@sanning/proof 0.7.0 → 0.8.0

package/dist/chain.js

@@ -143,7 +143,15 @@ function adapterLinkage(record) {
         // here: nothing to resolve is a beginning.
         const prev = str(fields.prev_event_id);
         const seqRaw = fields.seq;
-        const seq = Number.isInteger(seqRaw) ? seqRaw : null;
+        // SAFE integer, not merely integral. Beyond 2^53 a JSON number does not
+        // survive `JSON.parse` intact — `9007199254740993` arrives as
+        // `...992` — while Python's parser keeps it exactly, so the two kernels
+        // read DIFFERENT sequence numbers off identical bytes and report gaps of
+        // different widths. Measured at 2^53+1: a `chain-gap` count of
+        // 9007199254740990 here against 9007199254740992 there (proof#49). A value
+        // this kernel cannot represent is one it cannot read, which is the same
+        // answer it gives every other unreadable field: no sequence, take no part.
+        const seq = Number.isSafeInteger(seqRaw) ? seqRaw : null;
         return { namespace, chainKey, prev, seq };
     }
     return null;
@@ -226,6 +234,20 @@ function byChainOrder(a, b) {
         return a.seq - b.seq;
     return a.order - b.order;
 }
+/**
+ * The smallest slot between the lowest and highest occupied ones that no record
+ * occupies, found by walking the SORTED occupants rather than the range they
+ * span. See the call site: the range's width is chosen by whoever wrote the
+ * bundle.
+ */
+function firstMissingSlot(present) {
+    const ordered = [...present].sort((a, b) => a - b);
+    for (let i = 0; i < ordered.length - 1; i++) {
+        if (ordered[i + 1] > ordered[i] + 1)
+            return ordered[i] + 1;
+    }
+    return null;
+}
 function findingsFor(group) {
     const { members, chainKey, source, publicKey } = group;
     const of = members.length;
@@ -283,18 +305,23 @@ function findingsFor(group) {
         const present = new Set(sequenced.map((m) => m.seq));
         const low = Math.min(...present);
         const high = Math.max(...present);
-        const missing = [];
-        for (let s = low; s <= high; s++)
-            if (!present.has(s))
-                missing.push(s);
-        if (missing.length > 0) {
-            const after = sequenced.filter((m) => m.seq > missing[0]).sort(byChainOrder)[0];
+        // Counted, never walked. `seq` is attacker-chosen, so a bundle presenting
+        // two records at seq 0 and seq 1e15 made the old `for (let s = low; s <=
+        // high; s++)` spin for days — a verifier that HANGS on adversarial input is
+        // worse than one that raises, and this reader promises neither (proof#49).
+        // The present set is a subset of [low, high], so the absent slots are the
+        // width minus the occupants, and the first of them is found by walking the
+        // occupants in order.
+        const missingCount = high - low + 1 - present.size;
+        const firstMissing = missingCount > 0 ? firstMissingSlot(present) : null;
+        if (firstMissing !== null) {
+            const after = sequenced.filter((m) => m.seq > firstMissing).sort(byChainOrder)[0];
             findings.push({
                 kind: "chain-gap",
                 ...base,
-                count: missing.length,
+                count: missingCount,
                 eventIds: after === undefined ? [] : [after.eventId],
-                firstMissingSeq: missing[0],
+                firstMissingSeq: firstMissing,
             });
         }
     }
@@ -311,7 +338,18 @@ function findingsFor(group) {
 export async function readChains(bundle) {
     const groups = await groupChains(bundle);
     const order = (g) => `${g.source} ${g.namespace ?? ""} ${g.chainKey}`;
-    groups.sort((a, b) => order(a).localeCompare(order(b)));
+    // Ordered by UTF-16 code unit, NOT `localeCompare`. A chain key is caller
+    // text, and `localeCompare` with no locale argument answers from the host's
+    // ICU collation: measured here, it puts "chain-2" AFTER "chain_1" where every
+    // code-wise comparison puts it before, and it can differ between two
+    // TypeScript installs, let alone between kernels. The Python reader sorts the
+    // same key encoded as `utf-16-be`, which is exactly this comparison — so the
+    // two kernels emit findings in one order (proof#49).
+    groups.sort((a, b) => {
+        const x = order(a);
+        const y = order(b);
+        return x < y ? -1 : x > y ? 1 : 0;
+    });
     return {
         chains: groups.map((g) => ({
             chainKey: g.chainKey,

package/dist/evidence.d.ts

@@ -25,6 +25,7 @@ export declare const EXPORT_BODY_TYPE = "sanning.evidence.export/v1";
  * unrecoverable once witnessed.
  */
 export declare const STAMP_TRACE_BODY_TYPE = "sanning.stamp.trace/v1";
+export declare const STAMP_EVIDENCE_BODY_TYPE = "sanning.stamp.evidence/v1";
 /**
  * The version string INSIDE a witnessed stamp body — a different string from
  * the `body_type` above, and the two are easy to confuse.
@@ -162,6 +163,26 @@ export interface StampEntry {
 export interface StampTraceBody {
     stamps: StampEntry[];
 }
+/** §5.3's inclusion: §5.1's shape with `stamp_ref` as the join key. */
+export interface StampEvidenceInclusion {
+    leaf_hash: string;
+    leaf_index: number;
+    leaf_count: number;
+    audit_path: string[];
+    /** Resolves against `stamps[].stamp_ref` in the SAME body. */
+    stamp_ref: string;
+}
+export interface StampEvidenceEvent {
+    envelope: Envelope;
+    record_bytes?: string;
+    content?: string;
+    inclusion: StampEvidenceInclusion;
+}
+export interface StampEvidenceBody {
+    /** Byte-identical to §5.2.2 — one definition, one place to change. */
+    stamps: StampEntry[];
+    events: StampEvidenceEvent[];
+}
 export interface EvidenceBundle {
     spec_version: string;
     body_type: string;

