@sanning/proof 0.17.0 → 0.19.0

package/dist/cli.js

@@ -17,6 +17,8 @@
 //      could not be reached reads `partial`; a pack whose records nobody hashed
 //      reads `incomplete` (see below)
 //   4  mixed
+//   5  sandbox: a record is signed environment dev; would be 0, or only a
+//      simulated witness is unchecked (`sandboxExit`)
 // `sanningd verify-status` in sanning-io/agent mirrored the 0.12 table, which
 // exited 0 on `partial`; it moves with this one.
 //
@@ -47,13 +49,15 @@ import { createHash, randomBytes } from "node:crypto";
 import { basename, resolve, sep } from "node:path";
 import { fileURLToPath } from "node:url";
 import { isAgentProofSpec, verifyAgentProof } from "./agent-proof.js";
-import { CHAIN_READING_SCOPE, readChains, renderChainFinding } from "./chain.js";
+import { CHAIN_READING_SCOPE, readChainLinks, readChains, renderChainFinding } from "./chain.js";
 import { VERDICT_DISPLAY_TITLES, caseReliance, readCase, renderCaseNote, renderCaseSummary, renderException, renderWitnessLine, } from "./case.js";
 import { CASE_FILE_INDEX_NAME, caseFileListedPaths, jsonDepthExceeds, readCaseFileIndex, renderCaseFileFinding, unreadableCaseFileIndex, } from "./case-file.js";
 import { MAX_ZIP_ARCHIVE_BYTES, MAX_ZIP_BYTES, ZipReadError, readZip } from "./zip-reader.js";
 import { composeExport } from "./compose.js";
 import { isHexField, sha256Hex, utf8 } from "./crypto.js";
 import { verifyEvidenceBundle } from "./evidence.js";
+import { readRuns, renderAccountLine, renderEnclaveLines } from "./run.js";
+import { loadInstalledAdapters } from "./run-adapters.js";
 import { DuplicateKeyError, parseRefusingDuplicates } from "./verifier.js";
 import { fileMatchToJson, matchCaseFiles, matchFiles, notAccountedFor, renderFileMatch, } from "./file-match.js";
 import { WITNESS_CACHE_NAME, readWitnessCache, } from "./witness-cache.js";
@@ -65,7 +69,8 @@ import { WITNESS_CACHE_NAME, readWitnessCache, } from "./witness-cache.js";
 import { onChainHalf, witnessLine } from "./witness-lookup.js";
 import { checkDeclaration, renderDeclarationSummary, renderNote } from "./declaration.js";
 import { completenessNotes, gradePack, renderCause } from "./grading.js";
-import { EXIT_CODES_HELP, EXIT_FAILED, EXIT_MALFORMED, EXIT_UNDETERMINED, EXIT_VERIFIED, exitCodeFor, } from "./exit-codes.js";
+import { EXIT_CODES_HELP, EXIT_FAILED, EXIT_MALFORMED, EXIT_SANDBOX, EXIT_UNDETERMINED, EXIT_VERIFIED, exitCodeFor, sandboxExit, } from "./exit-codes.js";
+import { environmentMarker, onlySimulatedUnsettled, simulatedOnlyRun, SANDBOX_HEADLINE, SANDBOX_LINE, SANDBOX_TITLE, } from "./environment.js";
 // ── What a person reads is escaped at one choke point ──
 //
 // Every human-readable line this command prints passes through `guard`, which
@@ -326,7 +331,7 @@ async function runVerify(rest, io, sink) {
             gateways,
             ...(io.fetchImpl ? { fetchImpl: io.fetchImpl } : {}),
         });
-        return reportAgentProof(result, bundlePath, gateways, io, sink);
+        return reportAgentProof(result, bundlePath, gateways, io, sink, parsed);
     }
     // Default: treat anything else as an evidence bundle. verifyEvidenceBundle
     // rejects an unknown major as "malformed" so a genuinely unknown shape still
@@ -338,8 +343,11 @@ async function runVerify(rest, io, sink) {
     });
     // Read the chains from the SAME parsed bundle the verifier saw. Findings are
     // evidence about the records in front of us, not a verdict: they are printed
-    // and they never move `exit`, because a chain is not a completeness proof and
-    // an exit code is exactly the kind of thing people read as one.
+    // and they move `exit` only through the pack's own declaration, where a v3
+    // declaration claims a chain complete and in order and a finding under that
+    // claim contradicts it (rule 11). Without a claim a chain is not a
+    // completeness proof, and an exit code is exactly the kind of thing people
+    // read as one.
