@sanning/proof 0.8.2 → 0.8.3

package/README.md

@@ -203,7 +203,7 @@ The primary signature covers `JCS(envelope minus signature minus co_signatures)`
 
 ## Why you can trust it (without trusting us)
 
-Three **independent implementations** of this kernel exist: this package, the Python [`sanning-proof`](https://pypi.org/project/sanning-proof/) (PyPI), and and the MIT-licensed Go reference. The TypeScript and Python kernels are conformance-gated **byte-for-byte** in CI against one shared corpus, pinned per file by SHA-256 at cut tag `test-vectors-v3.2`, and a cross-kernel agreement gate re-runs the corpus plus adversarial negatives through both, asserting identical verdicts on identical bytes. The Go reference runs as a third leg of that same gate, built at the commit its vendoring pins.
+Three **independent implementations** of this kernel exist: this package, the Python [`sanning-proof`](https://pypi.org/project/sanning-proof/) (PyPI), and and the MIT-licensed Go reference. The TypeScript and Python kernels are conformance-gated **byte-for-byte** in CI against one shared corpus, pinned per file by SHA-256 at cut tag `test-vectors-v3.3`, and a cross-kernel agreement gate re-runs the corpus plus adversarial negatives through both, asserting identical verdicts on identical bytes. The Go reference runs as a third leg of that same gate, built at the commit its vendoring pins.
 
 That mutual gate is the point: anyone can verify these provenance records with **no Sanning code in the trust path**, write your own verifier against the specs that ship inside the [`sanning-proof`](https://pypi.org/project/sanning-proof/) sdist, and the corpus will tell you if it is conformant.
 

package/dist/evidence.js

@@ -393,9 +393,20 @@ async function verifyAnchorTrace(b, bodyType, specVersionOk, assertedStatus, err
         }
         const keyed = await resolveCheckpointKey(cp, recordBytes, isV1);
         cpErrors.push(...keyed.errors);
+        // A duplicate key is a HARD failure, not a note. `byKey` below keeps the
+        // FIRST occurrence, so a second checkpoint claiming the same key is
+        // verified against the first one's envelope and its own stated identity is
+        // never independently checked. Recording the finding and leaving `ok` true
+        // let the bundle roll up to `verified` while carrying a checkpoint nothing
+        // had verified: a false pass, which is what `evidence-bundle.md` §3
+        // principle 3 exists to prevent (the displayed verdict must be the
+        // recomputed one, and here the recomputation quietly dropped a finding it
+        // had made).
+        let duplicateKey = false;
         if (keyed.key !== null) {
             if (byKey.has(keyed.key)) {
                 cpErrors.push(`duplicate checkpoint ${isV1 ? "tx_id" : "checkpoint_ref"} ${keyed.key}`);
+                duplicateKey = true;
             }
             else {
                 byKey.set(keyed.key, cp);
@@ -448,7 +459,7 @@ async function verifyAnchorTrace(b, bodyType, specVersionOk, assertedStatus, err
             // standing rule is that malformed is a failure while absent is
             // undetermined (the same rule disclosed `content` follows). Without
             // this term the vector `trace-v2-malformed-anchor-ref` verified GREEN.
-            ok: envelopeOk && merkleRootOk && keyed.errors.length === 0,
+            ok: envelopeOk && merkleRootOk && keyed.errors.length === 0 && !duplicateKey,
             errors: cpErrors,
         });
     }
@@ -590,7 +601,17 @@ async function verifyAnchorTrace(b, bodyType, specVersionOk, assertedStatus, err
                 // gateway (null) leaves the offline-sound checkpoint ok; the run
                 // downgrades to "partial" (exit 3) via gatewayUnavailable, not a hard
                 // failure. A match (true) keeps it ok.
-                cpr.ok = cpr.envelopeOk && cpr.merkleRootOk && cpr.onChainOk !== false;
+                // AND into the verdict already computed, never rebuild it from a
+                // hand-listed set of dimensions. Rebuilding silently dropped every
+                // term not in that list: the duplicate-key gate (proof#28) and the
+                // `keyed.errors` term with it, so supplying a gateway turned a hard
+                // reject back into `verified` and an UNREACHABLE gateway turned it
+                // into `partial` (exit 3), which reads as a network problem an
+                // operator retries. Neither is conditioned on a gateway by the spec:
+                // `evidence-bundle.md` says two checkpoints carrying one key is a
+                // hard reject, full stop. Written this way, a term added at
+                // construction survives here by construction.
+                cpr.ok = cpr.ok && cpr.onChainOk !== false;
             }
         }
     }

