@sanning/proof 0.9.1 → 0.10.0

package/dist/grading.d.ts

@@ -113,7 +113,7 @@ export interface PackGrade {
 export declare function accountDisclosure(bundle: unknown, content: Readonly<Record<string, Uint8Array>> | ReadonlyMap<string, Uint8Array>): DisclosureAccount;
 /** The `leaf_count` a checkpoint's SIGNED record commits to, or null if unreadable. */
 export declare function signedLeafCount(checkpoint: {
-    record_bytes?: unknown;
+    event_bytes?: unknown;
 } | null | undefined): number | null;
 /**
  * Omission — the failure a per-record check structurally cannot see.

package/dist/grading.js

@@ -104,6 +104,18 @@ function inclusionKeyOf(incl) {
         return null;
     return (hasV2 ? incl.checkpoint_ref : incl.checkpoint_tx_id);
 }
+// The key a checkpoint and an inclusion are MATCHED on. A `checkpoint_ref` is
+// folded to lower case, because the verifier lowercases it before comparing.
+// A retired `tx_id` / `checkpoint_tx_id` is compared exactly as written, as the
+// retired reader did, even when it happens to look like hex.
+function checkpointMatchKey(o) {
+    const k = joinKeyOf(o);
+    return k !== null && typeof o?.checkpoint_ref === "string" ? k.toLowerCase() : k;
+}
+function inclusionMatchKey(incl) {
+    const k = inclusionKeyOf(incl);
+    return k !== null && typeof incl?.checkpoint_ref === "string" ? k.toLowerCase() : k;
+}
 const eventsOf = (bundle) => {
     const e = bundle?.body?.events;
     return Array.isArray(e) ? e : [];
@@ -272,7 +284,7 @@ export function accountDisclosure(bundle, content) {
 }
 /** The `leaf_count` a checkpoint's SIGNED record commits to, or null if unreadable. */
 export function signedLeafCount(checkpoint) {
-    const hex = checkpoint?.record_bytes;
+    const hex = checkpoint?.event_bytes;
     if (typeof hex !== "string" || hex.length === 0)
         return null;
     try {
@@ -310,7 +322,14 @@ export function completenessNotes(bundle) {
             notes.push({ checkpointRef, signed: null, presented: null, kind: "unreadable" });
             continue;
         }
-        const presented = events.filter((e) => inclusionKeyOf(e?.inclusion) === key).length;
+        // Compared case-folded. The verifier recomputes `checkpoint_ref` and
+        // accepts it in any case (evidence-bundle.md §5.1 names lowercase hex as
+        // the form, and the kernel lowercases before comparing), so a pack whose
+        // checkpoint spells its ref in upper case still verifies. Grading it
+        // case-sensitively reported every record as omitted: a completeness
+        // accusation manufactured by letter case. The ref shown is the pack's own.
+        const want = checkpointMatchKey(cp);
+        const presented = events.filter((e) => inclusionMatchKey(e?.inclusion) === want).length;
         if (presented < signed)
             notes.push({ checkpointRef, signed, presented, kind: "omitted" });
         else if (presented > signed)
@@ -455,7 +474,7 @@ export function renderCause(cause, subject = "this pack") {
         case "leaf-count-unreadable":
             return `checkpoint ${cause.checkpointRef} has no readable signed leaf_count — completeness is UNKNOWN`;
         case "no-disclosure":
-            return (`no record bytes were disclosed — content binding is UNKNOWN for all ${cause.count} ` +
+            return (`no event bytes were disclosed — content binding is UNKNOWN for all ${cause.count} ` +
                 `record(s), not verified`);
         case "missing-disclosure":
             return (`${cause.count} of ${cause.of} record(s) disclose no bytes (first: ${cause.firstEventId}) — ` +

