@sanning/proof 0.15.0 → 0.17.0

package/src/file-match.ts

@@ -70,6 +70,30 @@ export const NOT_READ_REASONS = [
 
 export type NotReadReason = (typeof NOT_READ_REASONS)[number];
 
+/**
+ * Why a file was named in the report and never hashed (5.7.5). A skipped file
+ * is listed, never dropped: every file a command found is matched, unmatched or
+ * skipped, so "no match" is never read as "no file was there".
+ */
+export const SKIPPED_REASONS = [
+  "symbolic_link",
+  "not_regular",
+  "unreadable",
+  "too_large",
+  "refused",
+] as const;
+
+export type SkippedReason = (typeof SKIPPED_REASONS)[number];
+
+const SKIPPED_TEXT: Record<SkippedReason, string> = {
+  symbolic_link: "a symbolic link: not followed, not read",
+  not_regular: "not a regular file: not read",
+  unreadable: "could not be read",
+  too_large: "past the 1 GiB read from folders in one run: not read",
+  // Followed by the reader's own words, `renderSkipped`.
+  refused: "a .zip entry the reader refused",
+};
+
 const REASON_TEXT: Record<NotReadReason, string> = {
   no_records: "this bundle carries no records this reading can read",
   record_unreadable: "its record bytes cannot be read",
@@ -94,6 +118,14 @@ export interface FileCommitment {
   contentHash: string;
   signer: string;
   signedAt: string | null;
+  /**
+   * The pack, by its position in the packs `matchCaseFiles` was handed (the
+   * same position the case reading's `packIndex` names), or `null` from
+   * `matchFiles`, which reads one pack (A43).
+   */
+  packIndex: number | null;
+  /** The record, by its position in the events the pack presents (A43). */
+  recordIndex: number;
 }
 
 export interface MatchedFile {
@@ -107,10 +139,25 @@ export interface UnmatchedFile {
   sha256: string;
 }
 
+/** A file a command found and did not hash, named with the reason. */
+export interface SkippedFile {
+  name: string;
+  reason: SkippedReason;
+  /** The reader's own words, for a `.zip` entry it refused (`refused`). */
+  detail?: string;
+}
+
 export interface NotRead {
   packRef: string | null;
   eventId: string | null;
   reason: NotReadReason;
+  /** As on `FileCommitment` (A43). */
+  packIndex: number | null;
+  /**
+   * As on `FileCommitment`, or `null` where the pack presents no events at all
+   * (`no_records`).
+   */
+  recordIndex: number | null;
 }
 
 export interface FileMatchReading {
@@ -120,13 +167,22 @@ export interface FileMatchReading {
   notOffered: FileCommitment[];
   notRead: NotRead[];
   scope: string;
+  /**
+   * Files found and not hashed. The matching functions leave it empty: it is
+   * the caller's, because only a caller that reads a folder knows a link.
+   */
+  skipped?: SkippedFile[];
 }
 
-/** A file handed in beside a pack. `name` is a label and is never compared. */
-export interface OfferedFile {
-  name: string;
-  bytes: Uint8Array;
-}
+/**
+ * A file handed in beside a pack. `name` is a label and is never compared. The
+ * file is its `bytes`, or its `sha256` (64 lowercase hex characters) where the
+ * caller has already hashed it: a command streams a file of any size rather
+ * than hold it.
+ */
+export type OfferedFile =
+  | { name: string; bytes: Uint8Array; sha256?: undefined }
+  | { name: string; sha256: string; bytes?: undefined };
 
