@sanning/proof 0.9.2 → 0.10.0

package/src/grading.ts

@@ -185,7 +185,7 @@ interface BundleLike {
       envelope?: { event_id?: unknown };
       inclusion?: { checkpoint_ref?: unknown; checkpoint_tx_id?: unknown };
     }[];
-    checkpoints?: { checkpoint_ref?: unknown; tx_id?: unknown; record_bytes?: unknown }[];
+    checkpoints?: { checkpoint_ref?: unknown; tx_id?: unknown; event_bytes?: unknown }[];
   };
 }
 
@@ -225,6 +225,22 @@ function inclusionKeyOf(
   return (hasV2 ? incl.checkpoint_ref : incl.checkpoint_tx_id) as string;
 }
 
+// The key a checkpoint and an inclusion are MATCHED on. A `checkpoint_ref` is
+// folded to lower case, because the verifier lowercases it before comparing.
+// A retired `tx_id` / `checkpoint_tx_id` is compared exactly as written, as the
+// retired reader did, even when it happens to look like hex.
+function checkpointMatchKey(o: { checkpoint_ref?: unknown; tx_id?: unknown } | null | undefined): string | null {
+  const k = joinKeyOf(o);
+  return k !== null && typeof o?.checkpoint_ref === "string" ? k.toLowerCase() : k;
+}
+
+function inclusionMatchKey(
+  incl: { checkpoint_ref?: unknown; checkpoint_tx_id?: unknown } | null | undefined,
+): string | null {
+  const k = inclusionKeyOf(incl);
+  return k !== null && typeof incl?.checkpoint_ref === "string" ? k.toLowerCase() : k;
+}
+
 const eventsOf = (bundle: unknown) => {
   const e = (bundle as BundleLike | null)?.body?.events;
   return Array.isArray(e) ? e : [];
@@ -402,8 +418,8 @@ export function accountDisclosure(
 }
 
 /** The `leaf_count` a checkpoint's SIGNED record commits to, or null if unreadable. */
-export function signedLeafCount(checkpoint: { record_bytes?: unknown } | null | undefined): number | null {
-  const hex = checkpoint?.record_bytes;
+export function signedLeafCount(checkpoint: { event_bytes?: unknown } | null | undefined): number | null {
+  const hex = checkpoint?.event_bytes;
   if (typeof hex !== "string" || hex.length === 0) return null;
   try {
     const record = JSON.parse(new TextDecoder().decode(hexToBytes(hex))) as {
@@ -442,7 +458,14 @@ export function completenessNotes(bundle: unknown): CompletenessNote[] {
       notes.push({ checkpointRef, signed: null, presented: null, kind: "unreadable" });
       continue;
     }
-    const presented = events.filter((e) => inclusionKeyOf(e?.inclusion) === key).length;
+    // Compared case-folded. The verifier recomputes `checkpoint_ref` and
+    // accepts it in any case (evidence-bundle.md §5.1 names lowercase hex as
+    // the form, and the kernel lowercases before comparing), so a pack whose
+    // checkpoint spells its ref in upper case still verifies. Grading it
+    // case-sensitively reported every record as omitted: a completeness
+    // accusation manufactured by letter case. The ref shown is the pack's own.
+    const want = checkpointMatchKey(cp);
+    const presented = events.filter((e) => inclusionMatchKey(e?.inclusion) === want).length;
     if (presented < signed) notes.push({ checkpointRef, signed, presented, kind: "omitted" });
     else if (presented > signed) notes.push({ checkpointRef, signed, presented, kind: "surplus" });
   }
@@ -604,7 +627,7 @@ export function renderCause(cause: PackGradeCause, subject = "this pack"): strin
       return `checkpoint ${cause.checkpointRef} has no readable signed leaf_count — completeness is UNKNOWN`;
     case "no-disclosure":
       return (
-        `no record bytes were disclosed — content binding is UNKNOWN for all ${cause.count} ` +
+        `no event bytes were disclosed — content binding is UNKNOWN for all ${cause.count} ` +
         `record(s), not verified`
       );
     case "missing-disclosure":

package/src/index.ts

@@ -46,9 +46,9 @@ export {
 export type { ContentRole, Envelope, Subject, VerificationResult, VerifyOptions } from "./types.js";
 