package/dist/index.d.ts

@@ -2,8 +2,8 @@ export { ACCEPTED_SPEC_MAJORS, contentHashes, jcs, specVersionSupported, verifyE
 export { bytesToHex, deriveOperatorAddress, ed25519Verify, hexToBytes, sha256Bytes, sha256Hex, utf8, verifyRsaPssSha256, } from "./crypto.js";
 export { EMPTY_TREE_ROOT_HEX, auditPath, leafHash, merkleRoot, nodeHash, verifyInclusion, } from "./merkle.js";
 export type { ContentRole, Envelope, Subject, VerificationResult, VerifyOptions } from "./types.js";
-export { ANCHOR_TRACE_BODY_TYPE, ANCHOR_TRACE_BODY_TYPE_V1, ANCHOR_TRACE_BODY_TYPES, EXPORT_BODY_TYPE, STAMP_BODY_VERSION, STAMP_TRACE_BODY_TYPE, STAMP_EVIDENCE_BODY_TYPE, disclosedContent, recomputeExportVerdict, verifyEvidenceBundle, } from "./evidence.js";
-export type { AnchorTraceBody, AttestationPayload, AttestationRecord, AttestationResult, CheckpointResult, ComposeVerdictResult, DisclosedContentResult, DisclosedEventContent, DisclosureStatus, EvidenceBundle, EvidenceBundleResult, EvidenceIssuer, EvidenceStatus, EvidenceVerdict, EventResult, ExportBody, ExportResult, OnChainOutcome, OnChainResult, PerGatewayOutcome, AnchorRef, StampBody, StampEntry, StampResult, StampSubtree, StampSubtreeResult, StampTraceBody, StampEvidenceBody, StampEvidenceEvent, StampEvidenceInclusion, TraceCheckpoint, TraceCheckpointV1, TraceEvent, TraceInclusion, VerdictAttestation, VerdictCheckpoint, VerdictEvent, VerdictObject, VerdictOnChain, VerdictOnChainGateway, VerifyEvidenceOptions, } from "./evidence.js";
+export { ANCHOR_TRACE_BODY_TYPE, EXPORT_BODY_TYPE, STAMP_BODY_VERSION, STAMP_TRACE_BODY_TYPE, STAMP_EVIDENCE_BODY_TYPE, disclosedContent, recomputeExportVerdict, verifyEvidenceBundle, } from "./evidence.js";
+export type { AnchorTraceBody, AttestationPayload, AttestationRecord, AttestationResult, CheckpointResult, ComposeVerdictResult, DisclosedContentResult, DisclosedEventContent, DisclosureStatus, EvidenceBundle, EvidenceBundleResult, EvidenceIssuer, EvidenceStatus, EvidenceVerdict, EventResult, ExportBody, ExportResult, OnChainOutcome, OnChainResult, PerGatewayOutcome, AnchorRef, StampBody, StampEntry, StampResult, StampSubtree, StampSubtreeResult, StampTraceBody, StampEvidenceBody, StampEvidenceEvent, StampEvidenceInclusion, TraceCheckpoint, TraceEvent, TraceInclusion, VerdictAttestation, VerdictCheckpoint, VerdictEvent, VerdictObject, VerdictOnChain, VerdictOnChainGateway, VerifyEvidenceOptions, } from "./evidence.js";
 export { accountDisclosure, completenessNotes, gradeCauses, gradePack, renderCause, signedLeafCount, } from "./grading.js";
 export type { CompletenessNote, DisclosureAccount, GradeInput, PackGrade, PackGradeCause, PackGradeCauseKind, PackVerdict, } from "./grading.js";
 export { ADAPTER_CHAIN_NAMESPACES, CHAIN_READING_SCOPE, readChains, renderChainFinding, } from "./chain.js";