     //
     // A READING THAT COULD NOT BE PRODUCED SAYS SO. This was an unguarded call:
     // a throw out of `readChains` would have escaped the command entirely and
@@ -355,7 +363,17 @@ async function runVerify(rest, io, sink) {
     catch (e) {
         chains = { unreadable: errMsg(e) };
     }
-    const exit = reportEvidence(result, bundlePath, gateways, io, chains, parsed, logs, sink);
+    // The links rule 11 holds a claimed chain to (evidence-bundle.md 5.4.2), from
+    // the same parsed bundle. Links that cannot be read are none, which reads a
+    // claim UNKNOWN and never clean.
+    let links;
+    try {
+        links = "unreadable" in chains ? null : await readChainLinks(parsed);
+    }
+    catch {
+        links = null;
+    }
+    const exit = reportEvidence(result, bundlePath, gateways, io, chains, links, parsed, logs, sink);
     // Files handed in beside the pack (evidence-bundle.md 5.7, A29): findings
     // beside the verdict, never inside it, so `exit` is untouched.
     if (offered !== undefined) {
@@ -1234,7 +1252,7 @@ function cliDisclosureAccount(result, logs) {
         extra: (logs?.suppliedIds ?? []).filter((id) => !known.has(id)),
     };
 }
-function reportEvidence(result, path, gateways, io, chains, parsed, logs, sink) {
+function reportEvidence(result, path, gateways, io, chains, links, parsed, logs, sink) {
     if (result.status === "malformed") {
         if (sink)
             sink.data = verifyJson(result, null, null, null);
@@ -1324,10 +1342,24 @@ function reportEvidence(result, path, gateways, io, chains, parsed, logs, sink)
     // their verdicts rather than a new check. A pack that DOES
     // carry a declaration this reader cannot read is a different case and exits
     // 3: the holder chose that field, so UNKNOWN is the honest answer.
-    const declaration = checkDeclaration(parsed, logs?.content);
+    //
+    // A v3 declaration that claims a chain is checked against this command's
+    // own chain links (rule 11, evidence-bundle.md 5.4.2 v1.36, A45). Links
+    // that could not be read are passed as none, which reads the claim UNKNOWN
+    // and never clean.
+    const declaration = checkDeclaration(parsed, logs?.content, links);
     const grade = gradePack(result, cliDisclosureAccount(result, logs), completenessNotes(parsed), declaration);
+    // Sandbox evidence: read from the signed envelopes the pack holds.
+    const marker = environmentMarker([parsed]);
+    // A pack whose records are all signed `dev`, undetermined only because a
+    // simulated witness cannot be looked up, would grade `verified` with that
+    // witness accepted: it is sandbox evidence, exit 5, never 3.
+    const simulatedOnly = grade.verdict === "partial" &&
+        onlySimulatedUnsettled(result) &&
+        gradePack({ ...result, status: "verified" }, cliDisclosureAccount(result, logs), completenessNotes(parsed), declaration).verdict === "verified";
+    const exit = sandboxExit(mapGradeToExit(grade), marker, simulatedOnly);
     io.out("");
-    printRollup(grade.verdict, result.status, result.assertedStatus, gateways, result.onChainChecked, io);
+    printRollup(grade.verdict, result.status, result.assertedStatus, gateways, result.onChainChecked, io, marker, exit === EXIT_SANDBOX, simulatedOnlyRun(result, gateways));
     io.out(paint(`  declaration: ${renderDeclarationSummary(declaration)}`, declaration.verdict === "failed" ? R : declaration.verdict === "verified" ? DIM : Y));
     for (const n of declaration.notes)
         io.out(paint(`  note: ${renderNote(n)}`, Y));
@@ -1346,15 +1378,15 @@ function reportEvidence(result, path, gateways, io, chains, parsed, logs, sink)
         io.out(paint(`  logs: ${grade.recordsVerified}/${result.events.length} record(s) content-verified`, DIM));
     }
     if (sink)
-        sink.data = verifyJson(result, grade, declaration, chains);
-    return mapGradeToExit(grade);
+        sink.data = verifyJson(result, grade, declaration, chains, marker);
+    return exit;
 }
 /**
  * What `verify --json` prints for an evidence bundle, the same keys and the
  * same words as `_verify_json` in the Python twin. `grade`, `declaration` and
  * `chains` are null for a bundle no verdict could be rendered over.