package/dist/evidence.js

@@ -61,6 +61,7 @@ export const EXPORT_BODY_TYPE = "sanning.evidence.export/v1";
  * unrecoverable once witnessed.
  */
 export const STAMP_TRACE_BODY_TYPE = "sanning.stamp.trace/v1";
+export const STAMP_EVIDENCE_BODY_TYPE = "sanning.stamp.evidence/v1";
 /**
  * The version string INSIDE a witnessed stamp body — a different string from
  * the `body_type` above, and the two are easy to confuse.
@@ -195,6 +196,10 @@ export async function verifyEvidenceBundle(bundle, options = {}) {
     if (bodyType === STAMP_TRACE_BODY_TYPE) {
         return verifyStampTrace(b, specVersionOk, assertedStatus, errors);
     }
+    // The DL-52 hand-over body (§5.3): stamps AND the customer's events, joined.
+    if (bodyType === STAMP_EVIDENCE_BODY_TYPE) {
+        return verifyStampEvidence(b, specVersionOk, assertedStatus, errors, options);
+    }
     if (bodyType !== ANCHOR_TRACE_BODY_TYPE && bodyType !== ANCHOR_TRACE_BODY_TYPE_V1) {
         // The wrapper is authentic but we don't know this body's structure. Per
         // wrap-don't-merge, that is "partial" (cryptographically sound wrapper,
@@ -523,75 +528,10 @@ async function verifyAnchorTrace(b, bodyType, specVersionOk, assertedStatus, err
                 evErrors.push(`inclusion verify error: ${stringifyErr(e)}`);
             }
         }
-        // Content (raw-log) binding — the rawLog → content_hash link the rest of
-        // the chain (content_hash → record → payload_hash → signature → leaf →
-        // root) already covers. The committed hash lives in the RECORD
-        // (record.event.content_hash, minimal disclosure); for a promoted-disclosure
-        // envelope it falls back to the envelope's own committed hashes
-        // (contentHashes — NOT verifyEnvelope's path, which reads payload/event_type
-        // and yields nothing for a sanning.events/v1 envelope). Disclosed bytes come
-        // from the signed in-body `ev.content` FIRST, then the out-of-band
-        // options.content side input. Undetermined (null) when nothing is disclosed
-        // or nothing is committed; false ONLY on a real mismatch or an in-body vs
-        // side-input disagreement — mirroring payloadBindingOk's never-fail-on-absent
-        // discipline.
-        let contentOk = null;
-        {
-            const committed = [];
-            let recordContentHash;
-            if (recordBytes !== undefined) {
-                try {
-                    const record = JSON.parse(new TextDecoder().decode(recordBytes));
-                    const ch = record.event?.content_hash;
-                    if (typeof ch === "string" && ch)
-                        recordContentHash = ch.toLowerCase();
-                }
-                catch {
-                    // record not JSON — the payload binding already reflects that; content
-                    // stays undetermined rather than throwing.
-                }
-            }
-            if (recordContentHash !== undefined) {
-                committed.push(recordContentHash);
-            }
-            else if (ev.envelope && typeof ev.envelope === "object") {
-                // Promoted fallback. Guarded: contentHashes() dereferences env.payload,
-                // which throws on a null/non-object envelope — a verifier must never
-                // raise on adversarial input (such an event already fails via envelopeOk).
-                for (const c of contentHashes(ev.envelope))
-                    committed.push(c.hash.toLowerCase());
-            }
-            // Disclosed bytes, precedence: in-body (signed) → side input. A string
-            // side input is hex; a Uint8Array is used as-is. Resolved by the SHARED
-            // selector so `disclosedContent` hands a consumer the very bytes bound
-            // here — one decode, not two that can drift apart.
-            const selection = selectDisclosedBytes(ev, eventId, options.content);
-            const { inBody, side } = selection;
-            evErrors.push(...selection.errors);
-            if (inBody !== undefined && side !== undefined && !bytesEqual(inBody, side)) {
-                // Two disclosures that disagree: a genuine conflict, not undetermined.
-                contentOk = false;
-                evErrors.push("disclosed content disagreement: in-body events[].content and the supplied content differ");
-            }
-            else {
-                const disclosed = inBody ?? side;
-                if (disclosed === undefined || committed.length === 0) {
-                    contentOk = null;
-                    if (disclosed !== undefined && committed.length === 0) {
-                        evErrors.push("disclosed content present but no committed content_hash to bind to " +
-                            "(record withheld or record has no event.content_hash) — undetermined");
-                    }
-                }
-                else {
-                    const got = await sha256Hex(disclosed);
-                    contentOk = committed.includes(got);
-                    if (!contentOk) {
-                        evErrors.push("disclosed content does not match the committed content_hash: " +
-                            `sha256(disclosed)=${got} committed=${committed.join("|")}`);
-                    }
-                }
-            }
-        }
+        // Content (raw-log) binding — shared with every other event-carrying body.
+        const contentRes = await verifyDisclosedContent(ev, eventId, recordBytes, options.content);
+        const contentOk = contentRes.contentOk;
+        evErrors.push(...contentRes.errors);
         eventResults.push({
             eventId,
             envelopeOk,
@@ -748,6 +688,72 @@ function isNonNegInt(n) {
  * verifier that stops at the first one turns a second fix into a second
  * round-trip.
  */
+// ===========================================================================
+// Disclosed-content binding, shared by every body that carries events.
+//
+// Extracted for `sanning.stamp.evidence/v1` (§5.3) rather than copied. The
+// rawLog -> content_hash link is the one step the chain
+// (content_hash -> record -> payload_hash -> signature -> leaf -> root) does
+// not otherwise cover, and a second copy of it is a second place for the
+// never-fail-on-absent discipline to drift. The rules are unchanged from the
+// anchor-trace path this came from: undetermined (null) when nothing is
+// disclosed or nothing is committed; false ONLY on a real mismatch or an
+// in-body vs side-input disagreement.
+// ===========================================================================
+async function verifyDisclosedContent(ev, eventId, recordBytes, sideContent) {
+    const evErrors = [];
+    let contentOk = null;
+    const committed = [];
+    let recordContentHash;
+    if (recordBytes !== undefined) {
+        try {
+            const record = JSON.parse(new TextDecoder().decode(recordBytes));
+            const ch = record.event?.content_hash;
+            if (typeof ch === "string" && ch)
+                recordContentHash = ch.toLowerCase();
+        }
+        catch {
+            // record not JSON — the payload binding already reflects that; content
+            // stays undetermined rather than throwing.
+        }
+    }
+    if (recordContentHash !== undefined) {
+        committed.push(recordContentHash);
+    }
+    else if (ev.envelope && typeof ev.envelope === "object") {
+        // Promoted fallback. Guarded: contentHashes() dereferences env.payload,
+        // which throws on a null/non-object envelope — a verifier must never raise
+        // on adversarial input.
+        for (const c of contentHashes(ev.envelope))
+            committed.push(c.hash.toLowerCase());
+    }
+    const selection = selectDisclosedBytes(ev, eventId, sideContent);
+    const { inBody, side } = selection;
+    evErrors.push(...selection.errors);
+    if (inBody !== undefined && side !== undefined && !bytesEqual(inBody, side)) {
+        contentOk = false;
+        evErrors.push("disclosed content disagreement: in-body events[].content and the supplied content differ");
+    }
+    else {
+        const disclosed = inBody ?? side;
+        if (disclosed === undefined || committed.length === 0) {
+            contentOk = null;
+            if (disclosed !== undefined && committed.length === 0) {
+                evErrors.push("disclosed content present but no committed content_hash to bind to " +
+                    "(record withheld or record has no event.content_hash) — undetermined");
+            }
+        }
+        else {
+            const got = await sha256Hex(disclosed);
+            contentOk = committed.includes(got);
+            if (!contentOk) {
+                evErrors.push("disclosed content does not match the committed content_hash: " +
+                    `sha256(disclosed)=${got} committed=${committed.join("|")}`);
+            }
+        }
+    }
+    return { contentOk, errors: evErrors };
+}
 async function verifyStampEntry(raw, seen) {
     const errors = [];
     const base = {
@@ -993,6 +999,197 @@ async function verifyStampTrace(b, specVersionOk, assertedStatus, errors) {
         errors,
     };
 }
+// ===========================================================================
+// `sanning.stamp.evidence/v1` — the two halves, bound (evidence-bundle.md §5.3)
+//
+// The stamp half is §5.2's code unchanged (`verifyStampEntry`, which carries
+// the sub-tree partition check). The event half reuses the same primitives the
+// anchor-trace path uses — `verifyEnvelope`, `verifyInclusion`, `leafHash`,