 // Evidence-bundle verification (specs/evidence-bundle.md): the signed
-// sanning.evidence/v1 wrapper carrying the sanning.anchor.trace/v1 body. The CLI
+// sanning.evidence/v1 wrapper carrying the sanning.anchor.trace/v3 body. The CLI
 // (`npx @sanning/proof verify`) is built on this. The same path dispatches on the
-// issuer-composed sanning.evidence.export/v1 body (specs/evidence-export.md) to
+// issuer-composed sanning.evidence.export/v2 body (specs/evidence-export.md) to
 // verifyExportBody (embedded RSA-PSS operator attestations + a recomputed §4
 // verdict object with per-gateway on-chain outcomes).
 //
@@ -61,8 +61,6 @@ export type { ContentRole, Envelope, Subject, VerificationResult, VerifyOptions
 // content_hash. Additive; verifyEvidenceBundle's behavior is unchanged.
 export {
   ANCHOR_TRACE_BODY_TYPE,
-  ANCHOR_TRACE_BODY_TYPE_V1,
-  ANCHOR_TRACE_BODY_TYPES,
   EXPORT_BODY_TYPE,
   STAMP_BODY_VERSION,
   STAMP_TRACE_BODY_TYPE,
@@ -103,7 +101,6 @@ export type {
   StampEvidenceEvent,
   StampEvidenceInclusion,
   TraceCheckpoint,
-  TraceCheckpointV1,
   TraceEvent,
   TraceInclusion,
   VerdictAttestation,
@@ -148,7 +145,7 @@ export type {
   PackVerdict,
 } from "./grading.js";
 
-// Chain reading (src/chain.ts): following the pointer every sanning.events/v1
+// Chain reading (src/chain.ts): following the pointer every sanning.events/v2
 // record carries to the record before it, over the records ONE bundle presents.
 //
 // Every anchored event has carried that pointer since the profile was ratified
@@ -164,7 +161,7 @@ export type {
 //
 // It returns FINDINGS, never a verdict, and it feeds no status. Chain links are
 // deletion/reorder-evidence for the events present and NOT a completeness proof
-// (`anchor/docs/profile-sanning.events-v1.md` §5) — drop the last N events of a
+// (`anchor/docs/profile-sanning.events-v2.md` §5), drop the last N events of a
 // chain and nothing dangles. `CHAIN_READING_SCOPE` is that sentence, exported so
 // every surface prints the same limit rather than paraphrasing it into a claim.
 // Additive — no existing export changes.
@@ -183,7 +180,7 @@ export type {
 } from "./chain.js";
 
 // The `proof export` composer (specs/evidence-export.md §5, phase 2): produce a
-// signed, offline-verifiable sanning.evidence.export/v1 artifact from a source
+// signed, offline-verifiable sanning.evidence.export/v2 artifact from a source
 // anchor-trace bundle + operator attestations + an exporter Ed25519 key. The
 // inverse of verifyEvidenceBundle's verifyExportBody dispatch.
 export { attestationSignatureToHex, composeExport } from "./compose.js";

package/src/verifier.ts

@@ -17,7 +17,7 @@ import type { ContentRole, Envelope, VerificationResult, VerifyOptions } from ".
 // major ("sanning.agent/v1.<minor>") are additive and tolerated — matching the Go
 // reference kernel's semantics (pkg/proof isSupportedSpec) so the kernels do
 // not diverge on minors. Accepting a new profile is a deliberate one-entry
-// addition HERE and only here. sanning.events/v1 (external commitment + Minimal
+// addition HERE and only here. sanning.events/v2 (external commitment + Minimal
 // disclosure; envelope-spec §4) is verified through the SAME primitives — the
 // signed scope is still envelope-minus-signature-minus-co_signatures, with no
 // profile-specific dialect (no underscore strip, that is mlflow-only).
@@ -39,9 +39,13 @@ import type { ContentRole, Envelope, VerificationResult, VerifyOptions } from ".
 // always strict mode) and the `readonly string[]` type rejects it at compile
 // time. The elements are strings, so a shallow freeze is a deep one. Pinned by
 // test/accept-set.test.ts "the exported registry cannot be widened at runtime".
+//
+// `sanning.events/v2` replaced `sanning.events/v1` in the producer-to-agent cut
+// (envelope-spec A10, governance.md §8 W-3). The old major is rejected like any
+// other unknown one: DL-73 keeps no reader for it.
 export const ACCEPTED_SPEC_MAJORS: readonly string[] = Object.freeze([
   "sanning.agent/v1",
-  "sanning.events/v1",
+  "sanning.events/v2",
 ]);
 