  */
-function verifyJson(result, grade, declaration, chains) {
+function verifyJson(result, grade, declaration, chains, marker = null) {
     let chainBlock = null;
     if (chains !== null) {
         chainBlock =
@@ -1380,6 +1412,9 @@ function verifyJson(result, grade, declaration, chains) {
             ? { presented: result.events.length, content_verified: grade.recordsVerified }
             : null,
         chains: chainBlock,
+        // Present only where the pack holds an envelope signed `dev`
+        // (envelope-spec §2 MAY), so a production pack's JSON is unchanged.
+        ...(marker !== null ? { environment_marker: marker } : {}),
     };
 }
 /**
@@ -1440,7 +1475,8 @@ function reportExport(exp, io) {
         }
     }
 }
-function reportAgentProof(result, path, gateways, io, sink) {
+function reportAgentProof(result, path, gateways, io, sink, parsed) {
+    const marker = result.status === "malformed" ? null : environmentMarker([parsed]);
     if (sink) {
         sink.data = {
             verdict: result.status,
@@ -1448,6 +1484,7 @@ function reportAgentProof(result, path, gateways, io, sink) {
             spec_version: "sanning.agent.proof/v1",
             on_chain_checked: result.onChainChecked,
             notes: [...result.errors],
+            ...(marker !== null ? { environment_marker: marker } : {}),
         };
     }
     if (result.status === "malformed") {
@@ -1464,17 +1501,30 @@ function reportAgentProof(result, path, gateways, io, sink) {
     io.out("");
     // An agent inclusion proof carries no records and no disclosed bytes, so
     // there is no pack to grade: the bundle status IS the headline here.
-    printRollup(result.status, result.status, null, gateways, result.onChainChecked, io);
+    const exit = sandboxExit(exitCodeFor(result.status), marker);
+    printRollup(result.status, result.status, null, gateways, result.onChainChecked, io, marker, exit === EXIT_SANDBOX);
     for (const e of result.errors)
         io.out(paint(`  note: ${e}`, DIM));
-    return exitCodeFor(result.status);
+    return exit;
 }
-function printRollup(headline, bundleStatus, asserted, gateways, onChainChecked, io) {
+function printRollup(headline, bundleStatus, asserted, gateways, onChainChecked, io, marker = null, sandbox = false, simulatedOnly = false) {
+    // Three scopes, not two. A run with gateways whose only witnesses are
+    // simulated looked nothing up (`simulatedOnlyRun`): saying "on-chain" there
+    // claims a check that never happened, and saying "no gateway re-fetch
+    // requested" denies the flag the reader passed. Every other run that is not
+    // counted as checked on a chain, a run that stopped early among them, keeps
+    // the second scope as before.
     const scope = onChainChecked
         ? `verified offline + on-chain against ${gateways.length} gateway(s)`
-        : "verified offline (no gateway re-fetch requested)";
+        : simulatedOnly
+            ? "verified offline; a simulated witness is not on a chain, so nothing was looked up"
+            : "verified offline (no gateway re-fetch requested)";
     let head;
-    switch (headline) {
+    switch (sandbox ? "sandbox" : headline) {
+        // Sandbox evidence (exit 5) never prints VERIFIED.
+        case "sandbox":
+            head = paint(SANDBOX_HEADLINE, Y);
+            break;
         case "verified":
             head = paint("VERIFIED", G);
             break;
@@ -1492,6 +1542,8 @@ function printRollup(headline, bundleStatus, asserted, gateways, onChainChecked,
             head = paint(headline.toUpperCase(), R);
     }
     io.out(`${head}  ${paint(scope, DIM)}`);
+    if (marker !== null)
+        io.out(paint(`  ${SANDBOX_LINE}`, Y));
     // Both verdicts, whenever they differ, because they answer different
     // questions: §3 grades the signed bundle, the pack verdict grades the bundle
     // plus whatever bytes travelled beside it. A pack can be incomplete while the
@@ -2072,7 +2124,7 @@ async function unzip(arg, prefix, tree, seen) {
 // 5.5.4 v1.16, A17), so it reads `failed` and exits 1.
 export const CASE_USAGE = `sanning-proof case -- a case reading: one verdict over one pack or many, offline
 
-  sanning-proof case <folder or case file>... [--gateways <url,url>] [--files <path>...] [--json]
+  sanning-proof case <folder or case file>... [--gateways <url,url>] [--files <path>...] [--enclave-policy <file>] [--enclave-rpc <url>] [--json]
 
   <folder>    a pack folder (bundle.json plus logs/), a folder that holds
               several packs, or an unzipped case file. Packs are found by the
@@ -2110,6 +2162,17 @@ export const CASE_USAGE = `sanning-proof case -- a case reading: one verdict ove
               contribution, the packs, each with its index, the files outside
               them, the case file index comparison, the witness line and the
               on-chain half.
