@typedstandards/verify-core 0.14.0 → 0.15.1

package/CHANGELOG.md

@@ -1,11 +1,92 @@
 # Changelog — @typedstandards/verify-core
 
-Factual record of what changed per published version. Check numbers (#1–#16)
+Factual record of what changed per published version. Check numbers (#1–#17)
 refer to the Typed Standards specification §9.2 verification sequence. Issue
 references are to `npstorey/civic-ai-tools-website` (#119 is the offline-crypto
 hardening arc; #116 is the standalone-verifier arc this package was extracted
 in).
 
+## 0.15.1 — 2026-11-02
+
+The R11 patch (npstorey/civic-ai-tools#293; anchor npstorey/civic-ai-tools#294). **A patch**: no
+export, signature or type changes.
+
+- **Check #8's inclusion verdict requires the log entry to record this record's hash.**
+  `rekorInclusion.inclusionVerified` and `checkpointVerified` are true only when the entry body's
+  `spec.data.hash` is `sha512` with the value `rekorHashForPackage(packageHash)`. That holds for an
+  entry body and proof the input carries (`verifyRecord`) and for an entry `verifyRekorEntry`
+  fetches (its `inclusion`). An entry that does not record the hash, or an empty `packageHash`,
+  reads both false, with the proof's `treeSize` and `leafIndex` and no `reason`.
+  `verifyRekorInclusion` is unchanged: it checks inclusion alone.
+- **Every genuine pairing reads as before.** Over the package objects and the carried log
+  inclusions in this repository's fixtures, and two host-served commitment views, `verifyRecord`
+  gives output deep-equal to 0.15.0's, with the entry carried, fetched, or both.
+- **The `ai-assisted-analysis/civicaitools-v1` row pins revision 2 of its guidance bundle**
+  (2026-11-02), as hub ADR-0038's amendment of 2026-11-02 records:
+  `https://raw.githubusercontent.com/npstorey/civic-ai-tools/v0.1.14-typed-standards-spec/docs/profiles/ai-assisted-analysis/civicaitools-v1/bundle.json`,
+  SHA-256 `45bf3ab479325a791829ed9987f5f291fea44238b54bfb598f32f306f574eb9b`. The row's key and
+  `admits` are unchanged. The local copy (not published) is byte-identical to the hub file at
+  tree `bcd06c5f`; its provenance is in `src/__fixtures__/README.md`.
+
+## 0.15.0 — 2026-10-30
+
+The R10 release (civic-ai-tools#289; hub ADR-0038 §3, §5 and §6, specification v0.1.13 §8.1.1,
+§8.6 and §9.2). **A minor bump**: new exports, a new `VerifyResult` field, and one combination
+check #16 newly reads `ok`.
+
+- **The subtype table (new exports `PRODUCER_PROFILE_SUBTYPES`, `isContentProfileConsistent`, and
+  the types `ProducerProfileSubtypeRow` and `ProducerProfileBundleRef`).** Beside the profile-type
+  table, one frozen row per built subtype of `ai-assisted-analysis`, keyed by the full
+  `producerProfile` value:
+  - `ai-assisted-analysis/datHere` admits `datHere`, with no bundle pinned;
+  - `ai-assisted-analysis/civicaitools-v1` admits `datHere` and `default`, with its guidance
+    bundle pinned by URL
+    (`https://raw.githubusercontent.com/npstorey/civic-ai-tools/v0.1.13-typed-standards-spec/docs/profiles/ai-assisted-analysis/civicaitools-v1/bundle.json`)
+    and SHA-256 (`724e399e02db8993041b64982eec731505084bec2ec5e6ca58fda2de8087a281`), revision 1.
+
+  `isContentProfileConsistent(producerProfile, contentProfile)` is the §8.1.1 invariant over the
+  table: the content profile is one the subtype's row admits; a subtype with no row admits
+  `"datHere"` exactly when it begins with `ai-assisted-analysis/datHere`, and `"default"` exactly
+  when it does not. Only the table's own keys are rows. The row does not change the capture
+  vocabulary: `PROFILE_CAPTURE_VOCAB`, `resolveProfileType` and `captureVocabForProfile` (check #15)
+  are unchanged.
+- **Check #16 reads the predicate.** `checkContentProfile` reports `contentProfile_inconsistent`
+  when `isContentProfileConsistent` is false, in place of the `startsWith` comparison. The no-row
+  clause is that comparison, so every status is unchanged except one: `datHere` under
+  `ai-assisted-analysis/civicaitools-v1` reads `ok` (it read `contentProfile_inconsistent`). No
+  published record carries that combination.
+- **Check #3's implicit rule reads the predicate.** For a package with no
+  `contentCanonicalization`, a `producerProfile` reads as datHere when its subtype admits
+  `"datHere"` and not `"default"`, which is the `startsWith` reading for the `datHere` row and every
+  subtype with no row; under `ai-assisted-analysis/civicaitools-v1` the choice is
+  `metadata.contentProfile`'s. Every result is unchanged.
+- **Check #17, the content-profile system prompt (new exports `checkSystemPrompt`,
+  `SYSTEM_PROMPT_STATUSES`, and the types `SystemPromptStatus` and `SystemPromptCheck`).** When
+  `metadata.contentProfile` is `"datHere"`, `skillMetadata.skillText` as a non-empty string reads
+  `ok` (`form: 'string'`) and as a BlobRef `ok` (`form: 'blobRef'`); absent, empty, or neither
+  reads `skillText_absent`. Any other content profile (absent, `"default"` or unknown) reads
+  `not_applicable`. `skillText_absent` is an attention status and never a failure. The check does
+  not resolve a BlobRef (check #9 does).
+- **`VerifyResult` gains `systemPrompt`** (`SystemPromptCheck | null`, null when the package is
+  absent), set by `verifyRecord` beside `contentProfile`. Every other field of the result is
+  unchanged. A consumer that builds a `VerifyResult` literal needs the new field.
+- **Every earlier fixture reads as before.** Over the signed bundles, signed documents and package
+  objects in this repository's fixtures and the hub harness's `reference-golden.json` and
+  `in-loop-golden.json`, `verifyRecord`, `checkContentProfile`, `resolveContentCanonicalization`
+  and `captureVocabForProfile` give byte-identical output to 0.14.0 once `systemPrompt` is removed.
+  Check #17 reads `skillText_absent` on the five fixture packages that declare `datHere` without
+  `skillText` (the hub reference golden's `v01-dathere-empty-notebook` and
+  `v01-dathere-executed-notebook`, their copies in produce-core's `reference-golden.json`, and the
+  hub's `in-loop-golden.json`), `ok` on the site's `q15-d67b8e` record, and `not_applicable` on
+  every other.
+- **Every lookup of a verify-core table by a value a record or bundle supplies reads only the
+  table's own entries;** a malformed value reads as an unknown one. Every well-formed value reads as
+  before.
+- **A local copy of the bundle**, `src/__fixtures__/civicaitools-v1-guidance-bundle.json` (not
+  published), byte-identical to the hub file at tree `7060f5e3`. A test asserts its SHA-256,
+  `subtype`, `url` and admitted set against the row, without the network. Its provenance is in
+  `src/__fixtures__/README.md`.
+
 ## 0.14.0 — 2026-10-16
 