+// `verifyDisclosedContent` — because a second copy of Merkle verification is a
+// second place for it to drift.
+//
+// What differs, and only this: the join. An event resolves `inclusion.stamp_ref`
+// to a stamps[] entry and walks its audit path to the root committed INSIDE
+// that stamp's witnessed bytes. There is no `merkle_root` field on the event to
+// read instead — repeating the root beside its own authoritative bytes would be
+// two answers to one question inside one signature (§5.1.2).
+// ===========================================================================
+async function verifyStampEvidence(b, specVersionOk, assertedStatus, errors, options) {
+    const body = b.body;
+    if (!Array.isArray(body?.stamps) || !Array.isArray(body?.events)) {
+        return malformed(`${STAMP_EVIDENCE_BODY_TYPE} body must have stamps[] and events[]`, true);
+    }
+    // --- The stamp half: §5.2's rules, §5.2's code ----------------------------
+    const seen = new Set();
+    const stamps = [];
+    for (const entry of body.stamps)
+        stamps.push(await verifyStampEntry(entry, seen));
+    // The join table. ONLY a stamp whose derived ref and witnessed bytes both
+    // checked out is joinable: a root read out of bytes that failed their own
+    // verification is not a root anyone should walk a proof to, and admitting one
+    // would let a broken stamp lend its authority to an event.
+    const byRef = new Map();
+    for (const st of stamps) {
+        if (st.stampRef && st.stampRefOk && st.bodyOk)
+            byRef.set(st.stampRef, st);
+    }
+    // --- The event half -------------------------------------------------------
+    const eventResults = [];
+    for (const rawEv of body.events) {
+        const evErrors = [];
+        // A verifier must never RAISE on adversarial input — a caller handed a
+        // stack trace instead of a verdict cannot tell a malformed pack from a
+        // broken tool. `events[]` is attacker-shaped, so a null/non-object entry
+        // is coerced to an empty event and fails through the normal path, exactly
+        // as the Python kernel does. Found by adversarial review, not by the
+        // cross-kernel leg — whose cases did not include one, and now do.
+        if (rawEv === null || typeof rawEv !== "object" || Array.isArray(rawEv)) {
+            // NOT an event. Graded and reported as such rather than coerced to an
+            // empty one: probing verifyEnvelope with nothing asks the envelope layer
+            // a question about an object that was never an envelope, and the two
+            // kernels answer it differently (undetermined vs failed) — a real
+            // divergence, but not this body's to resolve. Reported separately.
+            eventResults.push({
+                eventId: "<unknown>",
+                envelopeOk: false,
+                payloadBindingOk: null,
+                inclusionOk: false,
+                checkpointBound: false,
+                contentOk: null,
+                ok: false,
+                errors: ["events[] entry is not an object"],
+            });
+            continue;
+        }
+        const ev = rawEv;
+        const eventId = getEventId(ev.envelope);
+        let envelopeOk = false;
+        let payloadBindingOk = null;
+        let recordBytes;
+        try {
+            if (typeof ev.record_bytes === "string")
+                recordBytes = hexToBytes(ev.record_bytes);
+        }
+        catch (e) {
+            evErrors.push(`event record_bytes is not hex: ${stringifyErr(e)}`);
+        }
+        try {
+            const res = await verifyEnvelope(ev.envelope, recordBytes !== undefined ? { payloadBytes: recordBytes } : {});
+            envelopeOk = res.ok; // tolerates an undetermined binding (withheld record)
+            payloadBindingOk = res.payloadHashOk;
+            if (!res.signatureOk)
+                evErrors.push("event envelope signature failed");
+            if (res.payloadHashOk === false)
+                evErrors.push("event record does not bind to payload_hash");
+        }
+        catch (e) {
+            evErrors.push(`event envelope verify error: ${stringifyErr(e)}`);
+        }
+        // --- The join (§5.3.3 rule 1) -------------------------------------------
+        const incl = ev.inclusion;
+        let st;
+        if (!incl || typeof incl !== "object") {
+            evErrors.push("event missing inclusion proof");
+        }
+        else if (incl.checkpoint_ref !== undefined || incl.checkpoint_tx_id !== undefined) {
+            // One bundle speaks one vocabulary. An inclusion carrying an anchor-trace
+            // join key inside this body is a mixed bundle, and resolving it anyway is
+            // how an event silently binds to something nobody meant (§5.1.2).
+            evErrors.push(`event inclusion carries an anchor-trace join key in a ${STAMP_EVIDENCE_BODY_TYPE} body`);
+        }
+        else if (typeof incl.stamp_ref !== "string") {
+            evErrors.push("event inclusion missing stamp_ref");
+        }
+        else {
+            st = byRef.get(incl.stamp_ref);
+            if (st === undefined) {
+                // Hard reject, never undetermined: without a resolved stamp the
+                // inclusion proof has no root to check against at all.
+                evErrors.push(`event inclusion.stamp_ref ${JSON.stringify(incl.stamp_ref)} resolves to no verified stamp`);
+            }
+        }
+        const stampBound = st !== undefined;
+        let inclusionOk = false;
+        if (incl && stampBound && st) {
+            // Rule 3: the tree walked must be the tree the stamp committed to. A
+            // proof walked against a different leaf_count is a proof about a
+            // different tree, and RFC 9162's path shape depends on the size.
+            if (st.leafCount !== null && incl.leaf_count !== st.leafCount) {
+                evErrors.push(`inclusion leaf_count ${incl.leaf_count} does not equal the stamp's committed ` +
+                    `leaf_count ${st.leafCount}`);
+            }
+            else {
+                try {
+                    inclusionOk = await verifyInclusion(hexToBytes(incl.leaf_hash), incl.leaf_index, incl.leaf_count, (incl.audit_path ?? []).map((h) => hexToBytes(h)), hexToBytes(st.merkleRoot ?? ""));
+                    if (!inclusionOk) {
+                        evErrors.push("RFC 9162 inclusion proof did not reconstruct the stamp root");
+                    }
+                    // Defense in depth, as §5.1: the claimed leaf MUST be this event's
+                    // own signed envelope bytes, or a valid proof for an UNRELATED leaf
+                    // could be smuggled in.
+                    const expectedLeafHex = toHex(await leafHash(utf8(jcs(ev.envelope))));
+                    if (expectedLeafHex !== (incl.leaf_hash ?? "").toLowerCase()) {
+                        inclusionOk = false;
+                        evErrors.push("inclusion leaf_hash does not match SHA-256(0x00 || JCS(event envelope))");
+                    }
+                }
+                catch (e) {
+                    evErrors.push(`inclusion verify error: ${stringifyErr(e)}`);
+                }
+            }
+        }
+        const contentRes = await verifyDisclosedContent(ev, eventId, recordBytes, options.content);
+        const contentOk = contentRes.contentOk;
+        evErrors.push(...contentRes.errors);
+        eventResults.push({
+            eventId,
+            envelopeOk,
+            payloadBindingOk,
+            inclusionOk,
+            // Named for §5.1's join; here it reports whether `stamp_ref` resolved.
+            checkpointBound: stampBound,
+            contentOk,
+            ok: envelopeOk && inclusionOk && stampBound && contentOk !== false,
+            errors: evErrors,
+        });
+    }
+    // --- Rollup ---------------------------------------------------------------
+    // Rule 4: a declared event MUST be checked. `events[]` present and unverified
+    // is the false green this body exists to prevent, so an event that did not
+    // verify fails the bundle — it is never rolled up as verified.
+    const anyHardFailure = stamps.some((st) => !st.ok) || eventResults.some((e) => !e.ok);
+    const anyUnwitnessed = stamps.some((st) => st.anchorRef === null);
+    let status;
+    if (anyHardFailure) {
+        status = "failed";
+    }
+    else if (stamps.length === 0 && eventResults.length === 0) {
+        status = "partial";
+        errors.push(`${STAMP_EVIDENCE_BODY_TYPE} body carries no stamps and no events`);
+    }
+    else if (anyUnwitnessed) {
+        // §5.3.3 rule 6, inherited whole from §5.2.4: for a stamp the witness IS
+        // the independent part, so the events resting on it inherit `partial`.
+        status = "partial";
+        errors.push("one or more stamps carries no anchor_ref — sealed by Sanning, witnessed by nobody");
+    }
+    else {
+        status = "verified";
+    }
+    return {
+        status,
+        specVersionOk,
+        bodyHashOk: true,
+        signatureOk: true,
+        bodyType: STAMP_EVIDENCE_BODY_TYPE,
+        onChainChecked: false,
+        checkpoints: [],
+        events: eventResults,
+        assertedStatus,
+        stamps,
+        errors,
+    };
+}
 // How many `sanning.evidence.export/v1` wrappers deep the source bundle may be
 // nested before this path gives up. verifyEvidenceBundle's canonicalization
 // depth bound already rejects a pathological bundle, but the unwrap must be