+  --enclave-policy
+              a sanning.enclave-policy/v1 file: what this reader accepts of
+              an enclave attestation. Where the packs hold a runner's run, an
+              enclave attestation line and a run-account line print beside
+              the witness line (DRAFT); neither moves the verdict or the exit
+              code. Without a policy, or without an adapter for the provider
+              installed, the line reads not_checked.
+  --enclave-rpc
+              a chain JSON-RPC endpoint: a flare-fcc run also gets the online
+              line, read from the contracts the policy names. It moves
+              nothing either.
 
 Files outside every pack are matched too, always, so
 sanning-proof case audit-file.zip checks a whole download in one command: each
@@ -2184,12 +2247,21 @@ const titleOf = (word) => Object.prototype.hasOwnProperty.call(VERDICT_DISPLAY_T
  * scope sentence and the witness line are printed with it every time.
  */
 function caseReport(data) {
-    const lines = [
-        data.title,
-        `  ${data.summary}`,
-        `  ${data.witness.rendered}`,
-        `  ${data.reliance}`,
-    ];
+    const lines = [data.title];
+    // Sandbox evidence: printed with every headline the marker is on.
+    if (data.environment_marker !== undefined)
+        lines.push(`  ${SANDBOX_LINE}`);
+    lines.push(`  ${data.summary}`, `  ${data.witness.rendered}`);
+    // Where the packs hold a runner's run: its enclave attestation line and its
+    // run-account line, beside the witness line.
+    const enclave = data.enclave_attestation ?? [];
+    const account = data.run_account ?? [];
+    for (let i = 0; i < Math.min(enclave.length, account.length); i++) {
+        for (const line of enclave[i].rendered)
+            lines.push(`  ${line}`);
+        lines.push(`  ${account[i].rendered}`);
+    }
+    lines.push(`  ${data.reliance}`);
     for (const e of data.exceptions)
         lines.push(`  - ${e.rendered}`);
     for (const n of data.notes)
@@ -2197,7 +2269,11 @@ function caseReport(data) {
     lines.push(`packs         ${data.packs.length}`);
     for (const p of data.packs) {
         const key = p.signing_key !== null ? p.signing_key : "a key this reader cannot read";
-        const grade = p.grade !== null ? titleOf(p.grade) : "not graded";
+        const grade = p.grade === null
+            ? "not graded"
+            : p.grade === "verified" && p.environment_marker !== undefined
+                ? SANDBOX_TITLE
+                : titleOf(p.grade);
         // Each record's status, counted per pack (A43): the JSON lists every one.
         const mine = data.records.filter((r) => r.pack_index === p.index);
         const count = (status) => mine.filter((r) => r.status === status).length;
@@ -2235,13 +2311,23 @@ function caseReport(data) {
     }
     const oc = data.on_chain;
     if (oc.checked) {
-        lines.push(`on-chain      looked up against ${oc.gateways.length} gateway(s), ` +
-            "pack by pack; the reading above is offline and this does not " +
-            "change it");
+        // A drop whose only witnesses are simulated had nothing looked up on a
+        // chain, and the header says so rather than "looked up against".
+        const simulated = oc.packs.reduce((n, r) => n + (r.simulated ?? 0), 0);
+        const onlySimulated = simulated > 0 &&
+            oc.packs.every((r) => (r.simulated ?? 0) === r.witnesses && (r.witness_times ?? []).length === 0);
+        lines.push(onlySimulated
+            ? "on-chain      nothing looked up: every witness here is simulated, " +
+                "which is not on a chain; the reading above is offline and this " +
+                "does not change it"
+            : `on-chain      looked up against ${oc.gateways.length} gateway(s), ` +
+                "pack by pack; the reading above is offline and this does not " +
+                "change it");
         for (const r of oc.packs) {
+            const sim = r.simulated ? `, ${r.simulated} of them simulated (not on a chain)` : "";
             lines.push(`  ${r.ref}  ${r.witnesses} witness(es): ${r.confirmed} ` +
                 `confirmed, ${r.mismatched} mismatched, ${r.unreachable} ` +
-                `unreachable, ${r.not_checked} not checked`);
+                `unreachable, ${r.not_checked} not checked${sim}`);
         }
     }
     return lines;
@@ -2333,6 +2419,12 @@ export async function caseFileReadings(tree, whole, cap = MAX_FOLDER_BYTES) {
     }
     return out;
 }
+// One pack's environment marker, as the key its JSON row carries only where
+// the pack holds an envelope signed `dev`.