 The W5 release (civic-ai-tools#260, shipped in #146 and #147). **A minor bump**: new exports

package/dist/checks.d.ts

@@ -22,7 +22,12 @@ export interface ContentCanonicalizationResolution {
  * `unknown_canonicalization_rule` (renders; check #4 then cannot recompute). An
  * absent field on a pre-v0.1 package → `implicit`, inferring the rule from
  * contentProfile / producerProfile (datHere → dathere-ag-jupyter/v1; otherwise
- * legacy-json/v1).
+ * legacy-json/v1). A `producerProfile` reads as datHere when the subtype admits
+ * `"datHere"` and not `"default"` under the §8.1.1 invariant
+ * (`isContentProfileConsistent`): with no row, exactly when it begins with
+ * `ai-assisted-analysis/datHere`, as before; a subtype whose row admits both, as
+ * `ai-assisted-analysis/civicaitools-v1` does, leaves the choice to
+ * `contentProfile`.
  */
 export declare function resolveContentCanonicalization(pkg: Record<string, unknown>): ContentCanonicalizationResolution;
 export declare const CONTENT_HASH_STATUSES: readonly ["ok", "content_hash_mismatch", "contentHash_no_supported_algorithm", "unresolved_rule", "legacy_relabeled", "content_bytes_unavailable"];
@@ -94,14 +99,38 @@ export interface ContentProfileCheck {
  *   - key absent → `contentProfile_absent` (read as `"default"`, spec §8.1.2).
  *   - present and neither `"default"` nor `"datHere"` → `contentProfile_unknown`
  *     (reported, not passed; consistency is not judged).
- *   - present, known, `producerProfile` present, and the ADR-0006 §2 invariant
- *     fails (`contentProfile === "datHere"` iff `producerProfile` starts with
+ *   - present, known, `producerProfile` present, and the §8.1.1 invariant fails
+ *     (ADR-0006 §2 as amended by hub ADR-0038 §3: the content profile is not one
+ *     the subtype's row admits, `isContentProfileConsistent`; a subtype with no
+ *     row admits `"datHere"` exactly when it begins with
  *     `ai-assisted-analysis/datHere`) → `contentProfile_inconsistent`.
  *   - otherwise → `ok`.
  * The invariant is compared only when both fields are present. No status is an
  * integrity failure: both labels are signature-covered.
  */
 export declare function checkContentProfile(pkg: Record<string, unknown>): ContentProfileCheck;
+export declare const SYSTEM_PROMPT_STATUSES: readonly ["ok", "skillText_absent", "not_applicable"];
+export type SystemPromptStatus = (typeof SYSTEM_PROMPT_STATUSES)[number];
+export interface SystemPromptCheck {
+    status: SystemPromptStatus;
+    /** On `ok`, how the text is carried: inline, or a BlobRef (which check #9 resolves). */
+    form?: 'string' | 'blobRef';
+}
+/**
+ * Check #17 — the system prompt §8.7.1 requirement 2 requires of a
+ * `datHere`-content-profile package (hub ADR-0038 §6).
+ *   - `metadata.contentProfile` not `"datHere"` (absent, `"default"` or unknown)
+ *     → `not_applicable`, and nothing else is read.
+ *   - `"datHere"` and `skillMetadata.skillText` a non-empty string → `ok`
+ *     (`form: 'string'`), or a BlobRef → `ok` (`form: 'blobRef'`).
+ *   - `"datHere"` and the key absent, empty, or neither a string nor a BlobRef
+ *     → `skillText_absent`.
+ * `skillText_absent` is an attention status, never a failure: it says nothing
+ * about the envelope, the signature or the notebook. The check does not resolve
+ * a BlobRef (check #9 does), and cannot check that the text is the prompt the
+ * model ran under.
+ */
+export declare function checkSystemPrompt(pkg: Record<string, unknown>): SystemPromptCheck;
 export declare const CONTENT_LAYOUT = "content/layout/v1";
 export declare const KNOWN_TYPE_URIS: readonly string[];
 export declare const TYPE_RESOLUTION_STATUSES: readonly ["ok", "implicit", "unknown_type"];

