@sanning/proof 0.12.0 → 0.14.0

package/vectors/jcs-reader.json

@@ -1,9 +1,9 @@
 {
   "rule": "jcs-reader",
-  "ruleVersion": 2,
-  "statement": "How a kernel reads bytes that claim to be JCS(value) (RFC 8785). Four checks, none of them left to a built-in decoder's defaults: strict UTF-8, no LEADING byte-order mark, no non-finite literal, and no UNPAIRED surrogate in the parsed value. The fourth is not the first one twice: a surrogate written as the ASCII escape `\\ud800` survives every byte-level check, because the bytes are ASCII, and the parser produces the malformed code unit afterwards. Everything else a JSON parser rejects is rejected. A reader that accepts any of the rejected cases here is reading a set of bytes some other reader will read differently, and a producer chooses those bytes: that is a split verdict on one pack, not a spelling preference. The accepted cases matter as much as the rejected ones -- an honest body carrying astral characters, noncharacters, a U+FEFF inside a string value or combining marks is conformant and must keep verifying.",
+  "ruleVersion": 3,
+  "statement": "How a kernel reads bytes that claim to be JCS(value) (RFC 8785). Five checks, none of them left to a built-in decoder's defaults: strict UTF-8, no LEADING byte-order mark, no non-finite literal, no object that names one member twice (I-JSON, RFC 7493; ruleVersion 3, proof#144), and no UNPAIRED surrogate in the parsed value. The fourth is not the first one twice: a surrogate written as the ASCII escape `\\ud800` survives every byte-level check, because the bytes are ASCII, and the parser produces the malformed code unit afterwards. Everything else a JSON parser rejects is rejected. A reader that accepts any of the rejected cases here is reading a set of bytes some other reader will read differently, and a producer chooses those bytes: that is a split verdict on one pack, not a spelling preference. The accepted cases matter as much as the rejected ones -- an honest body carrying astral characters, noncharacters, a U+FEFF inside a string value or combining marks is conformant and must keep verifying.",
   "home": "@sanning/proof -- ts/vectors/jcs-reader.json. This file is the RULE, not a test fixture of one implementation. TypeScript implements it in ts/src/verifier.ts as jcsParse and Python in src/sanning_proof/canonicalize.py as jcs_loads; ts/test/host-wording.test.ts and tests/test_host_wording.py hold BOTH kernels to this file, so neither can pass by agreeing with the other.",
-  "howToUse": "Base64-decode `bytesB64`, hand the bytes to your kernel's JCS reader, and assert that it returns a value where `accept` is true and throws or raises where it is false. Never decode to a string first: half of these cases are ABOUT the decode, and a reader tested through a string has not been tested.",
+  "howToUse": "Base64-decode `bytesB64`, hand the bytes to your kernel's JCS reader, and assert that it returns a value where `accept` is true and throws or raises where it is false. Never decode to a string first: half of these cases are ABOUT the decode, and a reader tested through a string has not been tested. Where a case carries `error`, the refusal's message is that exact string in both kernels: a duplicate's message is kernel wording, and a finding carries it.",
   "whyItExists": "Round four of proof#140 put a strict decoder on the TypeScript side of three sites and left json.loads(<bytes>) on the Python side of two. CPython hands bytes to detect_encoding and decodes with errors='surrogatepass', so Python became the LENIENT kernel: a sanning.anchor.trace/v3 pack whose checkpoint record bytes were BOM + JCS(record), re-sealed so the pack verifies, read `verified` with zero exceptions in Python and `mixed` in TypeScript. The full ladder, the case leg and CI were green over it. Both guards were source assertions over different module sets, and the TypeScript one stated the false premise in its own comment. One table both kernels read is the fix for that.",
   "cases": [
     {
@@ -161,6 +161,85 @@
       "bytesB64": "WzEsMiwzXQ==",
       "accept": true,
       "why": "a JSON array at the root. The reader returns it; whether a given site accepts a non-object is that site's check, not this one's"