+function packMarker(bundle) {
+    const m = environmentMarker([bundle]);
+    return m !== null ? { environment_marker: m } : {};
+}
 function caseError(e, asJson, io) {
     if (asJson)
         outJson(io, jsonText({ error: e.message, exit_code: EXIT_MALFORMED, hint: e.hint }));
@@ -2417,11 +2509,69 @@ export async function looseFiles(tree, split, cap = MAX_FOLDER_BYTES) {
     }
     return { offered, skipped };
 }
+// A policy file that is not JSON: read, and unreadable (`policy_unreadable`).
+const POLICY_NOT_JSON = Symbol("policy not JSON");
+async function readEnclavePolicy(path) {
+    if (path === null)
+        return null;
+    let raw;
+    try {
+        if (!(await stat(path)).isFile())
+            throw new CaseInputError(`--enclave-policy ${path} is not a readable file`);
+        raw = new Uint8Array(await readFile(path));
+    }
+    catch (e) {
+        if (e instanceof CaseInputError)
+            throw e;
+        throw new CaseInputError(`--enclave-policy ${path} is not a readable file`);
+    }
+    try {
+        return parseRefusingDuplicates(new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(raw));
+    }
+    catch {
+        return POLICY_NOT_JSON;
+    }
+}
+/** The two line members of `--json`: one entry per run, with the lines it prints. */
+function runLines(runs) {
+    const enclave = runs.map((r) => ({
+        pack_ref: r.packRef,
+        pack_index: r.packIndex,
+        event_id: r.eventId,
+        runner_public_key: r.runnerPublicKey,
+        agent_public_key: r.agentPublicKey,
+        state: r.enclave.state,
+        kinds: r.enclave.kinds,
+        notes: r.enclave.notes,
+        reason: r.enclave.reason,
+        provider: r.enclave.provider,
+        evaluation: r.enclave.evaluation,
+        evaluated_at: r.enclave.evaluatedAt,
+        token_checked: r.enclave.tokenChecked,
+        online: r.online !== null ? { state: r.online.state, kinds: r.online.kinds } : null,
+        rendered: renderEnclaveLines(r).map(escapeControl),
+    }));
+    const account = runs.map((r) => ({
+        pack_ref: r.packRef,
+        pack_index: r.packIndex,
+        event_id: r.eventId,
+        runner_public_key: r.runnerPublicKey,
+        state: r.account.state,
+        findings: r.account.findings.map((f) => ({ kind: f.kind, event_id: f.eventId })),
+        notes: r.account.notes.map((n) => ({ kind: n.kind, event_id: n.eventId })),
+        closing_event_id: r.account.closingEventId,
+        reason: r.account.reason,
+        rendered: escapeControl(renderAccountLine(r)),
+    }));
+    return [enclave, account];
+}
 async function caseCommand(argv, io) {
     let asJson = false;
     let gateways = [];
     const paths = [];
     let filePaths;
+    let enclavePolicy = null;
+    let enclaveRpc = null;
     for (let i = 0; i < argv.length; i++) {
         const arg = argv[i];
         if ((arg === "--help" || arg === "-h" || arg === "help") && paths.length === 0) {
@@ -2454,6 +2604,19 @@ async function caseCommand(argv, io) {
             filePaths = [...(filePaths ?? []), ...taken];
             i += taken.length;
         }
+        else if (arg === "--enclave-policy" || arg === "--enclave-rpc") {
+            const next = argv[i + 1];
+            if (next === undefined) {
+                io.err(arg === "--enclave-policy" ? "case: --enclave-policy requires a policy file" : "case: --enclave-rpc requires a URL");
+                outBlock(io, CASE_USAGE);
+                return EXIT_MALFORMED;
+            }
+            if (arg === "--enclave-policy")
+                enclavePolicy = next;
+            else
+                enclaveRpc = next;
+            i++;
+        }
         else if (arg.startsWith("--")) {
             io.err(`case: unknown option ${arg}`);
             outBlock(io, CASE_USAGE);
@@ -2477,6 +2640,15 @@ async function caseCommand(argv, io) {
         offered = read.offered;
         skipped = read.skipped;
     }
+    let policy;
+    try {
+        policy = await readEnclavePolicy(enclavePolicy);
+    }
+    catch (e) {
+        if (e instanceof CaseInputError)
+            return caseError(e, asJson, io);
+        throw e;
+    }
     const whole = { n: MAX_FOLDER_BYTES };
     let split;
     let tree;
@@ -2506,13 +2678,24 @@ async function caseCommand(argv, io) {
     for (const [p, bundle] of bundles) {
         caches.push(readWitnessCache(bundle, await witnessCacheBytes(tree, split, p, whole, cacheRefused)));
     }
-    const onChain = await onChainHalf(bundles.map(([p, bundle], i) => [p.ref, bundle, caches[i]]), gateways, { ...(io.fetchImpl ? { fetchImpl: io.fetchImpl } : {}) });
+    const confirmedStamps = [];
+    const onChain = await onChainHalf(bundles.map(([p, bundle], i) => [p.ref, bundle, caches[i]]), gateways, { ...(io.fetchImpl ? { fetchImpl: io.fetchImpl } : {}) }, confirmedStamps);
     const witness = witnessLine(onChain, caches.flat());
-    const code = caseExitCode(reading.verdict, onChain.verdict);
+    // Sandbox evidence: over every envelope every pack holds, and per
+    // pack for its row. Only a case that would otherwise exit 0 exits 5.