 // Maximum JSON container-nesting depth a verifier will canonicalize. Inputs
@@ -488,7 +492,7 @@ export async function verifyEnvelope(
     const committed = contentHashes(env);
     if (committed.length === 0) {
       // UNDETERMINED, not failed. An external-commitment envelope
-      // (`sanning.events/v1`) has no inline payload, so it commits to no
+      // (`sanning.events/v2`) has no inline payload, so it commits to no
       // envelope-readable content hash and there is nothing here to compare
       // against. Reporting that as a failure would render "we cannot check
       // this" as "it did not match" — what P-10 and I-5 exist to prevent — and

package/vectors/README.md

@@ -12,7 +12,7 @@ correctly.
 
 The rule that decides what re-fetching a **stamp's witness** from a gateway does
 and does not settle — the optional, online half of `sanning.stamp.trace/v1` and
-`sanning.stamp.evidence/v1` (`evidence-bundle.md` §5.2.4 / §5.3.4). Implemented
+`sanning.stamp.evidence/v2` (`evidence-bundle.md` §5.2.4 / §5.3.4). Implemented
 by [`../src/evidence.ts`](../src/evidence.ts) and asserted against this table by
 [`../test/stamp-on-chain-vectors.test.ts`](../test/stamp-on-chain-vectors.test.ts)
 — **and by the Python kernel against the same bytes**, in

package/vectors/chain-reading.json

@@ -1,10 +1,10 @@
 {
   "rule": "chain-reading",
   "ruleVersion": 1,
-  "statement": "What following an event chain DOES and DOES NOT show. Every sanning.events/v1 record points at the record before it; reading those pointers over the records a bundle presents yields deletion- and reorder-EVIDENCE for those records, and nothing else. It is not a completeness proof and no finding here is a verdict: a chain whose last events were never exported dangles nowhere, and a record that is withheld or unreadable takes no part in a chain rather than becoming an accusation. Findings are the specific links that do not resolve inside the bundle in front of the reader: chain-link-dangling, chain-gap, chain-second-root.",
+  "statement": "What following an event chain DOES and DOES NOT show. Every sanning.events/v2 record points at the record before it; reading those pointers over the records a bundle presents yields deletion- and reorder-EVIDENCE for those records, and nothing else. It is not a completeness proof and no finding here is a verdict: a chain whose last events were never exported dangles nowhere, and a record that is withheld or unreadable takes no part in a chain rather than becoming an accusation. Findings are the specific links that do not resolve inside the bundle in front of the reader: chain-link-dangling, chain-gap, chain-second-root.",
   "home": "@sanning/proof — ts/vectors/chain-reading.json. This file is the RULE, not a test fixture of one implementation. The kernel implements it in ts/src/chain.ts and is held to it by ts/test/chain.test.ts.",
   "consumers": "A surface that follows event chains SHOULD call the kernel's readChains rather than derive the rule again. A surface that cannot yet (an older pinned kernel, another language) vendors this file byte-for-byte, asserts its own derivation against it, and runs a drift check that compares its copy against the copy shipped in the @sanning/proof tarball at vectors/chain-reading.json — and that fails when it cannot find a copy to compare against. A vendored copy that is not byte-identical to this one is a defect, not a variant.",
-  "howToUse": "Each case is a chain as it was WRITTEN, in order. Build one event record per entry from `recordScaffold`, overriding `previous_hash`, `context` and `metadata` from the entry and setting `event.content_length` to the entry's index so no two records share bytes. Canonicalize each record (RFC 8785), hex-encode the bytes as `record_bytes`, and place it in a bundle body as `{ envelope: { event_id, public_key }, record_bytes }` — in array order, SKIPPING every entry marked `dropped`. A dropped entry is still built and still hashed, because that is what deletion is: the record existed, its successor still points at it, and the pointer now leads nowhere. Then call readChains and assert `expect`.",
+  "howToUse": "Each case is a chain as it was WRITTEN, in order. Build one event record per entry from `recordScaffold`, overriding `previous_hash`, `context` and `metadata` from the entry and setting `event.content_length` to the entry's index so no two records share bytes. Canonicalize each record (RFC 8785), hex-encode the bytes as `event_bytes`, and place it in a bundle body as `{ envelope: { event_id, public_key }, event_bytes }`, in array order, SKIPPING every entry marked `dropped`. A dropped entry is still built and still hashed, because that is what deletion is: the record existed, its successor still points at it, and the pointer now leads nowhere. Then call readChains and assert `expect`.",
   "placeholders": {
     "@<id>": "The LINK IDENTITY of the entry with that id — for a record chain the SHA-256 of its canonical record bytes, for an adapter chain its event_id. Resolvable for dropped entries too; that is the point of them.",
     "GENESIS": "In previous_hash: this record claims to begin its chain.",
@@ -14,9 +14,9 @@
   "adapterNamespaces": "Verified against sanning-io/anchor @ main, 2026-09-07: `run` (LangChain callbacks, TS and Python — anchor#68 promoted this out of the old `langchain` namespace), `vercel_ai` (Vercel AI SDK middleware), `interchange` (Interchange adapter). All three carry `prev_event_id` and `seq`; their chain key is `root_run_id`, `chain_key` and `session_id` respectively. These are read ONLY where the record carries no chain of its own, and they are transitional: once every adapter sets the record's own previous_hash, a reader needs no adapter knowledge at all.",
   "recordScaffold": {
     "payload_version": 1,
-    "spec_version": "sanning.events/v1",
+    "spec_version": "sanning.events/v2",
     "event_type": "langchain.tool_start",
-    "subject": { "type": "producer", "producer_id": "vector" },
+    "subject": { "type": "agent", "agent_id": "vector" },
     "event": {
       "content_hash": "5e884898da28047151d0e56f8dc6292773603d0d6aabbdd62a11ef721d1542d8",
       "content_length": 0