+    },
+    {
+      "id": "duplicate-top-level",
+      "bytesB64": "eyJzcGVjX3ZlcnNpb24iOiJqdW5rIiwic3BlY192ZXJzaW9uIjoic2FubmluZy5ldmVudHMvdjIifQ==",
+      "accept": false,
+      "error": "duplicate key \"spec_version\"",
+      "why": "an object that names one member twice (proof#144). I-JSON (RFC 7493 section 2.3), which RFC 8785 is defined over, forbids it, and RFC 8785 cannot emit it. `json.loads` and `JSON.parse` both keep the LAST value and say nothing, so a reader that looks at the first sees junk while the kernel verifies the second"
+    },
+    {
+      "id": "duplicate-nested",
+      "bytesB64": "eyJldmVudCI6eyJtZXJrbGVfcm9vdCI6ImFhIiwibWVya2xlX3Jvb3QiOiJiYiJ9LCJwcmV2aW91c19oYXNoIjoiR0VORVNJUyJ9",
+      "accept": false,
+      "error": "duplicate key \"merkle_root\"",
+      "why": "the repeat is inside a nested object. Every level is checked, not only the root"
+    },
+    {
+      "id": "duplicate-escaped-spelling",
+      "bytesB64": "eyJhIjoxLCJcdTAwNjEiOjJ9",
+      "accept": false,
+      "error": "duplicate key \"a\"",
+      "why": "`\\u0061` is `a`. Names compare after unescaping, as both parsers compare them, so a second spelling of one name is still one name"
+    },
+    {
+      "id": "duplicate-innermost-first",
+      "bytesB64": "eyJhIjoxLCJhIjoyLCJiIjp7ImMiOjEsImMiOjJ9fQ==",
+      "accept": false,
+      "error": "duplicate key \"c\"",
+      "why": "two objects repeat a name. Objects are checked as they CLOSE, innermost first, so both kernels name `c` and not `a`: the rule for WHICH duplicate a message names, pinned because a finding carries it"
+    },
+    {
+      "id": "duplicate-name-rendered",
+      "bytesB64": "eyJcdTAwMDFcdWQ4M2RcdWRlMDBcIiI6MSwiXHUwMDAxXHVkODNkXHVkZTAwXCIiOjJ9",
+      "accept": false,
+      "error": "duplicate key \"\\u0001\\ud83d\\ude00\\\"\"",
+      "why": "the name in the message is rendered pure ASCII in both kernels: printable ASCII kept, a quote and a backslash escaped, every other UTF-16 code unit written \\uXXXX in lower case, so an astral character is its surrogate pair"
+    },
+    {
+      "id": "duplicate-name-truncated",
+      "bytesB64": "eyJra2tra2tra2tra2tra2tra2tra2tra2tra2tra2tra2tra2tra2tra2tra2tra2tra2tra2tra2tra2tra2tra2tra2tra2tra2tra2trayI6MSwia2tra2tra2tra2tra2tra2tra2tra2tra2tra2tra2tra2tra2tra2tra2tra2tra2tra2tra2tra2tra2tra2tra2tra2tra2tra2tra2siOjJ9",
+      "accept": false,
+      "error": "duplicate key \"kkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkk\"...",
+      "why": "a rendered name longer than 64 characters is cut there and `...` follows the closing quote, so a hostile name cannot flood a finding"
+    },
+    {
+      "id": "duplicate-backslash-at-string-end",
+      "bytesB64": "eyJrIjoiXFwiLCJrIjoxfQ==",
+      "accept": false,
+      "error": "duplicate key \"k\"",
+      "why": "a string value ending in an escaped backslash. A scanner that reads `\\\\\"` as an escaped quote runs past the end of the string and misses the repeat"
+    },
+    {
+      "id": "duplicate-then-non-finite",
+      "bytesB64": "eyJ4Ijp7ImEiOjEsImEiOjJ9LCJiIjpOYU59",
+      "accept": false,
+      "why": "a repeat AND a non-finite literal. The parse runs to the end before any repeat is reported, so these bytes fail as JSON in both kernels and never as a duplicate: `JSON.parse` has to finish before a scan can start, and a Python hook that raised on the repeat would name a duplicate where TypeScript names a syntax error"
+    },
+    {
+      "id": "same-name-sibling-objects",
+      "bytesB64": "W3siYSI6MX0seyJhIjoyfV0=",
+      "accept": true,
+      "why": "one name in two different objects is not a repeat"
+    },
+    {
+      "id": "same-name-nested",
+      "bytesB64": "eyJhIjp7ImEiOjF9fQ==",
+      "accept": true,
+      "why": "one name at two depths is not a repeat"
+    },
+    {
+      "id": "braces-and-quotes-inside-strings",
+      "bytesB64": "eyJhXCJ9eyI6MSwiYiI6IntcImFcIjoxLFwiYVwiOjJ9In0=",
+      "accept": true,
+      "why": "a name holding a quote and braces, and a string VALUE holding JSON text with a repeat in it. Neither is an object, so neither is a repeat"
+    },
+    {
+      "id": "case-variant-names",