+    const marker = environmentMarker(bundles.map(([, b]) => b));
+    // Undetermined only because a simulated witness cannot be looked up: every
+    // other witness confirmed, none unreachable or mismatched, every pack names
+    // one. With every record signed `dev` that is sandbox evidence, exit 5.
+    const simulatedOnly = reading.verdict === "verified" &&
+        onChain.verdict === "undetermined" &&
+        onChain.packs.some((r) => (r.simulated ?? 0) > 0) &&
+        onChain.packs.every((r) => r.witnesses > 0 && r.unreachable === 0 && r.mismatched === 0 && r.not_checked === (r.simulated ?? 0));
+    const code = sandboxExit(caseExitCode(reading.verdict, onChain.verdict), marker, simulatedOnly);
     const nil = (v) => (v === undefined ? null : v);
     const data = {
         verdict: reading.verdict,
-        title: titleOf(reading.verdict),
+        title: reading.verdict === "verified" && marker !== null ? SANDBOX_TITLE : titleOf(reading.verdict),
         reliance: caseReliance(reading.verdict, reading.handoffRecords),
         exit_code: code,
         summary: renderCaseSummary(reading),
@@ -2572,13 +2755,23 @@ async function caseCommand(argv, io) {
             grade: reading.packs[i].grade,
             records_withheld: reading.packs[i].recordsWithheld,
             declaration_version: reading.packs[i].declarationVersion,
+            ...packMarker(bundles[i][1]),
         })),
         outside: split.outside,
         not_regular: split.notRegular,
         case_file: caseFile,
         on_chain: onChain,
         ...(cacheRefused.length > 0 ? { witness_cache_not_read: cacheRefused } : {}),
+        ...(marker !== null ? { environment_marker: marker } : {}),
     };
+    // The runs in the drop (DRAFT, specs/enclave-attestation.md and
+    // run-records.md): an enclave attestation line and a run-account line per
+    // run, beside the witness line. Neither moves `code`, and a drop that holds
+    // no run prints and writes exactly what it did before.
+    const runs = (await readRuns(bundles.map(([p, bundle]) => ({ ref: p.ref, bundle, content: p.content })), { policy, adapters: await loadInstalledAdapters(), rpc: enclaveRpc, witnessed: confirmedStamps })).runs;
+    const withRuns = data;
+    if (runs.length > 0)
+        [withRuns.enclave_attestation, withRuns.run_account] = runLines(runs);
     // The files outside every pack (evidence-bundle.md 5.7, A29, A41), always,
     // then the files after --files. A pack's logs/ is its side content and is
     // never an offered file; only the paths after --files are. Both are matched

package/dist/crypto.d.ts

@@ -4,6 +4,23 @@ export declare function isHexField(value: unknown, nibbles: number, lower?: bool
 export declare function utf8(s: string): Uint8Array;
 export declare function sha256Bytes(bytes: Uint8Array): Promise<Uint8Array>;
 export declare function sha256Hex(bytes: Uint8Array): Promise<string>;
+/** The sentence a refused signature reads in an envelope result. */
+export declare const SIGNATURE_FAILED = "Ed25519 signature verification failed";
+export declare const ED25519_RULE_REASONS: readonly ["the public key is not the canonical encoding of a point", "the public key is a point of small order", "the public key is not in the prime-order subgroup", "R is not the canonical encoding of a point", "R is the identity", "R is a point of small order", "R is not in the prime-order subgroup", "S is not below the group order"];
+/**
+ * The clause of the rule that (`publicKey`, `signature`) breaks, or `null`
+ * when it breaks none and the equation is what is left to check. Lengths are
+ * the caller's (32 and 64 bytes). Never throws.