package/vectors/stamp-on-chain.json

@@ -4,7 +4,7 @@
   "statement": "What re-fetching a stamp's witness from a gateway DOES and DOES NOT settle. A stamp body carries no producer signature and no inclusion proof of its own, so the witness is the entire independent part of it (evidence-bundle.md §5.2.4): confirming that a gateway holds the exact bytes named by anchor_ref is the only check that turns Sanning's own assertion into evidence. It is an ONLINE act and always optional — an offline verdict is unchanged by it and never claims it happened. Four states, never three: not-checked (no gateway was asked, or the stamp names no witness), confirm (a gateway returned the witnessed bytes), mismatch (a gateway returned DIFFERENT bytes — the only outcome that fails anything), unreachable (we asked and nobody answered — an availability gap, never an accusation). The expected bytes are stamps[].stamp_bytes VERBATIM, because §5.2.2 defines that field as the exact bytes handed to the witness; re-canonicalizing them would compare the chain against bytes nobody signed.",
   "home": "@sanning/proof — ts/vectors/stamp-on-chain.json. This file is the RULE, not a test fixture of one implementation. The TypeScript kernel implements it in ts/src/evidence.ts (refetchStamps / refetchStamp / probeGateway / rollupOnChain) and is held to it by ts/test/stamp-on-chain-vectors.test.ts; the Python kernel implements it in src/sanning_proof/evidence.py (_refetch_stamps / _refetch_stamp / _probe_gateway / _rollup_on_chain) and is held to the SAME file by tests/test_stamp_on_chain_vectors.py. Neither kernel can pass by agreeing with the other.",
   "consumers": "A surface that re-fetches a stamp witness SHOULD call the kernel's verifyEvidenceBundle with `gateways` rather than derive the rule again. A surface that cannot yet (an older pinned kernel, another language) vendors this file byte-for-byte, asserts its own derivation against it, and runs a drift check against the copy shipped in the @sanning/proof tarball at vectors/stamp-on-chain.json — failing when it cannot find a copy to compare against. A vendored copy that is not byte-identical to this one is a defect, not a variant. In particular: a surface MUST NOT collapse the four states into a boolean. A reader that cannot distinguish not-checked from unreachable will report that no gateway could be reached when none was tried, which is a false accusation manufactured by a missing state, and is the defect this table was written after.",
-  "howToUse": "Each case describes one sanning.stamp.evidence/v1 pack and one set of scripted gateway responses. Build the pack from `packScaffold`: for each entry of `stamps` (index i, 0-based) sign ONE sanning.events/v1 envelope over the record {\"event\":{\"content_hash\":\"<64×a>\"},\"i\":i} with event_id `ev-<i>` and the fixed seed, take its leaf under RFC 9162 (SHA-256(0x00 ‖ JCS(envelope))), make a one-leaf tree, and build the stamp body from `stampBodyScaffold` with merkle_root = that root, leaf_count = 1 and one sub-tree covering [0,1). stamp_bytes is JCS(stamp body) hex-encoded; stamp_ref is SHA-256 of the DECODED bytes. When the entry's `witnessed` is true attach anchor_ref = {kind: \"arweave\", id: `<anchorIdPrefix><i>`}, otherwise omit anchor_ref entirely. Give each stamp one event whose inclusion is {stamp_ref, leaf_index: 0, leaf_count: 1, leaf_hash, audit_path: []}. Wrap the body per `wrapperScaffold`, set body_hash = SHA-256(JCS(body)) and sign the wrapper (minus `signature`) with the same seed. Then call the kernel with the case's `gateways` and a fetch seam that answers `{gateway}/{anchor id}` per the `returns` entry for that stamp at that gateway's index, and assert `expect`. A case with an empty `gateways` list is called with no gateway list at all — that is the not-checked state and it must be reachable without a fetch seam.",