package/dist/checks.js

@@ -1,5 +1,5 @@
 // Content-canonicalization, content-hash, and typed-standards envelope checks
-// (spec §9.2 checks #3, #4, #6, #12, #13, #14, #15, #16) + the package-level
+// (spec §9.2 checks #3, #4, #6, #12, #13, #14, #15, #16, #17) + the package-level
 // blob-ref walker (#9) — browser-safe.
 //
 // Factored verbatim from the server `verify.ts` (WS2); these functions were
@@ -8,7 +8,7 @@
 // for pre-v0.1 packages that omit the corresponding field.
 import { computeEnvelopeHash, computeContentHashSha256, isMultihashContentHash, KNOWN_CANONICALIZATION_RULES, LEGACY_JSON_CANONICALIZATION, DATHERE_AG_JUPYTER_CANONICALIZATION, RAW_BYTES_CANONICALIZATION, } from "./canonicalization.js";
 import { sha256Hex } from "./primitives.js";
-import { captureVocabForProfile, resolveProfileType } from "./profiles.js";
+import { captureVocabForProfile, isContentProfileConsistent, resolveProfileType } from "./profiles.js";
 import { isBlobRef, parseBlobRef, verifyBlobRef, } from "./blob-ref.js";
 import { isKeyDerivedIdentifier } from "./did-key.js";
 import { compareKeyDerivedIdentifier } from "./self-certifying.js";
@@ -34,7 +34,12 @@ export const CONTENT_CANONICALIZATION_STATUSES = [
  * `unknown_canonicalization_rule` (renders; check #4 then cannot recompute). An
  * absent field on a pre-v0.1 package → `implicit`, inferring the rule from
  * contentProfile / producerProfile (datHere → dathere-ag-jupyter/v1; otherwise
- * legacy-json/v1).
+ * legacy-json/v1). A `producerProfile` reads as datHere when the subtype admits
+ * `"datHere"` and not `"default"` under the §8.1.1 invariant
+ * (`isContentProfileConsistent`): with no row, exactly when it begins with
+ * `ai-assisted-analysis/datHere`, as before; a subtype whose row admits both, as
+ * `ai-assisted-analysis/civicaitools-v1` does, leaves the choice to
+ * `contentProfile`.
  */
 export function resolveContentCanonicalization(pkg) {
     const raw = pkg['contentCanonicalization'];
@@ -54,7 +59,9 @@ export function resolveContentCanonicalization(pkg) {
         ? pkg['producerProfile']
         : undefined;
     const isDatHere = contentProfile === 'datHere' ||
-        (producerProfile?.startsWith('ai-assisted-analysis/datHere') ?? false);
+        (producerProfile !== undefined &&
+            isContentProfileConsistent(producerProfile, 'datHere') &&
+            !isContentProfileConsistent(producerProfile, 'default'));
     return {
         status: 'implicit',
         rule: isDatHere
@@ -197,7 +204,7 @@ export async function verifyContentHashWithFetch(pkg, resolution, legacyExternal
         return first;
     return verifyContentHash(pkg, resolution, legacyExternalHash, bytes);
 }
-// --- Content-profile check (spec §9.2 check #16; hub ADR-0029 §5) ---
+// --- Content-profile check (spec §9.2 check #16; hub ADR-0029 §5, ADR-0038 §3) ---
 /** The known `metadata.contentProfile` values (spec §8.1.2). */
 export const KNOWN_CONTENT_PROFILES = ['default', 'datHere'];
 export const CONTENT_PROFILE_STATUSES = [
@@ -211,8 +218,10 @@ export const CONTENT_PROFILE_STATUSES = [
  *   - key absent → `contentProfile_absent` (read as `"default"`, spec §8.1.2).
  *   - present and neither `"default"` nor `"datHere"` → `contentProfile_unknown`
  *     (reported, not passed; consistency is not judged).
- *   - present, known, `producerProfile` present, and the ADR-0006 §2 invariant
- *     fails (`contentProfile === "datHere"` iff `producerProfile` starts with
+ *   - present, known, `producerProfile` present, and the §8.1.1 invariant fails
+ *     (ADR-0006 §2 as amended by hub ADR-0038 §3: the content profile is not one
+ *     the subtype's row admits, `isContentProfileConsistent`; a subtype with no
+ *     row admits `"datHere"` exactly when it begins with
  *     `ai-assisted-analysis/datHere`) → `contentProfile_inconsistent`.
  *   - otherwise → `ok`.
  * The invariant is compared only when both fields are present. No status is an
@@ -234,15 +243,44 @@ export function checkContentProfile(pkg) {
     if (typeof raw !== 'string' || !KNOWN_CONTENT_PROFILES.includes(raw)) {
         return { status: 'contentProfile_unknown', ...base };
     }
-    if (producerProfile !== undefined) {
-        const isDatHere = raw === 'datHere';
-        const profileIsDatHere = producerProfile.startsWith('ai-assisted-analysis/datHere');
-        if (isDatHere !== profileIsDatHere) {
-            return { status: 'contentProfile_inconsistent', ...base };
-        }
+    if (producerProfile !== undefined && !isContentProfileConsistent(producerProfile, raw)) {
+        return { status: 'contentProfile_inconsistent', ...base };
     }
     return { status: 'ok', ...base };
 }
+// --- Content-profile system prompt (spec §9.2 check #17; hub ADR-0038 §6) ---
+export const SYSTEM_PROMPT_STATUSES = ['ok', 'skillText_absent', 'not_applicable'];
+/**
+ * Check #17 — the system prompt §8.7.1 requirement 2 requires of a
+ * `datHere`-content-profile package (hub ADR-0038 §6).
+ *   - `metadata.contentProfile` not `"datHere"` (absent, `"default"` or unknown)
+ *     → `not_applicable`, and nothing else is read.
+ *   - `"datHere"` and `skillMetadata.skillText` a non-empty string → `ok`
+ *     (`form: 'string'`), or a BlobRef → `ok` (`form: 'blobRef'`).
+ *   - `"datHere"` and the key absent, empty, or neither a string nor a BlobRef
+ *     → `skillText_absent`.
+ * `skillText_absent` is an attention status, never a failure: it says nothing
+ * about the envelope, the signature or the notebook. The check does not resolve
+ * a BlobRef (check #9 does), and cannot check that the text is the prompt the
+ * model ran under.
+ */
+export function checkSystemPrompt(pkg) {
+    const metadata = pkg['metadata'];
+    const contentProfile = typeof metadata === 'object' && metadata !== null && !Array.isArray(metadata)
+        ? metadata['contentProfile']
+        : undefined;
+    if (contentProfile !== 'datHere')
+        return { status: 'not_applicable' };
+    const skillMetadata = pkg['skillMetadata'];
+    const skillText = typeof skillMetadata === 'object' && skillMetadata !== null && !Array.isArray(skillMetadata)
+        ? skillMetadata['skillText']
+        : undefined;
+    if (typeof skillText === 'string' && skillText.length > 0)
+        return { status: 'ok', form: 'string' };
+    if (isBlobRef(skillText))
+        return { status: 'ok', form: 'blobRef' };
+    return { status: 'skillText_absent' };
+}
 // --- Typed-standards envelope checks (spec §9.2 checks #12, #14, #15) ---
 // The `content/layout/v1` sub-type (spec §8.14, hub ADR-0034): a standalone
 // assertion of how a host's page arranges a node's parts. Registered for check