+      "bytesB64": "eyJzcGVjX3ZlcnNpb24iOiJzYW5uaW5nLmV2ZW50cy92MiIsIlNwZWNfVmVyc2lvbiI6Imp1bmsiLCJcdTAxN2ZwZWNfdmVyc2lvbiI6Imp1bmsifQ==",
+      "accept": true,
+      "why": "names that differ only in case, or by a look-alike such as the long s U+017F, are DIFFERENT names to I-JSON and to both parsers, and this rule does not refuse them. No spec in this repository pins how a reader treats a key that folds to a defined one; to every reader here it is an unknown member, and unknown members are ignored. The Go bundle reader in sanning-io/agent refuses these at the top level of a bundle, which is a recorded Go divergence (proof#144)"
     }
   ]
 }

package/vectors/pack-grading.json

@@ -1,15 +1,17 @@
 {
   "rule": "pack-grading",
-  "ruleVersion": 5,
-  "statement": "What a verification surface may CLAIM about a pack it was handed. verified is reachable ONLY when every record's own bytes bound to its own commitment and nothing is missing, unreadable, surplus or omitted. Absent or unreadable evidence is incomplete (UNKNOWN), never failed and never verified. A hard kernel verdict wins: malformed > failed > incomplete > the kernel's own headline. A pack that DEVIATES from its own signed declaration (evidence-bundle.md \u00a75.4) is failed, and every deviation is a cause: a declared record that is absent, a present record nobody declared, or a record the pack declared withheld whose bytes its own SIGNED BODY supplies. A reading that rests instead on the UNSIGNED content handed in beside a pack is not a deviation and never reaches failed (proof#147): each content-dependent finding is its own cause and carries the pack to incomplete, because whoever assembles a case fills that map in, so an accuser holding an intact pack could otherwise reach failed with no key at all. A deviation and a content-dependent finding together are still failed, because the deviation reads off the signed body and a failing check wins. A declaration check that came back partial therefore splits in THREE, and only two of the three turn on the declaration's readability: no declaration member in the body at all moves nothing, because every pack built before \u00a75.4 is that case; a declaration the reader CANNOT READ makes the pack incomplete, because declaration_version is chosen by the party that assembles the pack and has no accept-set, so an unreadable claim must never reach a clean verdict; and a declaration the reader read perfectly well whose disclosure only unsigned bytes could settle makes the pack incomplete as well, named as what the reader could not establish rather than as what the holder did. The grade carries the declaration check verdict in its own output field, so a consumer that keeps only the grade can still tell a declared pack from an undeclared one.",
+  "ruleVersion": 6,
+  "statement": "What a verification surface may CLAIM about a pack it was handed. verified is reachable ONLY when every record's own bytes bound to its own commitment and nothing is missing, unreadable, surplus or omitted. Absent or unreadable evidence is incomplete (UNKNOWN), never failed and never verified. A hard kernel verdict wins: malformed > failed > incomplete > the kernel's own headline. A pack that DEVIATES from its own signed declaration (evidence-bundle.md \u00a75.4) is failed, and every deviation is a cause: a declared record that is absent, a present record nobody declared, or a record the pack declared withheld whose bytes its own SIGNED BODY supplies. A reading that rests instead on the UNSIGNED content handed in beside a pack is not a deviation and never reaches failed (proof#147): each content-dependent finding is its own cause and carries the pack to incomplete, because whoever assembles a case fills that map in, so an accuser holding an intact pack could otherwise reach failed with no key at all. A deviation and a content-dependent finding together are still failed, because the deviation reads off the signed body and a failing check wins. A declaration check that came back partial therefore splits in THREE, and only two of the three turn on the declaration's readability: no declaration member in the body at all moves nothing, because every pack built