 /** One pack of a case, for `matchCaseFiles`. */
 export interface FileMatchPack {
@@ -197,17 +253,18 @@ async function readPack(
   bundle: unknown,
   content: SideContentMap | null | undefined,
   packRef: string | null,
+  packIndex: number | null,
 ): Promise<{ commitments: FileCommitment[]; notRead: NotRead[] }> {
   const commitments: FileCommitment[] = [];
   const notRead: NotRead[] = [];
   const events = resolveTraceEvents(bundle) as unknown[] | undefined;
   if (events === undefined) {
-    notRead.push({ packRef, eventId: null, reason: "no_records" });
+    notRead.push({ packRef, eventId: null, reason: "no_records", packIndex, recordIndex: null });
     return { commitments, notRead };
   }
-  for (const ev of events) {
+  for (const [recordIndex, ev] of events.entries()) {
     if (!isObject(ev)) {
-      notRead.push({ packRef, eventId: null, reason: "record_unreadable" });
+      notRead.push({ packRef, eventId: null, reason: "record_unreadable", packIndex, recordIndex });
       continue;
     }
     const envelope = own(ev, "envelope");
@@ -218,7 +275,7 @@ async function readPack(
     if (rawBytes !== undefined && rawBytes !== null) {
       eventBytes = typeof rawBytes === "string" ? decode(rawBytes) : undefined;
       if (eventBytes === undefined) {
-        notRead.push({ packRef, eventId, reason: "record_unreadable" });
+        notRead.push({ packRef, eventId, reason: "record_unreadable", packIndex, recordIndex });
         continue;
       }
     }
@@ -228,15 +285,15 @@ async function readPack(
       acceptedSpecMajors: RECORD_PROFILES,
     });
     if (!result.ok || !isObject(envelope) || !envelopeSpelled(envelope)) {
-      notRead.push({ packRef, eventId, reason: "record_not_verified" });
+      notRead.push({ packRef, eventId, reason: "record_not_verified", packIndex, recordIndex });
       continue;
     }
     if (eventBytes === undefined) {
-      notRead.push({ packRef, eventId, reason: "record_withheld" });
+      notRead.push({ packRef, eventId, reason: "record_withheld", packIndex, recordIndex });
       continue;
     }
     if (result.payloadHashOk !== true) {
-      notRead.push({ packRef, eventId, reason: "record_not_verified" });
+      notRead.push({ packRef, eventId, reason: "record_not_verified", packIndex, recordIndex });
       continue;
     }
     let record: unknown;
@@ -246,7 +303,7 @@ async function readPack(
       record = undefined;
     }
     if (!isObject(record)) {
-      notRead.push({ packRef, eventId, reason: "record_unreadable" });
+      notRead.push({ packRef, eventId, reason: "record_unreadable", packIndex, recordIndex });
       continue;
     }
 
@@ -264,12 +321,12 @@ async function readPack(
     if (isHandoffNamespace(held)) {
       const messageHash = own(event, "message_hash");
       if (!isConformantHandoffRecord(held) || !isHexField(messageHash, 64, true)) {
-        notRead.push({ packRef, eventId, reason: "handoff_record_malformed" });
+        notRead.push({ packRef, eventId, reason: "handoff_record_malformed", packIndex, recordIndex });
         continue;
       }
       const message = await messageOf(ev, eventId, messageHash, content);
       if (message === ABSENT) {
-        notRead.push({ packRef, eventId, reason: "message_withheld" });
+        notRead.push({ packRef, eventId, reason: "message_withheld", packIndex, recordIndex });
         continue;
       }
       const parts = isObject(message) ? own(message, "parts") : undefined;
@@ -284,6 +341,8 @@ async function readPack(
             contentHash: ((part as { content_hash: string }).content_hash).toLowerCase(),
             signer,
             signedAt,
+            packIndex,
+            recordIndex,
           });
         });
       }
@@ -292,7 +351,7 @@ async function readPack(
 
     const contentHash = own(event, "content_hash");
     if (!isHexField(contentHash, 64)) {
-      notRead.push({ packRef, eventId, reason: "no_content_hash" });
+      notRead.push({ packRef, eventId, reason: "no_content_hash", packIndex, recordIndex });
       continue;
     }
     commitments.push({
@@ -303,6 +362,8 @@ async function readPack(
       contentHash: contentHash.toLowerCase(),
       signer,
       signedAt,
+      packIndex,
+      recordIndex,
     });
   }
   return { commitments, notRead };
@@ -314,8 +375,17 @@ async function offeredDigests(files: readonly OfferedFile[]): Promise<[string, s
   const out: [string, string][] = [];
   for (const entry of files) {
     if (!isObject(entry)) throw new TypeError("matchFiles: each file is an object {name, bytes}");
-    const { name, bytes } = entry as { name?: unknown; bytes?: unknown };
+    const { name, bytes, sha256 } = entry as { name?: unknown; bytes?: unknown; sha256?: unknown };
     if (typeof name !== "string") throw new TypeError("matchFiles: a file's name is a string");
+    if (sha256 !== undefined && sha256 !== null) {
+      if ((bytes !== undefined && bytes !== null) || !isHexField(sha256, 64, true)) {
+        throw new TypeError(
+          "matchFiles: a file is {name, bytes} or {name, sha256}, and a sha256 is 64 lowercase hex characters",
+        );
+      }
+      out.push([name, sha256]);
+      continue;
+    }
     if (!(bytes instanceof Uint8Array)) {
       throw new TypeError("matchFiles: a file's bytes are a Uint8Array");
     }
@@ -352,6 +422,7 @@ async function match(
     notOffered: commitments.filter((_, i) => !used.has(i)),
     notRead,
     scope: FILE_MATCH_SCOPE,
+    skipped: [],
   };
 }
 