package/dist/lifecycle.js

@@ -319,7 +319,8 @@ function isAbsent(v) {
 }
 /** Each payload field §8.12.1 requires of `type` that `node` lacks, by name. */
 function missingRequiredFields(node, type) {
-    return (ATTESTATION_REQUIRED_FIELDS[type] ?? []).filter((f) => isAbsent(node[f]));
+    const required = Object.hasOwn(ATTESTATION_REQUIRED_FIELDS, type) ? ATTESTATION_REQUIRED_FIELDS[type] : [];
+    return required.filter((f) => isAbsent(node[f]));
 }
 /**
  * Check one `attestation/*` node on its own (spec §8.12.3), for `withdraws`,
@@ -343,7 +344,7 @@ function missingRequiredFields(node, type) {
 export function checkAttestationNode(carried, context = {}) {
     const node = carried.node;
     const type = pickString(node['type']) ?? '';
-    const rule = ATTESTATION_AUTHORIZATION_RULES[type] ?? null;
+    const rule = Object.hasOwn(ATTESTATION_AUTHORIZATION_RULES, type) ? ATTESTATION_AUTHORIZATION_RULES[type] : null;
     const verdict = verifyAttestationNode(node, carried.nodeId, carried.signature ?? null);
     const missingFields = missingRequiredFields(node, type);
     const publicKey = carried.signature?.publicKey ?? '';