before \u00a75.4 is that case; a declaration the reader CANNOT READ makes the pack incomplete, because declaration_version is chosen by the party that assembles the pack and has no accept-set, so an unreadable claim must never reach a clean verdict; and a declaration the reader read perfectly well whose disclosure only unsigned bytes could settle makes the pack incomplete as well, named as what the reader could not establish rather than as what the holder did. The grade carries the declaration check verdict in its own output field, so a consumer that keeps only the grade can still tell a declared pack from an undeclared one. Rule version 6 (evidence-bundle.md \u00a75.4.5 v1.20, A22): a record is WITHHELD BY ITS DECLARATION when a readable declaration lists it in declared_withheld, its ok is true, its contentOk is null and its payloadBindingOk is true; it counts in recordsWithheld and never in recordsVerified, it is taken out of expected and missing before the disclosure causes are computed, and it holds the pack at nothing, so a pack whose every record its declaration withholds grades verified with recordsVerified zero. A record that fails any of the four, a pack with no readable declaration, and an input that does not carry eventId and payloadBindingOk keep rule version 5's reading.",
   "home": "@sanning/proof — ts/vectors/pack-grading.json. This file is the RULE, not a test fixture of one implementation. The kernel implements it in ts/src/grading.ts and is held to it by ts/test/grading.test.ts.",
   "consumers": "A surface that grades packs SHOULD call the kernel's gradePack rather than derive the rule again. A surface that cannot yet (an older pinned kernel, another language) vendors this file byte-for-byte, asserts its own derivation against it, and runs a drift check that compares its copy against the copy shipped in the @sanning/proof tarball at vectors/pack-grading.json. A vendored copy that is not byte-identical to this one is a defect, not a variant.",
-  "howToUse": "Adapt a kernel verification result and a disclosure account into the shapes below, call gradePack, and assert the expectations. `kernel` gives the per-event outcome classes the kernel returns; `logs` gives the account of which records disclosed bytes; `omissions` gives the signed-leaf_count completeness notes. Nothing here depends on how the bytes were transported: a directory read and a browser drop produce the same account and must produce the same verdict. `declaration`, where a case carries one, gives the declaration check's verdict, whether the body carried a declaration member at all, and how many deviations it found; pass a check of that shape as gradePack's optional fourth argument. A case with no `declaration` key calls gradePack with three arguments, which is the pre-§5.4 behavior and must not move, and its `expect.declaration` is absent.",
+  "howToUse": "Adapt a kernel verification result and a disclosure account into the shapes below, call gradePack, and assert the expectations. `kernel` gives the per-event outcome classes the kernel returns; `logs` gives the account of which records disclosed bytes; `omissions` gives the signed-leaf_count completeness notes. Nothing here depends on how the bytes were transported: a directory read and a browser drop produce the same account and must produce the same verdict. `declaration`, where a case carries one, gives the declaration check's verdict, whether the body carried a declaration member at all, and how many deviations it found; pass a check of that shape as gradePack's optional fourth argument. A case with no `declaration` key calls gradePack with three arguments, which is the pre-§5.4 behavior and must not move, and its `expect.declaration` is absent. Rule version 6: `kernel.withheldBound` and `kernel.withheldUnbound` events carry eventId withheld-0, withheld-1 and so on, in that order, and payloadBindingOk true and null respectively, unless `kernel.v5Adapter` is true, in which case they carry neither field; `logs.withheld` adds that many of those ids to the account's expected AND missing lists, after the counted ones; `declaration.declaredWithheld` is how many of them, from withheld-0, the check lists in declared_withheld (0 where absent); and `expect.recordsWithheld`, where present, is the grade's count of records withheld by their declaration.",