@@ -366,7 +437,7 @@ export async function matchFiles(
   files: readonly OfferedFile[],
   content?: SideContentMap | null,
 ): Promise<FileMatchReading> {
-  const { commitments, notRead } = await readPack(bundle, content, null);
+  const { commitments, notRead } = await readPack(bundle, content, null, null);
   return match(commitments, notRead, files);
 }
 
@@ -377,10 +448,10 @@ export async function matchCaseFiles(
 ): Promise<FileMatchReading> {
   const commitments: FileCommitment[] = [];
   const notRead: NotRead[] = [];
-  for (const pack of packs) {
+  for (const [packIndex, pack] of packs.entries()) {
     if (!isObject(pack)) throw new TypeError("matchCaseFiles: each pack is an object {ref, bundle}");
     if (typeof pack.ref !== "string") throw new TypeError("matchCaseFiles: a pack's ref is a string");
-    const r = await readPack(pack.bundle, pack.content, pack.ref);
+    const r = await readPack(pack.bundle, pack.content, pack.ref, packIndex);
     commitments.push(...r.commitments);
     notRead.push(...r.notRead);
   }
@@ -390,7 +461,9 @@ export async function matchCaseFiles(
 function commitmentJson(c: FileCommitment): Record<string, unknown> {
   return {
     pack_ref: c.packRef,
+    pack_index: c.packIndex,
     event_id: c.eventId,
+    record_index: c.recordIndex,
     kind: c.kind,
     part_index: c.partIndex,
     content_hash: c.contentHash,
@@ -401,6 +474,7 @@ function commitmentJson(c: FileCommitment): Record<string, unknown> {
 
 /** The reading as the `files` member of `--json`, identical in both kernels. */
 export function fileMatchToJson(reading: FileMatchReading): Record<string, unknown> {
+  const skipped = reading.skipped ?? [];
   return {
     offered: reading.offered,
     matched: reading.matched.map((m) => ({
@@ -412,14 +486,33 @@ export function fileMatchToJson(reading: FileMatchReading): Record<string, unkno
     not_offered: reading.notOffered.map(commitmentJson),
     not_read: reading.notRead.map((n) => ({
       pack_ref: n.packRef,
+      pack_index: n.packIndex,
       event_id: n.eventId,
+      record_index: n.recordIndex,
       reason: n.reason,
       rendered: renderNotRead(n),
     })),
+    // Present only when something was skipped, so a reading with no skipped
+    // file is the object it was before a folder could be offered (A40).
+    ...(skipped.length > 0
+      ? {
+          skipped: skipped.map((k) => ({
+            name: k.name,
+            reason: k.reason,
+            ...(k.detail !== undefined ? { detail: k.detail } : {}),
+            rendered: renderSkipped(k),
+          })),
+        }
+      : {}),
     scope: reading.scope,
   };
 }
 
+function renderSkipped(k: SkippedFile): string {
+  if (k.detail !== undefined) return `${k.name}  (${SKIPPED_TEXT[k.reason]}: ${k.detail}; not read)`;
+  return `${k.name}  (${SKIPPED_TEXT[k.reason]})`;
+}
+
 function recordName(eventId: string | null): string {
   return eventId !== null ? `record ${eventId}` : "a record with no event_id";
 }
@@ -440,20 +533,61 @@ function renderNotRead(n: NotRead): string {
   return `${recordName(n.eventId)}${where} not read: ${REASON_TEXT[n.reason]}`;
 }
 