package/dist/profiles.d.ts

@@ -18,3 +18,32 @@ export declare function resolveProfileType(producerProfile?: string | null, cont
  * `producerProfile_bundle_unresolved` degraded case).
  */
 export declare function captureVocabForProfile(producerProfile?: string | null, contentProfile?: string | null): readonly CaptureMethod[] | undefined;
+/** A guidance bundle pinned by its address and the SHA-256 of its bytes. */
+export interface ProducerProfileBundleRef {
+    readonly url: string;
+    /** Lowercase hex SHA-256 of the bundle file's bytes. */
+    readonly sha256: string;
+}
+/** One built subtype's row. */
+export interface ProducerProfileSubtypeRow {
+    /** The `metadata.contentProfile` values the subtype admits. */
+    readonly admits: readonly string[];
+    /** The subtype's guidance bundle, when one is pinned. */
+    readonly bundle?: ProducerProfileBundleRef;
+}
+/**
+ * The subtype table, keyed by the full `producerProfile` value. The
+ * `ai-assisted-analysis/civicaitools-v1` bundle is revision 2 (2026-11-02), as
+ * hub ADR-0038's amendment of 2026-11-02 records its address and digest; a later
+ * revision moves the digest and this pin, and nothing else.
+ */
+export declare const PRODUCER_PROFILE_SUBTYPES: Readonly<Record<string, ProducerProfileSubtypeRow>>;
+/**
+ * The §8.1.1 consistency invariant, for a package that carries both
+ * `producerProfile` and `metadata.contentProfile`: whether the content profile is
+ * one the subtype's row admits. A subtype with no row admits `"datHere"` exactly
+ * when it begins with `ai-assisted-analysis/datHere`, and `"default"` exactly when
+ * it does not: the reading every earlier release applied, so a record whose
+ * subtype has no row reads as before. Check #16 reads it.
+ */
+export declare function isContentProfileConsistent(producerProfile: string, contentProfile: string): boolean;

package/dist/profiles.js

@@ -40,5 +40,38 @@ export function resolveProfileType(producerProfile, contentProfile) {
  * `producerProfile_bundle_unresolved` degraded case).
  */
 export function captureVocabForProfile(producerProfile, contentProfile) {
-    return PROFILE_CAPTURE_VOCAB[resolveProfileType(producerProfile, contentProfile)];
+    const profileType = resolveProfileType(producerProfile, contentProfile);
+    return Object.hasOwn(PROFILE_CAPTURE_VOCAB, profileType) ? PROFILE_CAPTURE_VOCAB[profileType] : undefined;
+}
+/**
+ * The subtype table, keyed by the full `producerProfile` value. The
+ * `ai-assisted-analysis/civicaitools-v1` bundle is revision 2 (2026-11-02), as
+ * hub ADR-0038's amendment of 2026-11-02 records its address and digest; a later
+ * revision moves the digest and this pin, and nothing else.
+ */
+export const PRODUCER_PROFILE_SUBTYPES = Object.freeze({
+    // No bundle pinned: the integration partner's, not this table's to name.
+    'ai-assisted-analysis/datHere': Object.freeze({ admits: Object.freeze(['datHere']) }),
+    'ai-assisted-analysis/civicaitools-v1': Object.freeze({
+        admits: Object.freeze(['datHere', 'default']),
+        bundle: Object.freeze({
+            url: 'https://raw.githubusercontent.com/npstorey/civic-ai-tools/v0.1.14-typed-standards-spec/docs/profiles/ai-assisted-analysis/civicaitools-v1/bundle.json',
+            sha256: '45bf3ab479325a791829ed9987f5f291fea44238b54bfb598f32f306f574eb9b',
+        }),
+    }),
+});
+const DATHERE_PREFIX = 'ai-assisted-analysis/datHere';
+/**
+ * The §8.1.1 consistency invariant, for a package that carries both
+ * `producerProfile` and `metadata.contentProfile`: whether the content profile is
+ * one the subtype's row admits. A subtype with no row admits `"datHere"` exactly
+ * when it begins with `ai-assisted-analysis/datHere`, and `"default"` exactly when
+ * it does not: the reading every earlier release applied, so a record whose
+ * subtype has no row reads as before. Check #16 reads it.
+ */
+export function isContentProfileConsistent(producerProfile, contentProfile) {
+    if (Object.hasOwn(PRODUCER_PROFILE_SUBTYPES, producerProfile)) {
+        return PRODUCER_PROFILE_SUBTYPES[producerProfile].admits.includes(contentProfile);
+    }
+    return producerProfile.startsWith(DATHERE_PREFIX) ? contentProfile === 'datHere' : contentProfile === 'default';
 }

package/dist/rekor-binding.d.ts

@@ -0,0 +1,12 @@
+import { type RekorInclusionProof, type RekorInclusionResult } from './rekor-inclusion.ts';
+/** Whether a log entry body records `packageHash`: `spec.data.hash` is `sha512`
+ *  with the value `rekorHashForPackage(packageHash)`. An empty hash, or a body that
+ *  does not decode, records nothing. */
+export declare function entryRecordsPackage(entryBody: string | Uint8Array, packageHash: string): boolean;
+/**
+ * Check 8's inclusion verdict for a record. An entry that does not record
+ * `packageHash` reads `inclusionVerified: false` and `checkpointVerified: false`,
+ * with the proof's `treeSize` and `leafIndex` and no `reason` (the proof is not
+ * evaluated). Otherwise the verdict is `verifyRekorInclusion`'s.
+ */
+export declare function verifyRekorInclusionForRecord(entryBody: string | Uint8Array, inclusionProof: RekorInclusionProof, packageHash: string): RekorInclusionResult;

