (e) {
-      errors.push(`event content is not hex: ${stringifyErr(e)}`);
+      errors.push(`event content is not hex${thrownDetail(e)}`);
     }
   }
   let side: Uint8Array | undefined;
@@ -3355,7 +3590,7 @@ function selectDisclosedBytes(
     try {
       side = hexToBytes(sideEntry.value);
     } catch (e) {
-      errors.push(`supplied content for ${eventId} is not hex: ${stringifyErr(e)}`);
+      errors.push(`supplied content for ${eventId} is not hex${thrownDetail(e)}`);
     }
   }
   // `offered` comes from the SAME test that produced the value, never from