@sanning/proof 0.11.0 → 0.11.1

package/dist/handoff.js

@@ -40,6 +40,9 @@
 //     compared absent to absent and found them equal.
 //   - A pair whose two envelope signing keys are equal does not verify.
 //   - Every hand-off record a reader holds is read, not only the ones that pair.
+//   - A formed pair verifies only when each record names the other's signer
+//     (v1.16, A21), or it fails `counterparty_named`. Up to 0.11.0 grading
+//     never read whom either record names.
 //
 // THE THREE ATTACKS THE ADVERSARIAL GATE LANDED (proof#133, rulings 1 to 3),
 // and they are one root cause: candidacy and the self-hand-off check compared
@@ -144,7 +147,7 @@ const HEX64 = /^[0-9a-fA-F]{64}$/;
 const LOWER_HEX64 = /^[0-9a-f]{64}$/;
 // The order a reader names the checks a formed pair failed, fixed so two
 // kernels report one list rather than two orderings of it.
-const CHECK_ORDER = ["message_hash", "sequence", "self_handoff"];
+const CHECK_ORDER = ["message_hash", "sequence", "self_handoff", "counterparty_named"];
 const VERDICT_RANK = { verified: 0, failed: 1, malformed: 2 };
 // ASCII whitespace, listed rather than delegated: `String.trim()` and Python's
 // `str.strip()` do not strip the same set (`U+FEFF` is whitespace to one and
@@ -478,6 +481,22 @@ function gradePair(subject, counterpart) {
         failed.add("message_hash");
     if (!sameNumber(subjectEvent.sequence, counterpartEvent.sequence))
         failed.add("sequence");
+    // Each record names the OTHER's signer (v1.16, A21). Candidacy reads the key
+    // the subject names and nothing the candidate says, so up to and including
+    // 0.11.0 a sent record addressed to C paired `verified` with B's receipt of
+    // it, and a receipt naming C as its sender paired `verified` with A's send.
+    // Both halves of the naming are graded, each against the envelope key the
+    // other record was SIGNED with, compared as a key. The Python half is
+    // `_grade_pair`.
+    const [sent, received] = eventType(subject) === "handoff.sent" ? [subject, counterpart] : [counterpart, subject];
+    const sentNames = normalizedSigningKey(section(sent.record, "event").counterparty_public_key);
+    const receivedNames = normalizedSigningKey(section(received.record, "event").counterparty_public_key);
+    // The send names who received it.
+    if (sentNames !== normalizedSigningKey(received.publicKey))
+        failed.add("counterparty_named");
+    // The receipt names who sent it.
+    if (receivedNames !== normalizedSigningKey(sent.publicKey))
+        failed.add("counterparty_named");
     const checks = CHECK_ORDER.filter((name) => failed.has(name));
     return { verdict: checks.length > 0 ? "failed" : "verified", checks: [...checks] };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sanning/proof",
-  "version": "0.11.0",
+  "version": "0.11.1",
   "description": "TypeScript kernel of the Sanning verification stack: RFC 8785 (JCS) canonicalization, SHA-256, and Ed25519 verification for Verifiable Event Envelopes. Full-family verifier (inline + external commitment); accepts sanning.agent/v1 and sanning.events/v2. Conformance-gated byte-for-byte against the test-vectors corpus.",
   "license": "MIT",
   "type": "module",

package/src/handoff.ts

@@ -40,6 +40,9 @@
 //     compared absent to absent and found them equal.
 //   - A pair whose two envelope signing keys are equal does not verify.
 //   - Every hand-off record a reader holds is read, not only the ones that pair.
+//   - A formed pair verifies only when each record names the other's signer
+//     (v1.16, A21), or it fails `counterparty_named`. Up to 0.11.0 grading
+//     never read whom either record names.
 //
 // THE THREE ATTACKS THE ADVERSARIAL GATE LANDED (proof#133, rulings 1 to 3),
 // and they are one root cause: candidacy and the self-hand-off check compared
@@ -147,7 +150,7 @@ const LOWER_HEX64 = /^[0-9a-f]{64}$/;
 
 // The order a reader names the checks a formed pair failed, fixed so two
 // kernels report one list rather than two orderings of it.
-const CHECK_ORDER = ["message_hash", "sequence", "self_handoff"] as const;
+const CHECK_ORDER = ["message_hash", "sequence", "self_handoff", "counterparty_named"] as const;
 const VERDICT_RANK: Record<string, number> = { verified: 0, failed: 1, malformed: 2 };
 
 // ASCII whitespace, listed rather than delegated: `String.trim()` and Python's
@@ -548,6 +551,23 @@ function gradePair(
   const counterpartHash = String(counterpartEvent.message_hash ?? "").toLowerCase();
   if (subjectHash !== counterpartHash) failed.add("message_hash");
   if (!sameNumber(subjectEvent.sequence, counterpartEvent.sequence)) failed.add("sequence");
+  // Each record names the OTHER's signer (v1.16, A21). Candidacy reads the key
+  // the subject names and nothing the candidate says, so up to and including
+  // 0.11.0 a sent record addressed to C paired `verified` with B's receipt of
+  // it, and a receipt naming C as its sender paired `verified` with A's send.
+  // Both halves of the naming are graded, each against the envelope key the
+  // other record was SIGNED with, compared as a key. The Python half is
+  // `_grade_pair`.
+  const [sent, received] =
+    eventType(subject) === "handoff.sent" ? [subject, counterpart] : [counterpart, subject];
+  const sentNames = normalizedSigningKey(section(sent.record, "event").counterparty_public_key);
+  const receivedNames = normalizedSigningKey(
+    section(received.record, "event").counterparty_public_key,
+  );
+  // The send names who received it.
+  if (sentNames !== normalizedSigningKey(received.publicKey)) failed.add("counterparty_named");
+  // The receipt names who sent it.
+  if (receivedNames !== normalizedSigningKey(sent.publicKey)) failed.add("counterparty_named");
   const checks = CHECK_ORDER.filter((name) => failed.has(name));
   return { verdict: checks.length > 0 ? "failed" : "verified", checks: [...checks] };
 }