package/dist/rekor-binding.js

@@ -0,0 +1,48 @@
+// Check 8's inclusion verdict, bound to the record (spec §9.2 check #8) —
+// browser-safe, offline.
+//
+// `verifyRekorInclusion` says whether a log entry is in a log the pinned key
+// vouches for. A verdict about a record also needs the entry to be that record's:
+// its body's `spec.data.hash` is `sha512` with the value
+// `rekorHashForPackage(packageHash)`, the comparison `verifyRekorEntry` makes for
+// hash parity. Both sources of a verdict read it here: the entry body and proof an
+// input carries (`verifyRecord`) and an entry `verifyRekorEntry` fetches.
+//
+// Internal: `index.ts` does not re-export this module.
+import { base64ToBytes } from "./primitives.js";
+import { rekorHashForPackage } from "./signature.js";
+import { verifyRekorInclusion, } from "./rekor-inclusion.js";
+/** Whether a log entry body records `packageHash`: `spec.data.hash` is `sha512`
+ *  with the value `rekorHashForPackage(packageHash)`. An empty hash, or a body that
+ *  does not decode, records nothing. */
+export function entryRecordsPackage(entryBody, packageHash) {
+    if (!packageHash)
+        return false;
+    try {
+        const bytes = typeof entryBody === 'string' ? base64ToBytes(entryBody) : entryBody;
+        const body = JSON.parse(new TextDecoder().decode(bytes));
+        const hash = body
+            ?.spec?.data?.hash;
+        return hash?.algorithm === 'sha512' && hash.value === rekorHashForPackage(packageHash);
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Check 8's inclusion verdict for a record. An entry that does not record
+ * `packageHash` reads `inclusionVerified: false` and `checkpointVerified: false`,
+ * with the proof's `treeSize` and `leafIndex` and no `reason` (the proof is not
+ * evaluated). Otherwise the verdict is `verifyRekorInclusion`'s.
+ */
+export function verifyRekorInclusionForRecord(entryBody, inclusionProof, packageHash) {
+    if (!entryRecordsPackage(entryBody, packageHash)) {
+        return {
+            inclusionVerified: false,
+            checkpointVerified: false,
+            treeSize: inclusionProof.treeSize,
+            leafIndex: inclusionProof.logIndex,
+        };
+    }
+    return verifyRekorInclusion(entryBody, inclusionProof);
+}

package/dist/rekor-inclusion.d.ts

@@ -53,7 +53,9 @@ export interface RekorInclusionResult {
     origin?: string;
     /** The matched anchor's key hint (hex), for display / provenance. */
     keyHint?: string;
-    /** The first thing that failed, when not fully verified. */
+    /** The first thing that failed, when not fully verified. Absent when
+     *  `verifyRecord` or `verifyRekorEntry` found that the entry does not record the
+     *  package's hash: the proof is then not evaluated. */
     reason?: RekorInclusionFailReason;
 }
 /**
@@ -103,7 +105,9 @@ export declare function verifyCheckpointSignature(checkpoint: ParsedCheckpoint,
  * is the carried `verification.inclusionProof`. Returns a graded verdict:
  * `inclusionVerified` (the proof folds to its root) and `checkpointVerified` (that
  * root is in a checkpoint a pinned log key signed). The strong property — "this
- * entry is in a log the sigstore key vouches for" — is both being true.
+ * entry is in a log the sigstore key vouches for" — is both being true. This
+ * export checks inclusion alone; `verifyRecord` (`verifyEvidence`) applies the
+ * record binding.
  */
 export declare function verifyRekorInclusion(entryBody: string | Uint8Array, inclusionProof: RekorInclusionProof, anchors?: readonly RekorLogAnchor[]): RekorInclusionResult;
 export {};

package/dist/rekor-inclusion.js

@@ -239,7 +239,9 @@ export function verifyCheckpointSignature(checkpoint, anchors) {
  * is the carried `verification.inclusionProof`. Returns a graded verdict:
  * `inclusionVerified` (the proof folds to its root) and `checkpointVerified` (that
  * root is in a checkpoint a pinned log key signed). The strong property — "this
- * entry is in a log the sigstore key vouches for" — is both being true.
+ * entry is in a log the sigstore key vouches for" — is both being true. This
+ * export checks inclusion alone; `verifyRecord` (`verifyEvidence`) applies the
+ * record binding.
  */
 export function verifyRekorInclusion(entryBody, inclusionProof, anchors = REKOR_LOG_ANCHORS) {
     const base = {