package/dist/verifier.js

@@ -236,7 +236,22 @@ export async function verifyEnvelope(env, optionsOrContentHash) {
         return {
             ok: false,
             specVersionOk: false,
-            payloadHashOk: false,
+            // `null`, not `false` (proof#62). This field carries "we cannot tell"
+            // against "it is wrong", and that distinction is what the whole
+            // minimum-disclosure posture rests on: a withheld record is `null` BY
+            // DESIGN and must never read as a failure (`evidence-bundle.md` §3.1,
+            // §6.2). There is no envelope here, so there is nothing to bind and
+            // nothing was determined. `false` asserted a binding had been checked
+            // and had failed, which is a claim this branch cannot support.
+            //
+            // The Python kernel already answered `None`, so the two disagreed on
+            // the dimension `verify-page` renders: an auditor on one CLI saw a
+            // dimension that could not be determined, and on the other one that
+            // failed, for the same bytes. `ok` is `false` either way, so no rollup
+            // verdict changes; what changes is what we tell the reader.
+            //
+            // `contentHashOk` on the next line already follows this rule.
+            payloadHashOk: null,
             signatureOk: false,
             contentHashOk: expectedContentHash === undefined ? null : false,
             contentRole: null,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sanning/proof",
-  "version": "0.8.2",
+  "version": "0.8.3",
   "description": "TypeScript kernel of the Sanning verification stack: RFC 8785 (JCS) canonicalization, SHA-256, and Ed25519 verification for Verifiable Event Envelopes. Full-family verifier (inline + external commitment); accepts sanning.agent/v1, sanning.mlflow/v1, sanning.events/v1. Conformance-gated byte-for-byte against the test-vectors corpus.",
   "license": "MIT",
   "type": "module",

package/src/evidence.ts

@@ -1007,9 +1007,20 @@ async function verifyAnchorTrace(
 
     const keyed = await resolveCheckpointKey(cp, recordBytes, isV1);
     cpErrors.push(...keyed.errors);
+    // A duplicate key is a HARD failure, not a note. `byKey` below keeps the
+    // FIRST occurrence, so a second checkpoint claiming the same key is
+    // verified against the first one's envelope and its own stated identity is
+    // never independently checked. Recording the finding and leaving `ok` true
+    // let the bundle roll up to `verified` while carrying a checkpoint nothing
+    // had verified: a false pass, which is what `evidence-bundle.md` §3
+    // principle 3 exists to prevent (the displayed verdict must be the
+    // recomputed one, and here the recomputation quietly dropped a finding it
+    // had made).
+    let duplicateKey = false;
     if (keyed.key !== null) {
       if (byKey.has(keyed.key)) {
         cpErrors.push(`duplicate checkpoint ${isV1 ? "tx_id" : "checkpoint_ref"} ${keyed.key}`);
+        duplicateKey = true;
       } else {
         byKey.set(keyed.key, cp);
         anchorByKey.set(keyed.key, keyed.anchorRef);
@@ -1066,7 +1077,7 @@ async function verifyAnchorTrace(
       // standing rule is that malformed is a failure while absent is
       // undetermined (the same rule disclosed `content` follows). Without
       // this term the vector `trace-v2-malformed-anchor-ref` verified GREEN.
-      ok: envelopeOk && merkleRootOk && keyed.errors.length === 0,
+      ok: envelopeOk && merkleRootOk && keyed.errors.length === 0 && !duplicateKey,
       errors: cpErrors,
     });
   }
@@ -1217,7 +1228,17 @@ async function verifyAnchorTrace(
         // gateway (null) leaves the offline-sound checkpoint ok; the run
         // downgrades to "partial" (exit 3) via gatewayUnavailable, not a hard
         // failure. A match (true) keeps it ok.
-        cpr.ok = cpr.envelopeOk && cpr.merkleRootOk && cpr.onChainOk !== false;
+        // AND into the verdict already computed, never rebuild it from a
+        // hand-listed set of dimensions. Rebuilding silently dropped every
+        // term not in that list: the duplicate-key gate (proof#28) and the
+        // `keyed.errors` term with it, so supplying a gateway turned a hard
+        // reject back into `verified` and an UNREACHABLE gateway turned it
+        // into `partial` (exit 3), which reads as a network problem an
+        // operator retries. Neither is conditioned on a gateway by the spec:
+        // `evidence-bundle.md` says two checkpoints carrying one key is a
+        // hard reject, full stop. Written this way, a term added at
+        // construction survives here by construction.
+        cpr.ok = cpr.ok && cpr.onChainOk !== false;
       }
     }
   }

package/src/verifier.ts

@@ -252,7 +252,22 @@ export async function verifyEnvelope(
     return {
       ok: false,
       specVersionOk: false,
-      payloadHashOk: false,
+      // `null`, not `false` (proof#62). This field carries "we cannot tell"
+      // against "it is wrong", and that distinction is what the whole
+      // minimum-disclosure posture rests on: a withheld record is `null` BY
+      // DESIGN and must never read as a failure (`evidence-bundle.md` §3.1,
+      // §6.2). There is no envelope here, so there is nothing to bind and
+      // nothing was determined. `false` asserted a binding had been checked
+      // and had failed, which is a claim this branch cannot support.
+      //
+      // The Python kernel already answered `None`, so the two disagreed on
+      // the dimension `verify-page` renders: an auditor on one CLI saw a
+      // dimension that could not be determined, and on the other one that
+      // failed, for the same bytes. `ok` is `false` either way, so no rollup
+      // verdict changes; what changes is what we tell the reader.
+      //
+      // `contentHashOk` on the next line already follows this rule.
+      payloadHashOk: null,
       signatureOk: false,
       contentHashOk: expectedContentHash === undefined ? null : false,
       contentRole: null,