package/dist/index.d.ts

@@ -2,8 +2,8 @@ export { ACCEPTED_SPEC_MAJORS, contentHashes, jcs, specVersionSupported, verifyE
 export { bytesToHex, deriveOperatorAddress, ed25519Verify, hexToBytes, sha256Bytes, sha256Hex, utf8, verifyRsaPssSha256, } from "./crypto.js";
 export { EMPTY_TREE_ROOT_HEX, auditPath, leafHash, merkleRoot, nodeHash, verifyInclusion, } from "./merkle.js";
 export type { ContentRole, Envelope, Subject, VerificationResult, VerifyOptions } from "./types.js";
-export { ANCHOR_TRACE_BODY_TYPE, ANCHOR_TRACE_BODY_TYPE_V1, ANCHOR_TRACE_BODY_TYPES, EXPORT_BODY_TYPE, STAMP_BODY_VERSION, STAMP_TRACE_BODY_TYPE, disclosedContent, recomputeExportVerdict, verifyEvidenceBundle, } from "./evidence.js";
-export type { AnchorTraceBody, AttestationPayload, AttestationRecord, AttestationResult, CheckpointResult, ComposeVerdictResult, DisclosedContentResult, DisclosedEventContent, DisclosureStatus, EvidenceBundle, EvidenceBundleResult, EvidenceIssuer, EvidenceStatus, EvidenceVerdict, EventResult, ExportBody, ExportResult, OnChainOutcome, OnChainResult, PerGatewayOutcome, AnchorRef, StampBody, StampEntry, StampResult, StampSubtree, StampSubtreeResult, StampTraceBody, TraceCheckpoint, TraceCheckpointV1, TraceEvent, TraceInclusion, VerdictAttestation, VerdictCheckpoint, VerdictEvent, VerdictObject, VerdictOnChain, VerdictOnChainGateway, VerifyEvidenceOptions, } from "./evidence.js";
+export { ANCHOR_TRACE_BODY_TYPE, ANCHOR_TRACE_BODY_TYPE_V1, ANCHOR_TRACE_BODY_TYPES, EXPORT_BODY_TYPE, STAMP_BODY_VERSION, STAMP_TRACE_BODY_TYPE, STAMP_EVIDENCE_BODY_TYPE, disclosedContent, recomputeExportVerdict, verifyEvidenceBundle, } from "./evidence.js";
+export type { AnchorTraceBody, AttestationPayload, AttestationRecord, AttestationResult, CheckpointResult, ComposeVerdictResult, DisclosedContentResult, DisclosedEventContent, DisclosureStatus, EvidenceBundle, EvidenceBundleResult, EvidenceIssuer, EvidenceStatus, EvidenceVerdict, EventResult, ExportBody, ExportResult, OnChainOutcome, OnChainResult, PerGatewayOutcome, AnchorRef, StampBody, StampEntry, StampResult, StampSubtree, StampSubtreeResult, StampTraceBody, StampEvidenceBody, StampEvidenceEvent, StampEvidenceInclusion, TraceCheckpoint, TraceCheckpointV1, TraceEvent, TraceInclusion, VerdictAttestation, VerdictCheckpoint, VerdictEvent, VerdictObject, VerdictOnChain, VerdictOnChainGateway, VerifyEvidenceOptions, } from "./evidence.js";
 export { accountDisclosure, completenessNotes, gradeCauses, gradePack, renderCause, signedLeafCount, } from "./grading.js";
 export type { CompletenessNote, DisclosureAccount, GradeInput, PackGrade, PackGradeCause, PackGradeCauseKind, PackVerdict, } from "./grading.js";
 export { ADAPTER_CHAIN_NAMESPACES, CHAIN_READING_SCOPE, readChains, renderChainFinding, } from "./chain.js";