   "kernelEventClasses": {
     "okBound": "{ ok: true, contentOk: true } — the record's own bytes hashed to its own commitment",
     "okUnknown": "{ ok: true, contentOk: null } — structurally fine, but no bytes were disclosed",
     "mismatched": "{ ok: false, contentOk: false } — the bytes disagree with the commitment",
-    "brokenNoContent": "{ ok: false, contentOk: null } — the record itself does not verify"
+    "brokenNoContent": "{ ok: false, contentOk: null } — the record itself does not verify",
+    "withheldBound": "{ eventId: withheld-<i>, ok: true, contentOk: null, payloadBindingOk: true } — no content bound, the record bytes bound to the envelope (rule version 6)",
+    "withheldUnbound": "{ eventId: withheld-<i>, ok: true, contentOk: null, payloadBindingOk: null } — no content bound, and the record bytes did not travel either (rule version 6)"
   },
   "cases": [
     {
@@ -259,6 +261,68 @@
       "omissions": [],
       "declaration": { "verdict": "partial", "present": true, "deviations": 0 },
       "expect": { "verdict": "incomplete", "recordsVerified": 26, "recordsFailed": 0, "recordsUndetermined": 0, "causeCount": 0, "declaration": "partial" }
+    },
+    {
+      "id": "withheld-by-declaration",
+      "why": "rule version 6, D5. One record the pack's readable declaration lists as content_withheld, whose record bytes bound to its envelope and whose content did not travel. Withholding it is the holder's signed act, so it holds the pack at nothing: verified, counted apart from the two records whose content bound. `logs.withheld` names the records that are both in the account's expected list and in its missing list under the withheld records' own ids",
+      "kernel": { "status": "verified", "okBound": 2, "okUnknown": 0, "mismatched": 0, "brokenNoContent": 0, "withheldBound": 1, "withheldUnbound": 0 },
+      "logs": { "expected": 3, "present": 2, "missing": 0, "unreadable": 0, "extra": 0, "withheld": 1 },
+      "omissions": [],
+      "declaration": { "verdict": "verified", "present": true, "deviations": 0, "declaredWithheld": 1 },
+      "expect": { "verdict": "verified", "recordsVerified": 2, "recordsFailed": 0, "recordsUndetermined": 0, "recordsWithheld": 1, "causeCount": 0, "declaration": "verified" }
+    },
+    {
+      "id": "every-record-withheld-by-declaration",
+      "why": "the cost of D5, stated rather than left to be found: every record withheld by the declaration grades verified with recordsVerified ZERO and no content byte hashed. It is safe to print only because the count travels, and a surface MUST NOT count these as verified records",
+      "kernel": { "status": "verified", "okBound": 0, "okUnknown": 0, "mismatched": 0, "brokenNoContent": 0, "withheldBound": 26, "withheldUnbound": 0 },
+      "logs": { "expected": 26, "present": 0, "missing": 0, "unreadable": 0, "extra": 0, "withheld": 26 },
+      "omissions": [],
+      "declaration": { "verdict": "verified", "present": true, "deviations": 0, "declaredWithheld": 26 },
+      "expect": { "verdict": "verified", "recordsVerified": 0, "recordsFailed": 0, "recordsUndetermined": 0, "recordsWithheld": 26, "causeCount": 0, "declaration": "verified" }
+    },
+    {
+      "id": "withheld-record-bytes-too",
+      "why": "the declaration withholds the record's content, and the pack withholds its record bytes as well, so its payload binding is undetermined: what is withheld is not only its content, and the fourth condition fails. Rule version 5's reading: incomplete, no_disclosure",
+      "kernel": { "status": "verified", "okBound": 0, "okUnknown": 0, "mismatched": 0, "brokenNoContent": 0, "withheldBound": 0, "withheldUnbound": 1 },
+      "logs": { "expected": 1, "present": 0, "missing": 0, "unreadable": 0, "extra": 0, "withheld": 1 },
+      "omissions": [],
+      "declaration": { "verdict": "verified", "present": true, "deviations": 0, "declaredWithheld": 1 },
+      "expect": { "verdict": "incomplete", "recordsVerified": 0, "recordsFailed": 0, "recordsUndetermined": 1, "recordsWithheld": 0, "causeCount": 1, "declaration": "verified" }