-/** The text report's lines for the reading, identical in both kernels. */
-export function renderFileMatch(reading: FileMatchReading): string[] {
+/**
+ * The commitments no offered file matched and no disclosed log answers.
+ *
+ * `contents` is each pack's side content by `pack_ref`. A record whose own pack
+ * discloses bytes that hash to its `content_hash` is accounted for by the pack,
+ * and is not returned. Only the text report's count reads this; the reading, and
+ * `--json`, still list every commitment no file matched.
+ */
+export async function notAccountedFor(
+  reading: FileMatchReading,
+  contents: ReadonlyMap<string, SideContentMap | null | undefined>,
+): Promise<FileCommitment[]> {
+  const out: FileCommitment[] = [];
+  for (const c of reading.notOffered) {
+    const held = c.packRef !== null ? contents.get(c.packRef) : undefined;
+    const raw =
+      c.kind === "record" && held !== undefined && held !== null && c.eventId !== null
+        ? decode(sideContentEntry(held, c.eventId).value)
+        : undefined;
+    if (raw !== undefined && (await sha256Hex(raw)) === c.contentHash) continue;
+    out.push(c);
+  }
+  return out;
+}
+
+/**
+ * The text report's lines for the reading, identical in both kernels.
+ *
+ * By default every commitment no file matched is a line. `notAmong` is the case
+ * command's report when no `--files` was given: one count line for the recorded
+ * files no loose file matched, and no line for each (A41).
+ */
+export function renderFileMatch(reading: FileMatchReading, notAmong?: number): string[] {
+  const skipped = reading.skipped ?? [];
   const lines = [
     `files         ${reading.offered} offered: ${reading.matched.length} vouched for, ` +
-      `${reading.unmatched.length} match no record; ` +
-      `${reading.notOffered.length} commitment(s) had no file offered`,
+      `${reading.unmatched.length} match no record` +
+      (notAmong === undefined ? `; ${reading.notOffered.length} commitment(s) had no file offered` : "") +
+      (skipped.length > 0 ? `; ${skipped.length} skipped, not read` : ""),
   ];
   for (const m of reading.matched) {
     lines.push(`  vouched for  ${m.name}  sha256 ${m.sha256}`);
     for (const c of m.records) lines.push(`    by ${renderCommitment(c)}`);
   }
   for (const u of reading.unmatched) lines.push(`  no match     ${u.name}  sha256 ${u.sha256}`);
-  for (const c of reading.notOffered) {
-    lines.push(`  not offered  ${c.contentHash}, ${renderCommitment(c)}`);
+  for (const k of skipped) lines.push(`  skipped      ${renderSkipped(k)}`);
+  if (notAmong === undefined) {
+    for (const c of reading.notOffered) {
+      lines.push(`  not offered  ${c.contentHash}, ${renderCommitment(c)}`);
+    }
+  } else if (notAmong > 0) {
+    lines.push(
+      `  ${notAmong} recorded commitment(s) matched no loose file and no log in their own pack ` +
+        "(--json lists every commitment no file matched, these included)",
+    );
   }
   for (const n of reading.notRead) lines.push(`  not read     ${renderNotRead(n)}`);
   lines.push(`  ${reading.scope}`);

package/src/grading.ts

@@ -476,6 +476,17 @@ export function accountDisclosure(
   return { expected, present, missing, unreadable, extra };
 }
 
+/**
+ * A JSON number read by its value: an integer within 2**53 - 1, or null.
+ * `Number.isSafeInteger`, mirrored by `_js_safe_integer` in
+ * `src/sanning_proof/chain.py`, so `2.0` is 2 in both kernels and
+ * `9007199254740993`, which this parser rounds, is unreadable in both.
+ */
+export function safeInteger(value: unknown): number | null {
+  // `+ 0` folds -0 into 0, which Python's `int(-0.0)` already is.
+  return typeof value === "number" && Number.isSafeInteger(value) ? value + 0 : null;
+}
+
 /** The `leaf_count` a checkpoint's SIGNED record commits to, or null if unreadable. */
 export function signedLeafCount(checkpoint: { event_bytes?: unknown } | null | undefined): number | null {
   const hex = checkpoint?.event_bytes;
@@ -490,8 +501,10 @@ export function signedLeafCount(checkpoint: { event_bytes?: unknown } | null | u
     const record = jcsParse(hexToBytes(hex)) as {
       event?: { leaf_count?: unknown };
     };
-    const n = record?.event?.leaf_count;
-    return Number.isInteger(n) ? (n as number) : null;
+    // Read BY VALUE, the model JCS signs: a record spelling `3.0`, `3e0` or
+    // `30e-1` commits to 3, and since A38 (proof#197) this count decides a
+    // verdict, not only a note. Past 2**53 - 1 it is unreadable, as in Python.
+    return safeInteger(record?.event?.leaf_count);
   } catch {
     return null;
   }