package/dist/index.js

@@ -34,7 +34,7 @@ export { EMPTY_TREE_ROOT_HEX, auditPath, leafHash, merkleRoot, nodeHash, verifyI
 // files that failed verification on genuine evidence. This hands back DECODED
 // bytes, and only for events whose verification bound them to the committed
 // content_hash. Additive; verifyEvidenceBundle's behavior is unchanged.
-export { ANCHOR_TRACE_BODY_TYPE, ANCHOR_TRACE_BODY_TYPE_V1, ANCHOR_TRACE_BODY_TYPES, EXPORT_BODY_TYPE, STAMP_BODY_VERSION, STAMP_TRACE_BODY_TYPE, disclosedContent, recomputeExportVerdict, verifyEvidenceBundle, } from "./evidence.js";
+export { ANCHOR_TRACE_BODY_TYPE, ANCHOR_TRACE_BODY_TYPE_V1, ANCHOR_TRACE_BODY_TYPES, EXPORT_BODY_TYPE, STAMP_BODY_VERSION, STAMP_TRACE_BODY_TYPE, STAMP_EVIDENCE_BODY_TYPE, disclosedContent, recomputeExportVerdict, verifyEvidenceBundle, } from "./evidence.js";
 // Pack grading (src/grading.ts): what a verification SURFACE may claim about a
 // pack — the signed bundle PLUS whatever disclosed bytes travelled beside it.
 //

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sanning/proof",
-  "version": "0.7.0",
+  "version": "0.8.0",
   "description": "TypeScript kernel of the Sanning verification stack: RFC 8785 (JCS) canonicalization, SHA-256, and Ed25519 verification for Verifiable Event Envelopes. Full-family verifier (inline + external commitment); accepts sanning.agent/v1, sanning.mlflow/v1, sanning.events/v1. Conformance-gated byte-for-byte against the test-vectors corpus.",
   "license": "MIT",
   "type": "module",

package/src/chain.ts

@@ -236,7 +236,15 @@ function adapterLinkage(
     // here: nothing to resolve is a beginning.
     const prev = str(fields.prev_event_id);
     const seqRaw = fields.seq;
-    const seq = Number.isInteger(seqRaw) ? (seqRaw as number) : null;
+    // SAFE integer, not merely integral. Beyond 2^53 a JSON number does not
+    // survive `JSON.parse` intact — `9007199254740993` arrives as
+    // `...992` — while Python's parser keeps it exactly, so the two kernels
+    // read DIFFERENT sequence numbers off identical bytes and report gaps of
+    // different widths. Measured at 2^53+1: a `chain-gap` count of
+    // 9007199254740990 here against 9007199254740992 there (proof#49). A value
+    // this kernel cannot represent is one it cannot read, which is the same
+    // answer it gives every other unreadable field: no sequence, take no part.
+    const seq = Number.isSafeInteger(seqRaw) ? (seqRaw as number) : null;
     return { namespace, chainKey, prev, seq };
   }
   return null;
@@ -322,6 +330,20 @@ function byChainOrder(a: Member, b: Member): number {
   return a.order - b.order;
 }
 
+/**
+ * The smallest slot between the lowest and highest occupied ones that no record
+ * occupies, found by walking the SORTED occupants rather than the range they
+ * span. See the call site: the range's width is chosen by whoever wrote the
+ * bundle.
+ */
+function firstMissingSlot(present: Set<number>): number | null {
+  const ordered = [...present].sort((a, b) => a - b);
+  for (let i = 0; i < ordered.length - 1; i++) {
+    if (ordered[i + 1]! > ordered[i]! + 1) return ordered[i]! + 1;
+  }
+  return null;
+}
+
 function findingsFor(group: Group): ChainFinding[] {
   const { members, chainKey, source, publicKey } = group;
   const of = members.length;
@@ -383,16 +405,23 @@ function findingsFor(group: Group): ChainFinding[] {
     const present = new Set(sequenced.map((m) => m.seq as number));
     const low = Math.min(...present);
     const high = Math.max(...present);
-    const missing: number[] = [];
-    for (let s = low; s <= high; s++) if (!present.has(s)) missing.push(s);
-    if (missing.length > 0) {
-      const after = sequenced.filter((m) => (m.seq as number) > missing[0]!).sort(byChainOrder)[0];
+    // Counted, never walked. `seq` is attacker-chosen, so a bundle presenting
+    // two records at seq 0 and seq 1e15 made the old `for (let s = low; s <=
+    // high; s++)` spin for days — a verifier that HANGS on adversarial input is
+    // worse than one that raises, and this reader promises neither (proof#49).
+    // The present set is a subset of [low, high], so the absent slots are the
+    // width minus the occupants, and the first of them is found by walking the
+    // occupants in order.
+    const missingCount = high - low + 1 - present.size;
+    const firstMissing = missingCount > 0 ? firstMissingSlot(present) : null;
+    if (firstMissing !== null) {
+      const after = sequenced.filter((m) => (m.seq as number) > firstMissing).sort(byChainOrder)[0];
       findings.push({
         kind: "chain-gap",
         ...base,
-        count: missing.length,
+        count: missingCount,
         eventIds: after === undefined ? [] : [after.eventId],
-        firstMissingSeq: missing[0]!,
+        firstMissingSeq: firstMissing,
       });
     }
   }
@@ -411,7 +440,18 @@ function findingsFor(group: Group): ChainFinding[] {
 export async function readChains(bundle: unknown): Promise<ChainReading> {
   const groups = await groupChains(bundle);
   const order = (g: Group) => `${g.source} ${g.namespace ?? ""} ${g.chainKey}`;
-  groups.sort((a, b) => order(a).localeCompare(order(b)));
+  // Ordered by UTF-16 code unit, NOT `localeCompare`. A chain key is caller
+  // text, and `localeCompare` with no locale argument answers from the host's
+  // ICU collation: measured here, it puts "chain-2" AFTER "chain_1" where every
+  // code-wise comparison puts it before, and it can differ between two
+  // TypeScript installs, let alone between kernels. The Python reader sorts the
+  // same key encoded as `utf-16-be`, which is exactly this comparison — so the
+  // two kernels emit findings in one order (proof#49).
+  groups.sort((a, b) => {
+    const x = order(a);
+    const y = order(b);
+    return x < y ? -1 : x > y ? 1 : 0;
+  });
 
   return {
     chains: groups.map((g) => ({

package/src/evidence.ts

@@ -86,6 +86,7 @@ export const EXPORT_BODY_TYPE = "sanning.evidence.export/v1";
  * unrecoverable once witnessed.
  */
 export const STAMP_TRACE_BODY_TYPE = "sanning.stamp.trace/v1";
+export const STAMP_EVIDENCE_BODY_TYPE = "sanning.stamp.evidence/v1";
 