+    },
+    {
+      "id": "withheld-no-declaration",
+      "why": "the records of withheld-by-declaration with NO declaration. Only a declaration makes withholding a signed act; without one, absent content is indistinguishable from content lost in transit, so the record is undetermined and the pack is incomplete (missing_disclosure), exactly as rule version 5 graded it",
+      "kernel": { "status": "verified", "okBound": 2, "okUnknown": 0, "mismatched": 0, "brokenNoContent": 0, "withheldBound": 1, "withheldUnbound": 0 },
+      "logs": { "expected": 3, "present": 2, "missing": 0, "unreadable": 0, "extra": 0, "withheld": 1 },
+      "omissions": [],
+      "expect": { "verdict": "incomplete", "recordsVerified": 2, "recordsFailed": 0, "recordsUndetermined": 1, "recordsWithheld": 0, "causeCount": 1 }
+    },
+    {
+      "id": "withheld-unreadable-declaration",
+      "why": "the records of withheld-by-declaration beside a declaration that is present and that this reader cannot read. Its declared_withheld is empty, so nothing is withheld by it, and the pack is incomplete for the absent content and for the unreadable claim both",
+      "kernel": { "status": "verified", "okBound": 2, "okUnknown": 0, "mismatched": 0, "brokenNoContent": 0, "withheldBound": 1, "withheldUnbound": 0 },
+      "logs": { "expected": 3, "present": 2, "missing": 0, "unreadable": 0, "extra": 0, "withheld": 1 },
+      "omissions": [],
+      "declaration": { "verdict": "partial", "present": true, "deviations": 0, "declaredWithheld": 0 },
+      "expect": { "verdict": "incomplete", "recordsVerified": 2, "recordsFailed": 0, "recordsUndetermined": 1, "recordsWithheld": 0, "causeCount": 1, "declaration": "partial" }
+    },
+    {
+      "id": "withheld-and-side-bytes",
+      "why": "a record withheld by its declaration, and a content-dependent finding on the pack: bytes nobody signed that do not line up with the claim. The record is still withheld by the declaration and counted so, and the finding is its own cause, so the pack is incomplete and never failed",
+      "kernel": { "status": "verified", "okBound": 2, "okUnknown": 0, "mismatched": 0, "brokenNoContent": 0, "withheldBound": 1, "withheldUnbound": 0 },
+      "logs": { "expected": 3, "present": 2, "missing": 0, "unreadable": 0, "extra": 0, "withheld": 1 },
+      "omissions": [],
+      "declaration": { "verdict": "partial", "present": true, "deviations": 0, "contentFindings": 1, "declaredWithheld": 1 },
+      "expect": { "verdict": "incomplete", "recordsVerified": 2, "recordsFailed": 0, "recordsUndetermined": 0, "recordsWithheld": 1, "causeCount": 1, "declaration": "partial" }
+    },
+    {
+      "id": "withheld-v5-adapter",
+      "why": "withheld-by-declaration graded through an adapter written for rule version 5, whose events carry neither eventId nor payloadBindingOk (`kernel.v5Adapter`). Such an input is never withheld by its declaration, so the adapter loses the exemption and keeps the stricter reading: incomplete, missing_disclosure",
+      "kernel": { "status": "verified", "okBound": 2, "okUnknown": 0, "mismatched": 0, "brokenNoContent": 0, "withheldBound": 1, "withheldUnbound": 0, "v5Adapter": true },
+      "logs": { "expected": 3, "present": 2, "missing": 0, "unreadable": 0, "extra": 0, "withheld": 1 },
+      "omissions": [],
+      "declaration": { "verdict": "verified", "present": true, "deviations": 0, "declaredWithheld": 1 },
+      "expect": { "verdict": "incomplete", "recordsVerified": 2, "recordsFailed": 0, "recordsUndetermined": 1, "recordsWithheld": 0, "causeCount": 1, "declaration": "verified" }
     }
   ]
 }

package/vectors/stamp-on-chain.json

@@ -1,10 +1,10 @@
 {
   "rule": "stamp-on-chain",
-  "ruleVersion": 1,
+  "ruleVersion": 3,