package/dist/index.js

@@ -21,9 +21,9 @@ export { ACCEPTED_SPEC_MAJORS, contentHashes, jcs, specVersionSupported, verifyE
 export { bytesToHex, deriveOperatorAddress, ed25519Verify, hexToBytes, sha256Bytes, sha256Hex, utf8, verifyRsaPssSha256, } from "./crypto.js";
 export { EMPTY_TREE_ROOT_HEX, auditPath, leafHash, merkleRoot, nodeHash, verifyInclusion, } from "./merkle.js";
 // Evidence-bundle verification (specs/evidence-bundle.md): the signed
-// sanning.evidence/v1 wrapper carrying the sanning.anchor.trace/v1 body. The CLI
+// sanning.evidence/v1 wrapper carrying the sanning.anchor.trace/v3 body. The CLI
 // (`npx @sanning/proof verify`) is built on this. The same path dispatches on the
-// issuer-composed sanning.evidence.export/v1 body (specs/evidence-export.md) to
+// issuer-composed sanning.evidence.export/v2 body (specs/evidence-export.md) to
 // verifyExportBody (embedded RSA-PSS operator attestations + a recomputed §4
 // verdict object with per-gateway on-chain outcomes).
 //
@@ -34,7 +34,7 @@ export { EMPTY_TREE_ROOT_HEX, auditPath, leafHash, merkleRoot, nodeHash, verifyI
 // files that failed verification on genuine evidence. This hands back DECODED
 // bytes, and only for events whose verification bound them to the committed
 // content_hash. Additive; verifyEvidenceBundle's behavior is unchanged.
-export { ANCHOR_TRACE_BODY_TYPE, ANCHOR_TRACE_BODY_TYPE_V1, ANCHOR_TRACE_BODY_TYPES, EXPORT_BODY_TYPE, STAMP_BODY_VERSION, STAMP_TRACE_BODY_TYPE, STAMP_EVIDENCE_BODY_TYPE, disclosedContent, recomputeExportVerdict, verifyEvidenceBundle, } from "./evidence.js";
+export { ANCHOR_TRACE_BODY_TYPE, EXPORT_BODY_TYPE, STAMP_BODY_VERSION, STAMP_TRACE_BODY_TYPE, STAMP_EVIDENCE_BODY_TYPE, disclosedContent, recomputeExportVerdict, verifyEvidenceBundle, } from "./evidence.js";
 // Pack grading (src/grading.ts): what a verification SURFACE may claim about a
 // pack — the signed bundle PLUS whatever disclosed bytes travelled beside it.
 //
@@ -51,7 +51,7 @@ export { ANCHOR_TRACE_BODY_TYPE, ANCHOR_TRACE_BODY_TYPE_V1, ANCHOR_TRACE_BODY_TY
 // derivation to it, and diff its copy against ours. Additive — no existing
 // export changes.
 export { accountDisclosure, completenessNotes, gradeCauses, gradePack, renderCause, signedLeafCount, } from "./grading.js";
-// Chain reading (src/chain.ts): following the pointer every sanning.events/v1
+// Chain reading (src/chain.ts): following the pointer every sanning.events/v2
 // record carries to the record before it, over the records ONE bundle presents.
 //
 // Every anchored event has carried that pointer since the profile was ratified
@@ -67,13 +67,13 @@ export { accountDisclosure, completenessNotes, gradeCauses, gradePack, renderCau
 //
 // It returns FINDINGS, never a verdict, and it feeds no status. Chain links are
 // deletion/reorder-evidence for the events present and NOT a completeness proof
-// (`anchor/docs/profile-sanning.events-v1.md` §5) — drop the last N events of a
+// (`anchor/docs/profile-sanning.events-v2.md` §5), drop the last N events of a
 // chain and nothing dangles. `CHAIN_READING_SCOPE` is that sentence, exported so
 // every surface prints the same limit rather than paraphrasing it into a claim.
 // Additive — no existing export changes.
 export { ADAPTER_CHAIN_NAMESPACES, CHAIN_READING_SCOPE, readChains, renderChainFinding, } from "./chain.js";
 // The `proof export` composer (specs/evidence-export.md §5, phase 2): produce a
-// signed, offline-verifiable sanning.evidence.export/v1 artifact from a source
+// signed, offline-verifiable sanning.evidence.export/v2 artifact from a source
 // anchor-trace bundle + operator attestations + an exporter Ed25519 key. The
 // inverse of verifyEvidenceBundle's verifyExportBody dispatch.
 export { attestationSignatureToHex, composeExport } from "./compose.js";

package/dist/verifier.d.ts

@@ -4,6 +4,7 @@ export declare const MAX_CANONICAL_DEPTH = 128;
 export declare function exceedsDepth(value: unknown, max: number): boolean;
 export declare function jcs(value: unknown): string;
 export declare function specVersionSupported(specVersion: string): boolean;
+export declare function isRfc3339UtcInstant(value: unknown): boolean;
 export declare function contentHashes(env: Envelope): {
     role: ContentRole;
     hash: string;