 /**
  * The version string INSIDE a witnessed stamp body — a different string from
@@ -245,6 +246,37 @@ export interface StampTraceBody {
   stamps: StampEntry[];
 }
 
+// ---- `sanning.stamp.evidence/v1` wire types (evidence-bundle.md §5.3) -----
+//
+// Both halves of a DL-52 record, bound: the producer signs the envelope, and
+// Sanning signs and witnesses the stamp whose root commits to it. Neither
+// earlier body joins them, and a field added to §5.2 could not — a conformant
+// reader MUST ignore fields it does not know (envelope-spec.md §2), so the
+// join has to live in a body_type readers DISPATCH on. See §5.3.1.
+
+/** §5.3's inclusion: §5.1's shape with `stamp_ref` as the join key. */
+export interface StampEvidenceInclusion {
+  leaf_hash: string; // hex
+  leaf_index: number;
+  leaf_count: number;
+  audit_path: string[]; // hex[]
+  /** Resolves against `stamps[].stamp_ref` in the SAME body. */
+  stamp_ref: string;
+}
+
+export interface StampEvidenceEvent {
+  envelope: Envelope;
+  record_bytes?: string; // hex of JCS(event record); omitted == withheld
+  content?: string; // opt-in disclosed raw bytes, lowercase hex
+  inclusion: StampEvidenceInclusion;
+}
+
+export interface StampEvidenceBody {
+  /** Byte-identical to §5.2.2 — one definition, one place to change. */
+  stamps: StampEntry[];
+  events: StampEvidenceEvent[];
+}
+
 export interface EvidenceBundle {
   spec_version: string;
   body_type: string;
@@ -720,6 +752,11 @@ export async function verifyEvidenceBundle(
     return verifyStampTrace(b, specVersionOk, assertedStatus, errors);
   }
 
+  // The DL-52 hand-over body (§5.3): stamps AND the customer's events, joined.
+  if (bodyType === STAMP_EVIDENCE_BODY_TYPE) {
+    return verifyStampEvidence(b, specVersionOk, assertedStatus, errors, options);
+  }
+
   if (bodyType !== ANCHOR_TRACE_BODY_TYPE && bodyType !== ANCHOR_TRACE_BODY_TYPE_V1) {
     // The wrapper is authentic but we don't know this body's structure. Per
     // wrap-don't-merge, that is "partial" (cryptographically sound wrapper,
@@ -1091,79 +1128,10 @@ async function verifyAnchorTrace(
       }
     }
 
-    // Content (raw-log) binding — the rawLog → content_hash link the rest of
-    // the chain (content_hash → record → payload_hash → signature → leaf →
-    // root) already covers. The committed hash lives in the RECORD
-    // (record.event.content_hash, minimal disclosure); for a promoted-disclosure
-    // envelope it falls back to the envelope's own committed hashes
-    // (contentHashes — NOT verifyEnvelope's path, which reads payload/event_type
-    // and yields nothing for a sanning.events/v1 envelope). Disclosed bytes come
-    // from the signed in-body `ev.content` FIRST, then the out-of-band
-    // options.content side input. Undetermined (null) when nothing is disclosed
-    // or nothing is committed; false ONLY on a real mismatch or an in-body vs
-    // side-input disagreement — mirroring payloadBindingOk's never-fail-on-absent
-    // discipline.
-    let contentOk: boolean | null = null;
-    {
-      const committed: string[] = [];
-      let recordContentHash: string | undefined;
-      if (recordBytes !== undefined) {
-        try {
-          const record = JSON.parse(new TextDecoder().decode(recordBytes)) as {
-            event?: { content_hash?: unknown };
-          };
-          const ch = record.event?.content_hash;
-          if (typeof ch === "string" && ch) recordContentHash = ch.toLowerCase();
-        } catch {
-          // record not JSON — the payload binding already reflects that; content
-          // stays undetermined rather than throwing.
-        }
-      }
-      if (recordContentHash !== undefined) {
-        committed.push(recordContentHash);
-      } else if (ev.envelope && typeof ev.envelope === "object") {
-        // Promoted fallback. Guarded: contentHashes() dereferences env.payload,
-        // which throws on a null/non-object envelope — a verifier must never
-        // raise on adversarial input (such an event already fails via envelopeOk).
-        for (const c of contentHashes(ev.envelope)) committed.push(c.hash.toLowerCase());
-      }
-
-      // Disclosed bytes, precedence: in-body (signed) → side input. A string
-      // side input is hex; a Uint8Array is used as-is. Resolved by the SHARED
-      // selector so `disclosedContent` hands a consumer the very bytes bound
-      // here — one decode, not two that can drift apart.
-      const selection = selectDisclosedBytes(ev, eventId, options.content);
-      const { inBody, side } = selection;
-      evErrors.push(...selection.errors);
-
-      if (inBody !== undefined && side !== undefined && !bytesEqual(inBody, side)) {
-        // Two disclosures that disagree: a genuine conflict, not undetermined.
-        contentOk = false;
-        evErrors.push(
-          "disclosed content disagreement: in-body events[].content and the supplied content differ",
-        );
-      } else {
-        const disclosed = inBody ?? side;
-        if (disclosed === undefined || committed.length === 0) {
-          contentOk = null;
-          if (disclosed !== undefined && committed.length === 0) {
-            evErrors.push(
-              "disclosed content present but no committed content_hash to bind to " +
-                "(record withheld or record has no event.content_hash) — undetermined",
-            );
-          }
-        } else {
-          const got = await sha256Hex(disclosed);
-          contentOk = committed.includes(got);
-          if (!contentOk) {
-            evErrors.push(
-              "disclosed content does not match the committed content_hash: " +
-                `sha256(disclosed)=${got} committed=${committed.join("|")}`,
-            );
-          }
-        }
-      }
-    }
+    // Content (raw-log) binding — shared with every other event-carrying body.
+    const contentRes = await verifyDisclosedContent(ev, eventId, recordBytes, options.content);
+    const contentOk = contentRes.contentOk;
+    evErrors.push(...contentRes.errors);
 