package/dist/rekor.d.ts

@@ -7,7 +7,8 @@ export interface RekorVerifyResult {
     integratedTime?: number;
     logEntryUrl?: string;
     /** Cryptographic Merkle-inclusion verdict (#119), when the fetched entry carries
-     *  an inclusion proof. Additive — `verified` (hash-parity) is unchanged. */
+     *  an inclusion proof; not verified when the entry does not record this package's
+     *  hash. Additive — `verified` (hash-parity) is unchanged. */
     inclusion?: RekorInclusionResult;
 }
 /**

package/dist/rekor.js

@@ -9,7 +9,7 @@
 // instead of `Buffer`, and the network fetch is injected.
 import { rekorHashForPackage } from "./signature.js";
 import { base64ToBytes } from "./primitives.js";
-import { verifyRekorInclusion, } from "./rekor-inclusion.js";
+import { verifyRekorInclusionForRecord } from "./rekor-binding.js";
 /**
  * Verify that a Rekor transparency log entry is consistent with a published
  * package.
@@ -31,7 +31,7 @@ export async function verifyRekorEntry(entryId, packageHash, options = {}) {
             return { verified: false };
         }
         const result = (await response.json());
-        const entry = result[entryId] || Object.values(result)[0];
+        const entry = (Object.hasOwn(result, entryId) ? result[entryId] : undefined) || Object.values(result)[0];
         if (!entry)
             return { verified: false };
         // Decode the base64 body and cross-check both hash algorithm and value.
@@ -43,9 +43,11 @@ export async function verifyRekorEntry(entryId, packageHash, options = {}) {
         const verified = recordedAlgo === 'sha512' && recordedHash === expectedHash;
         // Deepen #8 (civic-ai-tools-website#119): when the entry carries an inclusion
         // proof, cryptographically verify Merkle inclusion against the pinned log key —
-        // the same offline check a carried bundle runs, here over the fetched entry.
+        // the same offline check a carried bundle runs, here over the fetched entry, and
+        // bound to this record: an entry that does not record `packageHash` is not
+        // verified (`rekor-binding.ts`).
         const proof = entry.verification?.inclusionProof;
-        const inclusion = proof && entry.body ? verifyRekorInclusion(entry.body, proof) : undefined;
+        const inclusion = proof && entry.body ? verifyRekorInclusionForRecord(entry.body, proof, packageHash) : undefined;
         return {
             verified,
             logIndex: entry.logIndex,

package/dist/verify.d.ts

@@ -1,7 +1,7 @@
 import { type RekorInclusionProof, type RekorInclusionResult } from './rekor-inclusion.ts';
 import { type Rfc3161VerifyResult } from './rfc3161.ts';
 import { type KeyTrustResult, type TrustRegistry, type TrustRegistryProvenance } from './trust-registry.ts';
-import { type ContentCanonicalizationResolution, type ContentHashCheck, type TypeResolution, type SignerIdentityCheck, type SigningKeyIdConsistencyCheck, type CaptureMethodVocabCheck, type ContentProfileCheck, type BlobRefVerification } from './checks.ts';
+import { type ContentCanonicalizationResolution, type ContentHashCheck, type TypeResolution, type SignerIdentityCheck, type SigningKeyIdConsistencyCheck, type CaptureMethodVocabCheck, type ContentProfileCheck, type SystemPromptCheck, type BlobRefVerification } from './checks.ts';
 import { type LifecycleResolution } from './lifecycle.ts';
 import type { FetchLike } from './types.ts';
 /** The parsed signature envelope (`buildCommitmentView`'s `signature`). */
@@ -140,7 +140,8 @@ export interface VerifyResult {
     } | null;
     rekorIntegratedTime?: number;
     /** Cryptographic Merkle-inclusion verdict (#119): null when no proof was
-     *  available, else the graded result (`inclusionVerified` / `checkpointVerified`).
+     *  available, else the graded result (`inclusionVerified` / `checkpointVerified`),
+     *  both false when the log entry does not record `packageHash`.
      *  Additive to `rekorVerified` (hash-parity). */
     rekorInclusion: RekorInclusionResult | null;
     hasRekor: boolean;
@@ -163,6 +164,9 @@ export interface VerifyResult {
     captureMethodVocab: CaptureMethodVocabCheck | null;
     /** Check #16 — `metadata.contentProfile` (hub ADR-0029 §5). */
     contentProfile: ContentProfileCheck | null;
+    /** Check #17 — whether a `datHere`-content-profile package carries
+     *  `skillMetadata.skillText` (hub ADR-0038 §6). Null when the package is absent. */
+    systemPrompt: SystemPromptCheck | null;
     lifecycle: LifecycleResolution;
 }
 /**