package/dist/verifier.js

@@ -13,7 +13,7 @@ import { ed25519Verify, sha256Hex, utf8 } from "./crypto.js";
 // major ("sanning.agent/v1.<minor>") are additive and tolerated — matching the Go
 // reference kernel's semantics (pkg/proof isSupportedSpec) so the kernels do
 // not diverge on minors. Accepting a new profile is a deliberate one-entry
-// addition HERE and only here. sanning.events/v1 (external commitment + Minimal
+// addition HERE and only here. sanning.events/v2 (external commitment + Minimal
 // disclosure; envelope-spec §4) is verified through the SAME primitives — the
 // signed scope is still envelope-minus-signature-minus-co_signatures, with no
 // profile-specific dialect (no underscore strip, that is mlflow-only).
@@ -35,9 +35,13 @@ import { ed25519Verify, sha256Hex, utf8 } from "./crypto.js";
 // always strict mode) and the `readonly string[]` type rejects it at compile
 // time. The elements are strings, so a shallow freeze is a deep one. Pinned by
 // test/accept-set.test.ts "the exported registry cannot be widened at runtime".
+//
+// `sanning.events/v2` replaced `sanning.events/v1` in the producer-to-agent cut
+// (envelope-spec A10, governance.md §8 W-3). The old major is rejected like any
+// other unknown one: DL-73 keeps no reader for it.
 export const ACCEPTED_SPEC_MAJORS = Object.freeze([
     "sanning.agent/v1",
-    "sanning.events/v1",
+    "sanning.events/v2",
 ]);
 // Maximum JSON container-nesting depth a verifier will canonicalize. Inputs
 // nested deeper are rejected as malformed BEFORE canonicalization runs. This is
@@ -228,6 +232,57 @@ export function specVersionSupported(specVersion) {
         return minor.length > 0 && /^[0-9]+$/.test(minor);
     });
 }
+// `signed_at` format (envelope-spec §2: "RFC 3339 UTC, `Z`"), proof#95. The
+// accepted form is RFC 3339 `date-time` narrowed three ways, identically in
+// every kernel:
+//   - the zone is an uppercase `Z`: never a numeric offset (not even
+//     `+00:00`), never a lowercase `z` or `t`;
+//   - the date is a real proleptic Gregorian date from 0001-01-01 to
+//     9999-12-31, so February 29 only in a leap year;
+//   - second 60 is refused. RFC 3339 allows it at a real leap second, but
+//     which instants those were needs a table, and JavaScript's `Date`,
+//     Python's `datetime` and Go's `time` cannot hold one, so a verified `:60`
+//     would fail the first consumer that parses it.
+// Fractional seconds of any length are allowed. Digits are ASCII `[0-9]`
+// (Python's `\d` matches any Unicode digit, so the Python kernel spells it the
+// same way).
+const RFC3339_UTC = /^([0-9]{4})-([0-9]{2})-([0-9]{2})T([0-9]{2}):([0-9]{2}):([0-9]{2})(?:\.[0-9]+)?Z$/;
+const DAYS_IN_MONTH = [31, 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31];
+export function isRfc3339UtcInstant(value) {
+    if (typeof value !== "string")
+        return false;
+    const m = RFC3339_UTC.exec(value);
+    if (m === null)
+        return false;
+    const [year, month, day, hour, minute, second] = m.slice(1).map(Number);
+    if (year < 1 || month < 1 || month > 12 || day < 1)
+        return false;
+    const leap = year % 4 === 0 && (year % 100 !== 0 || year % 400 === 0);
+    const days = month === 2 && leap ? 29 : DAYS_IN_MONTH[month - 1];
+    return day <= days && hour <= 23 && minute <= 59 && second <= 59;
+}
+// The skeleton fields whose FORMAT §2 fixes and no other check reaches: a
+// correctly signed envelope with `signed_at: "2026-02-30T00:00:00Z"` or
+// `environment: "prod\u0000uction"` passes the signature and the payload
+// binding, so without this it verified in full. Each is checked only when
+// present: §2 flags an absent `signed_at` as non-conformant rather than
+// rejecting it, and `environment` is optional in the skeleton.
+//
+// Own properties only, because those are the members `jcs` signs over.
+function skeletonFieldErrors(env) {
+    const fields = env;
+    const own = (k) => (Object.prototype.hasOwnProperty.call(fields, k) ? fields[k] : undefined);
+    const out = [];
+    const signedAt = own("signed_at");
+    if (signedAt !== undefined && !isRfc3339UtcInstant(signedAt)) {
+        out.push("malformed signed_at: not an RFC 3339 UTC date-time with Z naming a real date and time (envelope-spec §2)");
+    }
+    const environment = own("environment");
+    if (environment !== undefined && environment !== "dev" && environment !== "production") {
+        out.push('malformed environment: not "dev" or "production" (envelope-spec §2)');
+    }
+    return out;
+}
 // The content hash(es) an envelope commits to, by event type — the values a
 // reverse lookup can match the user's in-browser file hash against.
 //   asset_registered -> payload.hash            (the registered, known-good bytes)
@@ -339,6 +394,13 @@ export async function verifyEnvelope(env, optionsOrContentHash) {
     const specVersionOk = specVersionSupported(env.spec_version);
     if (!specVersionOk)
         errors.push(`unsupported spec_version: ${JSON.stringify(env.spec_version)}`);
+    // Skeleton field format (envelope-spec §2, proof#95): a present `signed_at`
+    // or `environment` that is not what §2 says fails the verdict. There is no
+    // result field for it, so the verdict shape is unchanged for every envelope
+    // the spec allows; the reason is in `errors`.
+    const fieldErrors = skeletonFieldErrors(env);
+    errors.push(...fieldErrors);
+    const fieldsOk = fieldErrors.length === 0;
     // Check 1 — Payload binding (both modes; see header).
     //
     // payload_hash MUST be present and a string in every mode — envelope-spec
@@ -404,7 +466,7 @@ export async function verifyEnvelope(env, optionsOrContentHash) {
         const committed = contentHashes(env);
         if (committed.length === 0) {
             // UNDETERMINED, not failed. An external-commitment envelope
-            // (`sanning.events/v1`) has no inline payload, so it commits to no
+            // (`sanning.events/v2`) has no inline payload, so it commits to no
             // envelope-readable content hash and there is nothing here to compare
             // against. Reporting that as a failure would render "we cannot check
             // this" as "it did not match" — what P-10 and I-5 exist to prevent — and
@@ -439,7 +501,7 @@ export async function verifyEnvelope(env, optionsOrContentHash) {
         //
         // Absence stays undetermined: `contentHashOk` is null when no hash was
         // supplied, and null must not fail (P-10 — absence is not failure).
-        ok: specVersionOk && signatureOk && payloadHashOk !== false && contentHashOk !== false,
+        ok: specVersionOk && fieldsOk && signatureOk && payloadHashOk !== false && contentHashOk !== false,
         specVersionOk,
         payloadHashOk,
         signatureOk,