     eventResults.push({
       eventId,
@@ -1320,6 +1288,83 @@ function isNonNegInt(n: unknown): n is number {
  * verifier that stops at the first one turns a second fix into a second
  * round-trip.
  */
+// ===========================================================================
+// Disclosed-content binding, shared by every body that carries events.
+//
+// Extracted for `sanning.stamp.evidence/v1` (§5.3) rather than copied. The
+// rawLog -> content_hash link is the one step the chain
+// (content_hash -> record -> payload_hash -> signature -> leaf -> root) does
+// not otherwise cover, and a second copy of it is a second place for the
+// never-fail-on-absent discipline to drift. The rules are unchanged from the
+// anchor-trace path this came from: undetermined (null) when nothing is
+// disclosed or nothing is committed; false ONLY on a real mismatch or an
+// in-body vs side-input disagreement.
+// ===========================================================================
+async function verifyDisclosedContent(
+  ev: { envelope?: unknown; content?: unknown },
+  eventId: string,
+  recordBytes: Uint8Array | undefined,
+  sideContent: VerifyEvidenceOptions["content"],
+): Promise<{ contentOk: boolean | null; errors: string[] }> {
+  const evErrors: string[] = [];
+  let contentOk: boolean | null = null;
+
+  const committed: string[] = [];
+  let recordContentHash: string | undefined;
+  if (recordBytes !== undefined) {
+    try {
+      const record = JSON.parse(new TextDecoder().decode(recordBytes)) as {
+        event?: { content_hash?: unknown };
+      };
+      const ch = record.event?.content_hash;
+      if (typeof ch === "string" && ch) recordContentHash = ch.toLowerCase();
+    } catch {
+      // record not JSON — the payload binding already reflects that; content
+      // stays undetermined rather than throwing.
+    }
+  }
+  if (recordContentHash !== undefined) {
+    committed.push(recordContentHash);
+  } else if (ev.envelope && typeof ev.envelope === "object") {
+    // Promoted fallback. Guarded: contentHashes() dereferences env.payload,
+    // which throws on a null/non-object envelope — a verifier must never raise
+    // on adversarial input.
+    for (const c of contentHashes(ev.envelope as Envelope)) committed.push(c.hash.toLowerCase());
+  }
+
+  const selection = selectDisclosedBytes(ev as TraceEvent, eventId, sideContent);
+  const { inBody, side } = selection;
+  evErrors.push(...selection.errors);
+
+  if (inBody !== undefined && side !== undefined && !bytesEqual(inBody, side)) {
+    contentOk = false;
+    evErrors.push(
+      "disclosed content disagreement: in-body events[].content and the supplied content differ",
+    );
+  } else {
+    const disclosed = inBody ?? side;
+    if (disclosed === undefined || committed.length === 0) {
+      contentOk = null;
+      if (disclosed !== undefined && committed.length === 0) {
+        evErrors.push(
+          "disclosed content present but no committed content_hash to bind to " +
+            "(record withheld or record has no event.content_hash) — undetermined",
+        );
+      }
+    } else {
+      const got = await sha256Hex(disclosed);
+      contentOk = committed.includes(got);
+      if (!contentOk) {
+        evErrors.push(
+          "disclosed content does not match the committed content_hash: " +
+            `sha256(disclosed)=${got} committed=${committed.join("|")}`,
+        );
+      }
+    }
+  }
+  return { contentOk, errors: evErrors };
+}
+
 async function verifyStampEntry(
   raw: unknown,
   seen: Set<string>,
@@ -1591,6 +1636,220 @@ async function verifyStampTrace(
   };
 }
 