package/dist/verify.js

@@ -31,11 +31,11 @@
 import { recomputePackageHash } from "./checks.js";
 import { verifySignature } from "./signature.js";
 import { verifyRekorEntry } from "./rekor.js";
-import { verifyRekorInclusion, } from "./rekor-inclusion.js";
+import { verifyRekorInclusionForRecord } from "./rekor-binding.js";
 import { verifyRfc3161Timestamp } from "./rfc3161.js";
 import { verifyKeyTrust, legacyEmbeddedKeyTrust, } from "./trust-registry.js";
 import { applyKeyDerivedRegistryRule, applySelfCertifiedKeyTrust, compareKeyDerivedIdentifier, } from "./self-certifying.js";
-import { resolveContentCanonicalization, verifyContentHashWithFetch, resolvePackageType, checkSignerIdentity, checkSigningKeyIdConsistency, checkCaptureMethodVocab, checkContentProfile, verifyPackageBlobRefs, } from "./checks.js";
+import { resolveContentCanonicalization, verifyContentHashWithFetch, resolvePackageType, checkSignerIdentity, checkSigningKeyIdConsistency, checkCaptureMethodVocab, checkContentProfile, checkSystemPrompt, verifyPackageBlobRefs, } from "./checks.js";
 import { resolveLifecycleFromLegacyColumns, } from "./lifecycle.js";
 /**
  * A fetcher that sends at most one request per URL and replays that request's
@@ -128,6 +128,7 @@ export async function verifyRecord(input, deps) {
     // Merkle inclusion (#119) is verified cryptographically. The carried proof + body
     // verify inclusion OFFLINE (no fetch); otherwise the online fetch's entry carries
     // the proof. Carried-offline takes precedence — it is the zero-dependency property.
+    // Either way the entry must record this record's hash (`rekor-binding.ts`).
     let rekorVerified = null;
     let rekorDetails = null;
     let rekorIntegratedTime;
@@ -146,7 +147,7 @@ export async function verifyRecord(input, deps) {
             rekorInclusion = rekorResult.inclusion;
     }
     if (input.rekorInclusionProof && input.rekorEntryBody) {
-        rekorInclusion = verifyRekorInclusion(input.rekorEntryBody, input.rekorInclusionProof);
+        rekorInclusion = verifyRekorInclusionForRecord(input.rekorEntryBody, input.rekorInclusionProof, packageHash);
     }
     // Step 3c — RFC 3161 timestamp (check #7, deep). Presence is `hasTimestamp`; when a
     // token + package hash are present, cryptographically verify the TSA signature over
@@ -204,7 +205,7 @@ export async function verifyRecord(input, deps) {
             : applyKeyDerivedRegistryRule(keyTrust, deps.registryProvenance);
     }
     // Step 5 — canonicalization, content-hash, and envelope checks
-    // (#3/#4/#6/#12/#14/#15/#16). #4 fetches only for a raw-bytes/v1 BlobRef output.
+    // (#3/#4/#6/#12/#14/#15/#16/#17). #4 fetches only for a raw-bytes/v1 BlobRef output.
     let contentCanonicalization = null;
     let contentHashCheck = null;
     let typeResolution = null;
@@ -212,6 +213,7 @@ export async function verifyRecord(input, deps) {
     let signingKeyIdConsistency = null;
     let captureMethodVocab = null;
     let contentProfile = null;
+    let systemPrompt = null;
     if (pkg) {
         contentCanonicalization = resolveContentCanonicalization(pkg);
         contentHashCheck = await verifyContentHashWithFetch(pkg, contentCanonicalization, input.legacyExternalHash ?? packageHash, { fetch: blobFetch });
@@ -222,6 +224,7 @@ export async function verifyRecord(input, deps) {
         }
         captureMethodVocab = checkCaptureMethodVocab(pkg);
         contentProfile = checkContentProfile(pkg);
+        systemPrompt = checkSystemPrompt(pkg);
     }
     // Step 6 — lifecycle (check #10). Server-deeper resolution wins when supplied;
     // otherwise derive STATE from the sidecar's lifecycle (the portable depth).
@@ -257,6 +260,7 @@ export async function verifyRecord(input, deps) {
         signingKeyIdConsistency,
         captureMethodVocab,
         contentProfile,
+        systemPrompt,
         lifecycle,
     };
 }

package/dist/x509.js

@@ -162,7 +162,7 @@ function isImplementedCertSignatureAlgorithm(oid) {
  * apart before it calls this.
  */
 export async function verifyCertSignatureRsa(cert, issuerSpkiDer) {
-    const hash = RSA_SIG_HASH[cert.sigAlgOid];
+    const hash = isImplementedCertSignatureAlgorithm(cert.sigAlgOid) ? RSA_SIG_HASH[cert.sigAlgOid] : undefined;
     if (!hash)
         return false;
     try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@typedstandards/verify-core",
-  "version": "0.14.0",
+  "version": "0.15.1",
   "description": "Portable, browser-safe verification core for Typed Standards record packages — the §9.2 check suite, single-sourced so it verifies identically on a server and in the browser.",
   "license": "MIT",
   "author": "Nathan Storey",
@@ -31,12 +31,12 @@
     "prepublishOnly": "npm run clean && npm run build"
   },
   "dependencies": {
-    "@noble/curves": "^2.2.0",
+    "@noble/curves": "^2.4.0",
     "@noble/hashes": "^2.2.0",
-    "canonicalize": "^3.0.0"
+    "canonicalize": "^5.1.0"
   },
   "devDependencies": {
-    "@types/node": "^20",
+    "@types/node": "^22",
     "typescript": "^5.9.3"
   },
   "engines": {