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@sanning/proof",
-  "version": "0.9.1",
-  "description": "TypeScript kernel of the Sanning verification stack: RFC 8785 (JCS) canonicalization, SHA-256, and Ed25519 verification for Verifiable Event Envelopes. Full-family verifier (inline + external commitment); accepts sanning.agent/v1, sanning.mlflow/v1, sanning.events/v1. Conformance-gated byte-for-byte against the test-vectors corpus.",
+  "version": "0.10.0",
+  "description": "TypeScript kernel of the Sanning verification stack: RFC 8785 (JCS) canonicalization, SHA-256, and Ed25519 verification for Verifiable Event Envelopes. Full-family verifier (inline + external commitment); accepts sanning.agent/v1 and sanning.events/v2. Conformance-gated byte-for-byte against the test-vectors corpus.",
   "license": "MIT",
   "type": "module",
   "sideEffects": false,

package/src/agent-proof.ts

@@ -118,6 +118,9 @@ export async function verifyAgentProofBundle(
     checkpointOk = res.ok && res.payloadHashOk === true;
     if (!res.signatureOk) errors.push("checkpoint envelope signature failed");
     if (res.payloadHashOk !== true) errors.push("checkpoint envelope payload binding failed");
+    // A malformed skeleton field (proof#95) fails the envelope with a valid
+    // signature and binding; name it rather than fail with no reason.
+    for (const m of res.errors) if (m.startsWith("malformed ")) errors.push(`checkpoint envelope ${m}`);
     const payload = (b.checkpoint_envelope.payload ?? {}) as {
       merkle_root?: unknown;
       leaf_count?: unknown;

package/src/chain.ts

@@ -2,8 +2,8 @@
 // event before it, and reporting what does not line up.
 //
 // WHY THIS LIVES IN THE KERNEL, BESIDE PACK GRADING.
-// `sanning.events/v1` records carry `previous_hash`, and until now nothing we
-// shipped read it. The envelope verifier hashes each event's `record_bytes`
+// `sanning.events/v2` records carry `previous_hash`, and until now nothing we
+// shipped read it. The envelope verifier hashes each event's `event_bytes`
 // and stops — `evidence.ts` says following the link is "consumer-layer logic
 // above it", and it was right that a SINGLE-envelope verifier should not do
 // it. But the consumer layer never did it either, so a bundle with an event
@@ -18,7 +18,7 @@
 // ---- WHAT THIS IS NOT ------------------------------------------------------
 //
 // It is not a completeness statement and it must never be read as one. The
-// profile says so in its own words (`anchor/docs/profile-sanning.events-v1.md`
+// profile says so in its own words (`anchor/docs/profile-sanning.events-v2.md`
 // §5): chain semantics are "deletion/reorder-evidence for the events present
 // ... not a completeness proof." Drop the last N events of a chain and nothing
 // here dangles; the record that would have pointed at them was never written.
@@ -273,7 +273,7 @@ async function groupChains(bundle: unknown): Promise<Group[]> {
     // event id an adapter pointer has nothing to resolve against.
     if (eventId === null || publicKey === null) continue;
 
-    const decoded = decodeRecord(entry?.record_bytes);
+    const decoded = decodeRecord(entry?.event_bytes);
     if (decoded === null) continue;
     const { record, bytes } = decoded;
 

package/src/cli.ts

@@ -2,8 +2,9 @@
 // npx @sanning/proof verify <bundle.json> [comma,sep,gateways]
 //