+  "howToUse": "Each case describes one sanning.stamp.evidence/v2 pack and one set of scripted gateway responses. Build the pack from `packScaffold`: for each entry of `stamps` (index i, 0-based) sign ONE sanning.events/v2 envelope over the record {\"event\":{\"content_hash\":\"<64×a>\"},\"i\":i} with event_id `ev-<i>` and the fixed seed, take its leaf under RFC 9162 (SHA-256(0x00 ‖ JCS(envelope))), make a one-leaf tree, and build the stamp body from `stampBodyScaffold` with merkle_root = that root, leaf_count = 1 and one sub-tree covering [0,1). stamp_bytes is JCS(stamp body) hex-encoded; stamp_ref is SHA-256 of the DECODED bytes. When the entry's `witnessed` is true attach anchor_ref = {kind: \"arweave\", id: `<anchorIdPrefix><i>`}, otherwise omit anchor_ref entirely. Give each stamp one event whose inclusion is {stamp_ref, leaf_index: 0, leaf_count: 1, leaf_hash, audit_path: []}. Wrap the body per `wrapperScaffold`, set body_hash = SHA-256(JCS(body)) and sign the wrapper (minus `signature`) with the same seed. Then call the kernel with the case's `gateways` and a fetch seam that answers `{gateway}/{anchor id}` per the `returns` entry for that stamp at that gateway's index, and assert `expect`. A case with an empty `gateways` list is called with no gateway list at all, that is the not-checked state and it must be reachable without a fetch seam.",
   "responseKinds": {
     "witnessed": "The exact decoded stamp_bytes. The honest chain.",
     "altered": "JCS of the same stamp body with interval_end changed to 2026-09-09T13:00:00.000Z — a well-formed, canonical, semantically different stamp. This is the forgery shape that matters: a pack built on it is fully self-consistent OFFLINE and lies only about what was witnessed.",
@@ -13,7 +13,7 @@
     "unreachable": "The fetch fails: a network error, a timeout, a non-ok response, or no such transaction. Never a mismatch."
   },
   "alsoAppliesTo": "sanning.stamp.trace/v1 — the same case, with body_type changed and events[] dropped. Every case's `expect` holds UNCHANGED for that body, and a grader MUST run all of them twice. §5.2 and §5.3 carry the same stamps[] array under the same §5.2.2 definition, so they must give the same on-chain answer: a stamp that can be re-fetched inside one wrapper and not the other forces every consumer to know which wrapper it is holding before it can read `onChain: null`, and that is the kind of per-body exception a reader eventually gets wrong. The one case-level difference is outside this rule: a §5.2 body with no stamps at all is `partial` for carrying nothing, which no case here exercises.",
-  "anchorIdPrefix": "stampOnChainFixtureAnchorId0000000000-",
+  "anchorIdPrefix": "stampOnChainFixtureAnchorId00000000000000-",
   "packScaffold": {
     "seedHex": "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef",
     "eventIdPrefix": "ev-",
@@ -30,7 +30,7 @@
   },
   "wrapperScaffold": {
     "spec_version": "sanning.evidence/v1",
-    "body_type": "sanning.stamp.evidence/v1",
+    "body_type": "sanning.stamp.evidence/v2",
     "issuer": { "kind": "sanning" },
     "generated_at": "2026-09-09T12:20:00.000Z",
     "gateway": null,