   "statement": "What re-fetching a stamp's witness from a gateway DOES and DOES NOT settle. A stamp body carries no producer signature and no inclusion proof of its own, so the witness is the entire independent part of it (evidence-bundle.md §5.2.4): confirming that a gateway holds the exact bytes named by anchor_ref is the only check that turns Sanning's own assertion into evidence. It is an ONLINE act and always optional — an offline verdict is unchanged by it and never claims it happened. Four states, never three: not-checked (no gateway was asked, or the stamp names no witness), confirm (a gateway returned the witnessed bytes), mismatch (a gateway returned DIFFERENT bytes — the only outcome that fails anything), unreachable (we asked and nobody answered — an availability gap, never an accusation). The expected bytes are stamps[].stamp_bytes VERBATIM, because §5.2.2 defines that field as the exact bytes handed to the witness; re-canonicalizing them would compare the chain against bytes nobody signed.",
   "home": "@sanning/proof — ts/vectors/stamp-on-chain.json. This file is the RULE, not a test fixture of one implementation. The TypeScript kernel implements it in ts/src/evidence.ts (refetchStamps / refetchStamp / probeGateway / rollupOnChain) and is held to it by ts/test/stamp-on-chain-vectors.test.ts; the Python kernel implements it in src/sanning_proof/evidence.py (_refetch_stamps / _refetch_stamp / _probe_gateway / _rollup_on_chain) and is held to the SAME file by tests/test_stamp_on_chain_vectors.py. Neither kernel can pass by agreeing with the other.",
   "consumers": "A surface that re-fetches a stamp witness SHOULD call the kernel's verifyEvidenceBundle with `gateways` rather than derive the rule again. A surface that cannot yet (an older pinned kernel, another language) vendors this file byte-for-byte, asserts its own derivation against it, and runs a drift check against the copy shipped in the @sanning/proof tarball at vectors/stamp-on-chain.json — failing when it cannot find a copy to compare against. A vendored copy that is not byte-identical to this one is a defect, not a variant. In particular: a surface MUST NOT collapse the four states into a boolean. A reader that cannot distinguish not-checked from unreachable will report that no gateway could be reached when none was tried, which is a false accusation manufactured by a missing state, and is the defect this table was written after.",
-  "howToUse": "Each case describes one sanning.stamp.evidence/v2 pack and one set of scripted gateway responses. Build the pack from `packScaffold`: for each entry of `stamps` (index i, 0-based) sign ONE sanning.events/v2 envelope over the record {\"event\":{\"content_hash\":\"<64×a>\"},\"i\":i} with event_id `ev-<i>` and the fixed seed, take its leaf under RFC 9162 (SHA-256(0x00 ‖ JCS(envelope))), make a one-leaf tree, and build the stamp body from `stampBodyScaffold` with merkle_root = that root, leaf_count = 1 and one sub-tree covering [0,1). stamp_bytes is JCS(stamp body) hex-encoded; stamp_ref is SHA-256 of the DECODED bytes. When the entry's `witnessed` is true attach anchor_ref = {kind: \"arweave\", id: `<anchorIdPrefix><i>`}, otherwise omit anchor_ref entirely. Give each stamp one event whose inclusion is {stamp_ref, leaf_index: 0, leaf_count: 1, leaf_hash, audit_path: []}. Wrap the body per `wrapperScaffold`, set body_hash = SHA-256(JCS(body)) and sign the wrapper (minus `signature`) with the same seed. Then call the kernel with the case's `gateways` and a fetch seam that answers `{gateway}/{anchor id}` per the `returns` entry for that stamp at that gateway's index, and assert `expect`. A case with an empty `gateways` list is called with no gateway list at all, that is the not-checked state and it must be reachable without a fetch seam.",
+  "howToUse": "Each case describes one sanning.stamp.evidence/v2 pack and one set of scripted gateway responses. Build the pack from `packScaffold`: for each entry of `stamps` (index i, 0-based) sign ONE sanning.events/v2 envelope over the record {\"event\":{\"content_hash\":\"<64×a>\"},\"i\":i} with event_id `ev-<i>` and the fixed seed, take its leaf under RFC 9162 (SHA-256(0x00 ‖ JCS(envelope))), make a one-leaf tree, and build the stamp body from `stampBodyScaffold` with merkle_root = that root, leaf_count = 1 and one sub-tree covering [0,1). stamp_bytes is JCS(stamp body) hex-encoded; stamp_ref is SHA-256 of the DECODED bytes. When the entry's `witnessed` is true attach anchor_ref = {kind: entry's `kind` (default \"arweave\"), id: `<anchorIdPrefix><i>`}, otherwise omit anchor_ref entirely. Give each stamp one event whose inclusion