package/src/index.ts

@@ -219,6 +219,7 @@ export {
   CASE_EXCEPTION_KINDS,
   CASE_QUARANTINED_PROFILES,
   CASE_RECORD_PROFILES,
+  CASE_RECORD_STATUSES,
   CASE_NOTE_KINDS,
   CASE_RELIANCE,
   CASE_RELIANCE_HANDOFF_CLAUSE,
@@ -285,6 +286,7 @@ export type {
   CasePackReading,
   CaseReading,
   CaseRecordReading,
+  CaseRecordStatus,
   CaseVerdict,
   WitnessLine,
   WitnessState,
@@ -316,9 +318,11 @@ export type {
 export {
   FILE_MATCH_SCOPE,
   NOT_READ_REASONS,
+  SKIPPED_REASONS,
   fileMatchToJson,
   matchCaseFiles,
   matchFiles,
+  notAccountedFor,
   renderFileMatch,
 } from "./file-match.js";
 export type {
@@ -329,6 +333,8 @@ export type {
   NotRead,
   NotReadReason,
   OfferedFile,
+  SkippedFile,
+  SkippedReason,
   UnmatchedFile,
 } from "./file-match.js";
 

package/src/merkle.ts

@@ -78,25 +78,31 @@ export async function verifyInclusion(
   }
   if (totalLeaves === 1) return auditPath.length === 0 && bytesEqual(leaf, expectedRoot);
 
+  // Arithmetic, not bitwise: JavaScript's `&` and `>>=` truncate to 32 bits,
+  // so a tree past 2**31 leaves walked a different tree here than in the
+  // Python kernel, whose integers are unbounded. `% 2` and a halving floor
+  // are exact for every safe integer, and the stated index and count reach
+  // this walk as safe integers.
   let fn = leafIndex;
   let sn = totalLeaves - 1;
   let r = leaf;
+  const half = (v: number): number => Math.floor(v / 2);
 
   for (const p of auditPath) {
     if (sn === 0) return false; // path longer than the tree depth — malformed
-    if ((fn & 1) === 1 || fn === sn) {
+    if (fn % 2 === 1 || fn === sn) {
       r = await nodeHash(p, r);
-      if ((fn & 1) === 0) {
-        while ((fn & 1) === 0 && fn !== 0) {
-          fn >>= 1;
-          sn >>= 1;
+      if (fn % 2 === 0) {
+        while (fn % 2 === 0 && fn !== 0) {
+          fn = half(fn);
+          sn = half(sn);
         }
       }
     } else {
       r = await nodeHash(r, p);
     }
-    fn >>= 1;
-    sn >>= 1;
+    fn = half(fn);
+    sn = half(sn);
   }
 
   return sn === 0 && bytesEqual(r, expectedRoot);

package/src/verifier.ts

@@ -708,7 +708,7 @@ export async function verifyEnvelope(
   // exotic object.
   try {
     return await verifyEnvelopeChecked(env, opts);
-  } catch (e) {
+  } catch {
     return {
       ok: false,
       specVersionOk: false,
@@ -718,7 +718,7 @@ export async function verifyEnvelope(
       signatureOk: false,
       contentHashOk: opts.expectedContentHash === undefined ? null : false,
       contentRole: null,
-      errors: [`envelope could not be read: ${stringifyErr(e)}`],
+      errors: ["envelope could not be read"],
     };
   }
 }
@@ -761,7 +761,15 @@ async function verifyEnvelopeChecked(
   }
 
   const specVersionOk = specVersionSupported(env.spec_version, opts.acceptedSpecMajors);
-  if (!specVersionOk) errors.push(`unsupported spec_version: ${JSON.stringify(env.spec_version)}`);
+  if (!specVersionOk) {
+    // Absent or null reads "missing", as in the Python kernel. Everything else
+    // is quoted the way both kernels quote a value in a finding.
+    errors.push(
+      env.spec_version === undefined || env.spec_version === null
+        ? "missing spec_version"
+        : `unsupported spec_version: ${JSON.stringify(env.spec_version)}`,
+    );
+  }
 