 // One turnkey verifier for both producer bundles in the stack:
-//   - sanning.evidence/v1 (body sanning.anchor.trace/v1)  — the @sanning/anchor SDK trace
-//   - sanning.agent.proof/v1                            — the agent inclusion proof
+//   - sanning.evidence/v1: bodies sanning.anchor.trace/v3, sanning.stamp.trace/v1,
+//     sanning.stamp.evidence/v2 and sanning.evidence.export/v2
+//   - sanning.agent.proof/v1: the agent inclusion proof
 // Dispatch is by sniffed spec_version; no flag tells the CLI which it is.
 //
 // Pinned exit codes (mirror `sanningd verify-status`):
@@ -184,8 +185,8 @@ export async function runCli(argv: string[], io: Cli): Promise<number> {
 // `proof bundle <source-bundle.json> --attestations <f> --key <f> [-o <out>]`
 // (`proof export` still reaches this, undocumented — see the dispatch above.)
 //
-// Compose a signed, offline-verifiable sanning.evidence.export/v1 artifact from a
-// source sanning.anchor.trace/v1 bundle + operator attestation records + an exporter
+// Compose a signed, offline-verifiable sanning.evidence.export/v2 artifact from a
+// source sanning.anchor.trace/v3 bundle + operator attestation records + an exporter
 // Ed25519 key (evidence-export.md §5, composer). Writes the export to `-o <out>`
 // (or stdout when omitted, so it can be piped straight into `proof verify`).
 //
@@ -307,8 +308,8 @@ function usageExport(io: Cli): number {
     "Usage: npx @sanning/proof bundle <source-bundle.json> --attestations <file> --key <file> [-o <out.json>]",
   );
   io.out("");
-  io.out("Compose a signed, offline-verifiable sanning.evidence.export/v1 artifact from an");
-  io.out("sanning.anchor.trace/v1 source bundle + operator attestation records + an exporter");
+  io.out("Compose a signed, offline-verifiable sanning.evidence.export/v2 artifact from an");
+  io.out("sanning.anchor.trace/v3 source bundle + operator attestation records + an exporter");
   io.out("Ed25519 key. The output verifies with `proof verify <out.json>`.");
   io.out("");
   io.out("--attestations <file>  JSON array of attestation records (or {attestations:[...]}).");
@@ -642,10 +643,12 @@ function printUsage(io: Cli): void {
   io.out("  verify <bundle.json> [gateways] [--logs <path>]        Verify a bundle");
   io.out("  bundle <source.json> --attestations <f> --key <f> [-o] Create an attested bundle");
   io.out("");
-  io.out("Verify a sanning.evidence/v1 (sanning.anchor.trace/v1) bundle, an");
-  io.out("sanning.evidence.export/v1 attested export, or a sanning.agent.proof/v1");
-  io.out("inclusion bundle, fully offline. Supply a comma-separated gateway list");
-  io.out("to also re-fetch each checkpoint on-chain.");
+  io.out("Verify a sanning.evidence/v1 bundle (body sanning.anchor.trace/v3,");
+  io.out("sanning.stamp.trace/v1, sanning.stamp.evidence/v2 or the attested export");
+  io.out("sanning.evidence.export/v2) or a sanning.agent.proof/v1 inclusion bundle,");
+  io.out("fully offline. Supply a comma-separated gateway list to also re-fetch");
+  io.out("each checkpoint and stamp on-chain. Only arweave witnesses are re-fetched;");
+  io.out("a witness of any other kind is not checked and the run exits 3.");
   io.out("");
   io.out("--logs <path>       Bind disclosed raw logs to each event's committed");
   io.out("                    content_hash. Either shape works, and which one you");