+// ===========================================================================
+// `sanning.stamp.evidence/v1` — the two halves, bound (evidence-bundle.md §5.3)
+//
+// The stamp half is §5.2's code unchanged (`verifyStampEntry`, which carries
+// the sub-tree partition check). The event half reuses the same primitives the
+// anchor-trace path uses — `verifyEnvelope`, `verifyInclusion`, `leafHash`,
+// `verifyDisclosedContent` — because a second copy of Merkle verification is a
+// second place for it to drift.
+//
+// What differs, and only this: the join. An event resolves `inclusion.stamp_ref`
+// to a stamps[] entry and walks its audit path to the root committed INSIDE
+// that stamp's witnessed bytes. There is no `merkle_root` field on the event to
+// read instead — repeating the root beside its own authoritative bytes would be
+// two answers to one question inside one signature (§5.1.2).
+// ===========================================================================
+async function verifyStampEvidence(
+  b: EvidenceBundle,
+  specVersionOk: boolean,
+  assertedStatus: string | null,
+  errors: string[],
+  options: VerifyEvidenceOptions,
+): Promise<EvidenceBundleResult> {
+  const body = b.body as StampEvidenceBody;
+  if (!Array.isArray(body?.stamps) || !Array.isArray(body?.events)) {
+    return malformed(`${STAMP_EVIDENCE_BODY_TYPE} body must have stamps[] and events[]`, true);
+  }
+
+  // --- The stamp half: §5.2's rules, §5.2's code ----------------------------
+  const seen = new Set<string>();
+  const stamps: StampResult[] = [];
+  for (const entry of body.stamps) stamps.push(await verifyStampEntry(entry, seen));
+
+  // The join table. ONLY a stamp whose derived ref and witnessed bytes both
+  // checked out is joinable: a root read out of bytes that failed their own
+  // verification is not a root anyone should walk a proof to, and admitting one
+  // would let a broken stamp lend its authority to an event.
+  const byRef = new Map<string, StampResult>();
+  for (const st of stamps) {
+    if (st.stampRef && st.stampRefOk && st.bodyOk) byRef.set(st.stampRef, st);
+  }
+
+  // --- The event half -------------------------------------------------------
+  const eventResults: EventResult[] = [];
+  for (const rawEv of body.events) {
+    const evErrors: string[] = [];
+    // A verifier must never RAISE on adversarial input — a caller handed a
+    // stack trace instead of a verdict cannot tell a malformed pack from a
+    // broken tool. `events[]` is attacker-shaped, so a null/non-object entry
+    // is coerced to an empty event and fails through the normal path, exactly
+    // as the Python kernel does. Found by adversarial review, not by the
+    // cross-kernel leg — whose cases did not include one, and now do.
+    if (rawEv === null || typeof rawEv !== "object" || Array.isArray(rawEv)) {
+      // NOT an event. Graded and reported as such rather than coerced to an
+      // empty one: probing verifyEnvelope with nothing asks the envelope layer
+      // a question about an object that was never an envelope, and the two
+      // kernels answer it differently (undetermined vs failed) — a real
+      // divergence, but not this body's to resolve. Reported separately.
+      eventResults.push({
+        eventId: "<unknown>",
+        envelopeOk: false,
+        payloadBindingOk: null,
+        inclusionOk: false,
+        checkpointBound: false,
+        contentOk: null,
+        ok: false,
+        errors: ["events[] entry is not an object"],
+      });
+      continue;
+    }
+    const ev = rawEv as StampEvidenceEvent;
+    const eventId = getEventId(ev.envelope);
+    let envelopeOk = false;
+    let payloadBindingOk: boolean | null = null;
+
+    let recordBytes: Uint8Array | undefined;
+    try {
+      if (typeof ev.record_bytes === "string") recordBytes = hexToBytes(ev.record_bytes);
+    } catch (e) {
+      evErrors.push(`event record_bytes is not hex: ${stringifyErr(e)}`);
+    }
+    try {
+      const res = await verifyEnvelope(
+        ev.envelope,
+        recordBytes !== undefined ? { payloadBytes: recordBytes } : {},
+      );
+      envelopeOk = res.ok; // tolerates an undetermined binding (withheld record)
+      payloadBindingOk = res.payloadHashOk;
+      if (!res.signatureOk) evErrors.push("event envelope signature failed");
+      if (res.payloadHashOk === false) evErrors.push("event record does not bind to payload_hash");
+    } catch (e) {
+      evErrors.push(`event envelope verify error: ${stringifyErr(e)}`);
+    }
+
+    // --- The join (§5.3.3 rule 1) -------------------------------------------
+    const incl = ev.inclusion as (StampEvidenceInclusion & Record<string, unknown>) | undefined;
+    let st: StampResult | undefined;
+    if (!incl || typeof incl !== "object") {
+      evErrors.push("event missing inclusion proof");
+    } else if (incl.checkpoint_ref !== undefined || incl.checkpoint_tx_id !== undefined) {
+      // One bundle speaks one vocabulary. An inclusion carrying an anchor-trace
+      // join key inside this body is a mixed bundle, and resolving it anyway is
+      // how an event silently binds to something nobody meant (§5.1.2).
+      evErrors.push(
+        `event inclusion carries an anchor-trace join key in a ${STAMP_EVIDENCE_BODY_TYPE} body`,
+      );
+    } else if (typeof incl.stamp_ref !== "string") {
+      evErrors.push("event inclusion missing stamp_ref");
+    } else {
+      st = byRef.get(incl.stamp_ref);
+      if (st === undefined) {
+        // Hard reject, never undetermined: without a resolved stamp the
+        // inclusion proof has no root to check against at all.
+        evErrors.push(
+          `event inclusion.stamp_ref ${JSON.stringify(incl.stamp_ref)} resolves to no verified stamp`,
+        );
+      }
+    }
+    const stampBound = st !== undefined;
+
+    let inclusionOk = false;
+    if (incl && stampBound && st) {
+      // Rule 3: the tree walked must be the tree the stamp committed to. A
+      // proof walked against a different leaf_count is a proof about a
+      // different tree, and RFC 9162's path shape depends on the size.
+      if (st.leafCount !== null && incl.leaf_count !== st.leafCount) {
+        evErrors.push(
+          `inclusion leaf_count ${incl.leaf_count} does not equal the stamp's committed ` +
+            `leaf_count ${st.leafCount}`,
+        );
+      } else {
+        try {
+          inclusionOk = await verifyInclusion(
+            hexToBytes(incl.leaf_hash),
+            incl.leaf_index,
+            incl.leaf_count,
+            (incl.audit_path ?? []).map((h) => hexToBytes(h)),
+            hexToBytes(st.merkleRoot ?? ""),
+          );
+          if (!inclusionOk) {
+            evErrors.push("RFC 9162 inclusion proof did not reconstruct the stamp root");
+          }
+
+          // Defense in depth, as §5.1: the claimed leaf MUST be this event's
+          // own signed envelope bytes, or a valid proof for an UNRELATED leaf
+          // could be smuggled in.
+          const expectedLeafHex = toHex(await leafHash(utf8(jcs(ev.envelope))));
+          if (expectedLeafHex !== (incl.leaf_hash ?? "").toLowerCase()) {
+            inclusionOk = false;
+            evErrors.push(
+              "inclusion leaf_hash does not match SHA-256(0x00 || JCS(event envelope))",
+            );
+          }
+        } catch (e) {
+          evErrors.push(`inclusion verify error: ${stringifyErr(e)}`);
+        }
+      }
+    }
+
+    const contentRes = await verifyDisclosedContent(ev, eventId, recordBytes, options.content);
+    const contentOk = contentRes.contentOk;
+    evErrors.push(...contentRes.errors);
+
+    eventResults.push({
+      eventId,
+      envelopeOk,
+      payloadBindingOk,
+      inclusionOk,
+      // Named for §5.1's join; here it reports whether `stamp_ref` resolved.
+      checkpointBound: stampBound,
+      contentOk,
+      ok: envelopeOk && inclusionOk && stampBound && contentOk !== false,
+      errors: evErrors,
+    });
+  }
+
+  // --- Rollup ---------------------------------------------------------------
+  // Rule 4: a declared event MUST be checked. `events[]` present and unverified
+  // is the false green this body exists to prevent, so an event that did not
+  // verify fails the bundle — it is never rolled up as verified.
+  const anyHardFailure = stamps.some((st) => !st.ok) || eventResults.some((e) => !e.ok);
+  const anyUnwitnessed = stamps.some((st) => st.anchorRef === null);
+
+  let status: EvidenceStatus;
+  if (anyHardFailure) {
+    status = "failed";
+  } else if (stamps.length === 0 && eventResults.length === 0) {
+    status = "partial";
+    errors.push(`${STAMP_EVIDENCE_BODY_TYPE} body carries no stamps and no events`);
+  } else if (anyUnwitnessed) {
+    // §5.3.3 rule 6, inherited whole from §5.2.4: for a stamp the witness IS
+    // the independent part, so the events resting on it inherit `partial`.
+    status = "partial";
+    errors.push(
+      "one or more stamps carries no anchor_ref — sealed by Sanning, witnessed by nobody",
+    );
+  } else {
+    status = "verified";
+  }
+
+  return {
+    status,
+    specVersionOk,
+    bodyHashOk: true,
+    signatureOk: true,
+    bodyType: STAMP_EVIDENCE_BODY_TYPE,
+    onChainChecked: false,
+    checkpoints: [],
+    events: eventResults,
+    assertedStatus,
+    stamps,
+    errors,
+  };
+}
+
 // ===========================================================================
 // Ingest: materializing the disclosed raw bytes (evidence-bundle.md §5.1).
 //

package/src/index.ts

@@ -66,6 +66,7 @@ export {
   EXPORT_BODY_TYPE,
   STAMP_BODY_VERSION,
   STAMP_TRACE_BODY_TYPE,
+  STAMP_EVIDENCE_BODY_TYPE,
   disclosedContent,
   recomputeExportVerdict,
   verifyEvidenceBundle,
@@ -98,6 +99,9 @@ export type {
   StampSubtree,
   StampSubtreeResult,
   StampTraceBody,
+  StampEvidenceBody,
+  StampEvidenceEvent,
+  StampEvidenceInclusion,
   TraceCheckpoint,
   TraceCheckpointV1,
   TraceEvent,