   // Skeleton field format (envelope-spec §2, proof#95): a present `signed_at`
   // or `environment` that is not what §2 says fails the verdict. There is no
@@ -791,8 +799,8 @@ async function verifyEnvelopeChecked(
   // line, or an ANSI escape that paints `VERIFIED` green, into what the
   // verifier prints. No other field in this file echoes its value, the Python
   // twin names the same failure without one, and the value is in the envelope
-  // the auditor already holds. The RECOMPUTED digest stays: this kernel
-  // produced it, so it is 64 characters of lowercase hex by construction.
+  // the auditor already holds. Neither is the recomputed digest: the reason is
+  // the Python kernel's sentence, word for word (proof#150).
   let payloadHashOk: boolean | null;
   if (typeof env.payload_hash !== "string") {
     payloadHashOk = false;
@@ -803,26 +811,22 @@ async function verifyEnvelopeChecked(
       try {
         const recomputed = await sha256Hex(utf8(jcs(env.payload)));
         checks.push(recomputed === env.payload_hash);
-        if (recomputed !== env.payload_hash) {
-          errors.push(
-            `payload_hash mismatch: the envelope's payload_hash is not SHA-256(JCS(payload)), recomputed=${recomputed}`,
-          );
-        }
-      } catch (e) {
+      } catch {
         checks.push(false);
-        errors.push(`payload canonicalization failed: ${stringifyErr(e)}`);
+        errors.push("payload is not JCS-canonicalizable");
       }
     }
     if (opts.payloadBytes !== undefined) {
       const external = await sha256Hex(opts.payloadBytes);
       checks.push(external === env.payload_hash);
-      if (external !== env.payload_hash) {
-        errors.push(
-          `payload_hash does not match the committed bytes: bytes=${external}`,
-        );
-      }
     }
     payloadHashOk = checks.length > 0 ? checks.every(Boolean) : null;
+    // One sentence for a mismatch against the inline payload, the supplied
+    // bytes or both, and none when the payload could not be canonicalized: the
+    // Python kernel's rule, word for word (proof#150).
+    if (payloadHashOk === false && !errors.some((e) => e.startsWith("payload is not"))) {
+      errors.push("payload_hash does not match the committed bytes");
+    }
   }
 
   // Check 2 — Signature Confirmed: Ed25519 over the signed scope, which is
@@ -836,8 +840,11 @@ async function verifyEnvelopeChecked(
     const { signature: _signature, co_signatures: _coSignatures, ...envelopeForSig } = env;
     signatureOk = await ed25519Verify(utf8(jcs(envelopeForSig)), env.signature, env.public_key);
     if (!signatureOk) errors.push("Ed25519 signature verification failed");
-  } catch (e) {
-    errors.push(`signature verification error: ${stringifyErr(e)}`);
+  } catch {
+    // The sentence the Python kernel writes for the same failure. What was
+    // thrown is the host's wording (`jcs: input nesting exceeds ...`), and a
+    // public result carries the kernel's own words only (proof#150).
+    errors.push("Ed25519 signature verification failed");
   }
 
   // Check 3 (optional) — Content Bind: the user's bytes match a hash this
@@ -895,6 +902,3 @@ async function verifyEnvelopeChecked(
   };
 }
 
-function stringifyErr(e: unknown): string {
-  return e instanceof Error ? e.message : String(e);
-}

package/src/zip-reader.ts

@@ -32,6 +32,13 @@ import { utf8Strict } from "./verifier.js";
 export const MAX_ZIP_ENTRIES = 50_000;
 /** More uncompressed bytes than this, across every entry, refuse the archive. */
 export const MAX_ZIP_BYTES = 2 ** 30;
+/**
+ * An archive file larger than this is refused before it is read: the
+ * uncompressed cap, and room for the headers, the central directory and the
+ * deflate framing of an archive that holds that much. The caller checks the
+ * size on disk, so the archive is never read whole to find out it is too big.
+ */
+export const MAX_ZIP_ARCHIVE_BYTES = MAX_ZIP_BYTES + 256 * 2 ** 20;
 /** A name nested deeper than this many folders refuses the archive. */
 export const MAX_ZIP_DEPTH = 32;
 

package/vectors/README.md

@@ -173,7 +173,11 @@ matched by its SHA-256 and by nothing else**, and **no match moves a verdict**:
 a surface that matched by name, or took a hash from a field no record's key
 signed, would vouch for a file the pack never committed to. Written by
 `tools/gen-vectors/gen_file_match_vectors.py`, whose expectations are written
-by hand from what it built.
+by hand from what it built. Rule version 2 (A43, proof#204) adds `pack_index`
+and `record_index` to every commitment and every `not_read` entry: the pack's
+position among the row's packs in `mode: case` (`null` in `mode: pack`) and
+the record's position among the events the pack presents, both read off the
+packs the row names.
 
 ## `case-split.json`