is {stamp_ref, leaf_index: 0, leaf_count: 1, leaf_hash, audit_path: []}. Wrap the body per `wrapperScaffold`, set body_hash = SHA-256(JCS(body)) and sign the wrapper (minus `signature`) with the same seed. Then call the kernel with the case's `gateways` and a fetch seam that answers `{gateway}/{anchor id}` per the `returns` entry for that stamp at that gateway's index, and assert `expect`. A case with an empty `gateways` list is called with no gateway list at all, that is the not-checked state and it must be reachable without a fetch seam. Only an `arweave` witness whose id is a 43-character base64url string is ever fetched (proof#115): a stamp naming any other `kind` is never probed, whatever its id looks like, and stays `ok` with `onChain: null`.",
   "responseKinds": {
     "witnessed": "The exact decoded stamp_bytes. The honest chain.",
     "altered": "JCS of the same stamp body with interval_end changed to 2026-09-09T13:00:00.000Z — a well-formed, canonical, semantically different stamp. This is the forgery shape that matters: a pack built on it is fully self-consistent OFFLINE and lies only about what was witnessed.",
@@ -16,7 +16,7 @@
   "anchorIdPrefix": "stampOnChainFixtureAnchorId00000000000000-",
   "packScaffold": {
     "seedHex": "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef",
-    "eventIdPrefix": "ev-",
+    "eventIdPrefix": "00000000-0000-4000-8000-00000000000",
     "contentHash": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
     "signedAt": "2026-09-09T12:00:00Z",
     "environment": "production"
@@ -150,13 +150,13 @@
     },
     {
       "id": "unwitnessed-stamp-is-not-checked-never-unreachable",
-      "why": "A stamp with no anchor_ref names no witness, so there is nothing to ask any gateway for. onChain stays null — not-checked — even though gateways were supplied and every one of them is reachable. Reporting all-unreachable here would invent a network event that did not occur, and would move this pack's exit code from 0 to 3 purely because the caller passed a gateway list. The bundle is already `partial` for the right reason, said in the right words, by §5.2.4.",
+      "why": "A stamp with no anchor_ref names no witness, so there is nothing to ask any gateway for. onChain stays null — not-checked — even though gateways were supplied and every one of them is reachable. Reporting all-unreachable here would invent a network event that did not occur. The bundle is already `partial` for the right reason, said in the right words, by §5.2.4, and exits 3 for that reason with or without a gateway list (0.13.0: `partial` exits 3 in every verb).",
       "gateways": ["https://g1.example"],
       "stamps": [{ "witnessed": false, "returns": ["witnessed"] }],
       "expect": {
         "onChainChecked": true,
         "status": "partial",
-        "exit": 0,
+        "exit": 3,
         "stamps": [{ "rollup": null, "onChainOk": null, "ok": true }],
         "bundleErrorsContain": ["sealed by Sanning, witnessed by nobody"]
       }
@@ -224,6 +224,21 @@
           "sealed by Sanning, witnessed by nobody"
         ]
       }
+    },
+    {
+      "id": "unknown-kind-witness-is-not-checked-never-mismatch",
+      "why": "proof#115: a witness whose kind names no adapter this verifier has is never fetched, whatever gateways were passed and whatever its id looks like. Fetching it anyway, and comparing the response against stamp_bytes, is how a gateway that has never heard of the kind gets read as a mismatch or a 404 gets read as unreachable — both an accusation this verifier has no grounds to make. The bundle stays partial, said in the kind note, and the stamp itself stays ok with no on-chain result at all: not-checked, not unreachable.",
+      "gateways": ["https://g1.example"],
+      "stamps": [{ "witnessed": true, "kind": "memory", "returns": ["witnessed"] }],
+      "expect": {
+        "onChainChecked": true,
+        "status": "partial",
+        "exit": 3,
+        "stamps": [{ "rollup": null, "onChainOk": null, "ok": true }],
+        "bundleErrorsContain": [
+          "one or more stamps name a witness kind this verifier has no adapter for, so it could not be re-fetched"
+        ]
+      }
     }
   ]
 }