+ */
+export declare function ed25519RuleReason(signature: Uint8Array, publicKey: Uint8Array): string | null;
+/**
+ * `null` iff `signatureHex` is a signature of `message` under `publicKeyHex`
+ * by the rule; otherwise the sentence the refusal reads: `SIGNATURE_FAILED`,
+ * with `": "` and the clause of the rule it broke when it broke one. A
+ * malformed field, a wrong length and an equation that does not hold read
+ * the bare sentence. Never throws. The Python twin is `ed25519_refusal`.
+ */
+export declare function ed25519Refusal(message: Uint8Array, signatureHex: string, publicKeyHex: string): Promise<string | null>;
 export declare function ed25519Verify(message: Uint8Array, signatureHex: string, publicKeyHex: string): Promise<boolean>;
 export declare function ed25519Sign(message: Uint8Array, privateKeyHex: string): Promise<string>;
 export declare function ed25519PublicKey(privateKeyHex: string): Promise<string>;

package/dist/crypto.js

@@ -6,7 +6,9 @@ import * as ed from "@noble/ed25519";
 // @noble/ed25519 needs SHA-512 to verify. Wire it to WebCrypto rather than
 // pulling in @noble/hashes. globalThis.crypto.subtle exists in every modern
 // browser and in Node >= 19, so the same code path runs in the app and in tests.
-ed.etc.sha512Async = async (...msgs) => new Uint8Array(await crypto.subtle.digest("SHA-512", asBufferSource(ed.etc.concatBytes(...msgs))));
+// noble 3 ships this provider as its default; it is set here so the kernel
+// says what it hashes with rather than inheriting it.
+ed.hashes.sha512Async = async (message) => new Uint8Array(await crypto.subtle.digest("SHA-512", asBufferSource(message)));
 // WebCrypto's digest() wants a BufferSource backed by a (non-shared) ArrayBuffer.
 // Our byte arrays always are; this keeps TS 5.7's stricter Uint8Array<ArrayBufferLike>
 // typing satisfied without a runtime copy.
@@ -70,31 +72,129 @@ export async function sha256Bytes(bytes) {
 export async function sha256Hex(bytes) {
     return bytesToHex(await sha256Bytes(bytes));
 }
-// Verify an Ed25519 signature. Inputs are hex (signature, public key) as they
-// appear in the envelope; message is raw bytes. Never throws — a malformed
-// signature or key is "not verified," not an exception, so a hostile envelope
-// can't crash the checker.
+// ---------------------------------------------------------------------------
+// The Ed25519 rule (envelope-spec §7, A44, proof#230)
+//
+// Strict RFC 8032 (`zip215: false`, a frozen invariant), and more: the public
+// key A and the signature's R must each be the canonical encoding of a point
+// in the prime-order subgroup other than the identity, and S below the group
+// order L. Only then is the equation checked.
+//
+// Why more than `zip215: false`: noble checks the equation with the cofactor,
+// 8·S·B = 8·R + 8·k·A, and Go's crypto/ed25519 and libsodium without it, so on
+// their own they disagree when A or R has a small-order component. noble 2.3
+// also could not encode an identity R and hashed nothing for k, so it accepted
+// one signature from a key holder over every message. With A and R in the
+// prime-order subgroup the two equations are the same equation, and every
+// kernel accepts exactly the same signatures.
+//
+// Each clause is checked here, in this order, and named in these words: the
+// Python twin is `ed25519_rule_reason` in `src/sanning_proof/ed25519_rule.py`
+// and the Go kernel's `verifyEd25519Strict` in sanning-io/agent `pkg/proof`.
+// Several clauses are ones noble 3 refuses on its own; they are checked here
+// anyway so the refusal names the clause, which a library's `false` cannot.
+/** The sentence a refused signature reads in an envelope result. */
+export const SIGNATURE_FAILED = "Ed25519 signature verification failed";
+export const ED25519_RULE_REASONS = [
+    "the public key is not the canonical encoding of a point",
+    "the public key is a point of small order",
+    "the public key is not in the prime-order subgroup",
+    "R is not the canonical encoding of a point",
+    "R is the identity",
+    "R is a point of small order",
+    "R is not in the prime-order subgroup",
+    "S is not below the group order",
+];
+const [KEY_NOT_CANONICAL, KEY_SMALL_ORDER, KEY_NOT_IN_SUBGROUP, R_NOT_CANONICAL, R_IDENTITY, R_SMALL_ORDER, R_NOT_IN_SUBGROUP, S_NOT_BELOW_L,] = ED25519_RULE_REASONS;
+const ED25519_L = 2n ** 252n + 27742317777372353535851937790883648493n;
+function bytesToNumberLE(bytes) {
+    let v = 0n;
+    for (let i = bytes.length - 1; i >= 0; i--)
+        v = (v << 8n) | BigInt(bytes[i]);
+    return v;
+}
+// `Point.fromBytes(..., false)` is RFC 8032 decoding with its two strict
+// branches: it throws on y at or above p and on x zero with the sign bit set,
+// the two non-canonical encodings of a point, and on bytes that are no point.