package/src/compose.ts

@@ -1,8 +1,8 @@
 // Attested-evidence-export composer (`proof export`, evidence-export.md §5,
 // phase 2). The last-mile issuer/runtime job the kernel does NOT own (§5.1
-// "Out of the kernel"): take a source `sanning.anchor.trace/v1` bundle + a set of
+// "Out of the kernel"): take a source `sanning.anchor.trace/v3` bundle + a set of
 // operator attestation records + an exporter Ed25519 key, and PRODUCE one signed,
-// offline-verifiable `sanning.evidence.export/v1` artifact — exactly the bytes the
+// offline-verifiable `sanning.evidence.export/v2` artifact, exactly the bytes the
 // kernel's verifyExportBody round-trip-verifies.
 //
 // This is the inverse of evidence.ts's verifyExportBody, and it is deliberately
@@ -64,7 +64,7 @@ export interface ComposeExportOptions {
 }
 
 export interface ComposeExportResult {
-  // The signed, offline-verifiable sanning.evidence.export/v1 artifact.
+  // The signed, offline-verifiable sanning.evidence.export/v2 artifact.
   bundle: EvidenceBundle;
   // The export rollup the embedded kernel_verdict carries (verified|partial|failed).
   status: EvidenceStatus;
@@ -75,7 +75,7 @@ export interface ComposeExportResult {
 }
 
 const GENESIS = "GENESIS";
-const EXPORT_SCHEMA = "sanning.evidence.export/v1";
+const EXPORT_SCHEMA = EXPORT_BODY_TYPE;
 
 // Transcode an attestation `signature` to the lowercase hex §2.2 mandates. The
 // issuer emits either lowercase-hex or unpadded base64url; §2.2 stores hex, so

package/src/crypto.ts

@@ -85,7 +85,7 @@ export async function ed25519PublicKey(privateKeyHex: string): Promise<string> {
 }
 
 // ---------------------------------------------------------------------------
-// RSA-PSS operator-attestation crypto (sanning.evidence.export/v1)
+// RSA-PSS operator-attestation crypto (sanning.evidence.export/v2)
 //
 // The attested-evidence-export body embeds operator attestations signed with
 // RSA-PSS-SHA-256 over the JCS-canonical attestation payload; the operator key