+function decodeStrict(bytes) {
+    try {
+        return ed.Point.fromBytes(bytes, false);
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * The clause of the rule that (`publicKey`, `signature`) breaks, or `null`
+ * when it breaks none and the equation is what is left to check. Lengths are
+ * the caller's (32 and 64 bytes). Never throws.
+ */
+export function ed25519RuleReason(signature, publicKey) {
+    const A = decodeStrict(publicKey);
+    if (A === null)
+        return KEY_NOT_CANONICAL;
+    if (A.isSmallOrder())
+        return KEY_SMALL_ORDER;
+    if (!A.isTorsionFree())
+        return KEY_NOT_IN_SUBGROUP;
+    const R = decodeStrict(signature.subarray(0, 32));
+    if (R === null)
+        return R_NOT_CANONICAL;
+    if (R.is0())
+        return R_IDENTITY;
+    if (R.isSmallOrder())
+        return R_SMALL_ORDER;
+    if (!R.isTorsionFree())
+        return R_NOT_IN_SUBGROUP;
+    if (bytesToNumberLE(signature.subarray(32, 64)) >= ED25519_L)
+        return S_NOT_BELOW_L;
+    return null;
+}
+/**
+ * `null` iff `signatureHex` is a signature of `message` under `publicKeyHex`
+ * by the rule; otherwise the sentence the refusal reads: `SIGNATURE_FAILED`,
+ * with `": "` and the clause of the rule it broke when it broke one. A
+ * malformed field, a wrong length and an equation that does not hold read
+ * the bare sentence. Never throws. The Python twin is `ed25519_refusal`.
+ */
+export async function ed25519Refusal(message, signatureHex, publicKeyHex) {
+    let signature;
+    let publicKey;
+    try {
+        signature = hexToBytes(signatureHex);
+        publicKey = hexToBytes(publicKeyHex);
+    }
+    catch {
+        return SIGNATURE_FAILED;
+    }
+    if (signature.length !== 64 || publicKey.length !== 32)
+        return SIGNATURE_FAILED;
+    const reason = ed25519RuleReason(signature, publicKey);
+    if (reason !== null)
+        return `${SIGNATURE_FAILED}: ${reason}`;
+    try {
+        return (await ed.verifyAsync(signature, message, publicKey, { zip215: false })) ? null : SIGNATURE_FAILED;
+    }
+    catch {
+        return SIGNATURE_FAILED;
+    }
+}
+// Verify an Ed25519 signature by the rule above. Inputs are hex (signature,
+// public key) as they appear in the envelope; message is raw bytes. Never
+// throws — a malformed signature or key is "not verified," not an exception,
+// so a hostile envelope can't crash the checker.
 // Arguments in the Python twin's order, `ed25519_verify(message,
 // signature_hex, public_key_hex)` (P-03, 0.13.0). The message came second
 // until 0.13.0; a caller that still passes the signature first gets a compile
 // error, because a string is not a Uint8Array.
 export async function ed25519Verify(message, signatureHex, publicKeyHex) {
-    try {
-        // zip215:false → strict RFC-8032 verification, matching the Go agent's
-        // crypto/ed25519 exactly (noble defaults to the more lenient zip215:true).
-        return await ed.verifyAsync(hexToBytes(signatureHex), message, hexToBytes(publicKeyHex), {
-            zip215: false,
-        });
-    }
-    catch {
-        return false;
-    }
+    return (await ed25519Refusal(message, signatureHex, publicKeyHex)) === null;
 }
 // Ed25519 SIGN the raw `message` bytes with a 32-byte private-key seed (lowercase
 // hex). Returns the signature as lowercase hex. The signing counterpart to
 // ed25519Verify — the ONE signing primitive the composer (`proof export`,
 // evidence-export.md §5) needs to Ed25519-sign the export wrapper with the
-// exporter's key ("anyone can export", P-4). The @noble sha512Async hook wired at
+// exporter's key ("anyone can export", P-4). The @noble sha512Async provider wired at
 // module load serves signing and verification alike, so this stays WebCrypto-only.
 export async function ed25519Sign(message, privateKeyHex) {
     return bytesToHex(await ed.signAsync(message, hexToBytes(privateKeyHex)));