@typedstandards/verify-core 0.9.0 → 0.10.0

package/CHANGELOG.md

@@ -1,11 +1,60 @@
 # Changelog — @typedstandards/verify-core
 
-Factual record of what changed per published version. Check numbers (#1–#15)
+Factual record of what changed per published version. Check numbers (#1–#16)
 refer to the Typed Standards specification §9.2 verification sequence. Issue
 references are to `npstorey/civic-ai-tools-website` (#119 is the offline-crypto
 hardening arc; #116 is the standalone-verifier arc this package was extracted
 in).
 
+## 0.10.0 — 2026-09-22
+
+Specification v0.1.9 (hub ADR-0029 and ADR-0030, anchored at `typedstandards#77`): a Producer Profile
+for deterministic tool output, a raw-bytes content rule, a content-profile check, and a self-certifying
+signer. **A minor bump** — new exports, and every type-level union below gains members, so a consumer
+with an exhaustive `switch` or `Record` over one of them needs the new cases.
+
+- **The `scripted-recomputation` Producer Profile (ADR-0029).** `PROFILE_CAPTURE_VOCAB` gains
+  `scripted-recomputation: ['script-run', 'tool-emitted']`, a second stand-in entry under hub Q32, and
+  `CaptureMethod` gains both values. Check #15 now resolves a `scripted-recomputation/<subtype>`
+  package's capture method instead of reporting `producerProfile_bundle_unresolved`. The two signed
+  ADR-0028 eval-run packages read `ok`.
+- **`raw-bytes/v1` (`RAW_BYTES_CANONICALIZATION`).** A third content-canonicalization rule, in
+  `KNOWN_CANONICALIZATION_RULES`: `contentHash` fingerprints the exact bytes of `output`.
+  - With inline `output`, check #4 hashes its UTF-8 bytes.
+  - With a BlobRef `output`, check #4 hashes the file's bytes obtained through the injected fetcher
+    (`verifyContentHashWithFetch`; `verifyRecord` runs it):
+    - `content_hash_mismatch` when they differ, or when `contentHash.sha256` differs from the hex of
+      `output.ref`;
+    - the new status `content_bytes_unavailable` when the bytes cannot be obtained. It is never `ok`
+      without hashing.
+  - `verifyContentHash` stays synchronous and I/O-free, with an optional `outputBytes` argument.
+- **Check #16, the content-profile label (`checkContentProfile`, `CONTENT_PROFILE_STATUSES`,
+  `KNOWN_CONTENT_PROFILES`).** Reads `metadata.contentProfile` and reports one of:
+  - `ok`;
+  - `contentProfile_absent` (read as `"default"`);
+  - `contentProfile_unknown`;
+  - `contentProfile_inconsistent` (compared with `producerProfile` only when both are present).
+
+  `VerifyResult` gains `contentProfile`.
+- **The self-certifying signer (ADR-0030).**
+  - **The identifier.** `deriveKeyDerivedIdentifier` derives `did:key:z…` from an Ed25519 SPKI
+    `publicKey`. `isKeyDerivedIdentifier` and `KEY_DERIVED_IDENTIFIER_PREFIX` recognize one.
+  - **Key trust.** `KEY_TRUST_STATUSES` gains `self_certified` (`verified: false`) for a
+    `pseudonymous` signer whose identifier matches its signing key.
+  - **Check #14.** It gains `key_derived_match` and `key_derived_mismatch` (fatal; the result carries
+    `claimed` and `derived`), and never reports `ok` under a key-derived identifier.
+    `checkSignerIdentity` takes an optional `publicKey`.
+  - **Registry provenance.** `VerifyDeps.registryProvenance` (`TRUST_REGISTRY_PROVENANCES`:
+    `'declared-url' | 'bundle'`; absent is treated as `'bundle'`) states where the caller's registry
+    came from.
+    - For a key-derived identifier, only a `'declared-url'` registry can raise the status.
+    - A bundle-carried registry contributes only `revoked` and `deprecated_invalid`.
+    - This holds at every tier, and under a mismatch too.
+  - **Base-58.** The encoder is written in place; there is no new runtime dependency.
+- **Signers whose identifier is not key-derived are unchanged.** Already-signed packages verify
+  exactly as before, apart from checks #15 and #16, which now resolve a `scripted-recomputation`
+  profile and report a content profile.
+
 ## 0.9.0 — 2026-08-19
 
 Vocabulary settlement (spec v0.1.5 Appendix J; registry Q50/Q66, ADR-0025,

package/dist/canonicalization.d.ts

@@ -1,5 +1,8 @@
 export declare const LEGACY_JSON_CANONICALIZATION = "https://typedstandards.org/canonicalization/legacy-json/v1";
 export declare const DATHERE_AG_JUPYTER_CANONICALIZATION = "https://typedstandards.org/canonicalization/dathere-ag-jupyter/v1";
+/** hub ADR-0029 §4: the SHA-256 of the bytes of the package's `output`, with no
+ *  normalization — the digest `sha256sum` prints for the file. */
+export declare const RAW_BYTES_CANONICALIZATION = "https://typedstandards.org/canonicalization/raw-bytes/v1";
 /** Canonicalization-rule URIs this implementation knows how to apply. An
  *  unknown URI fails verify check #3 (`unknown_canonicalization_rule`). */
 export declare const KNOWN_CANONICALIZATION_RULES: readonly string[];
@@ -43,5 +46,9 @@ export declare function computeEnvelopeHash(pkg: Record<string, unknown>): strin
  *     (and the sig envelope, which lives off-package here) omitted.
  *   - dathere-ag-jupyter/v1 → the executed notebook object
  *     (`extensions["org.civicaitools.notebook"]` and its rendered outputs).
+ *   - raw-bytes/v1          → the UTF-8 bytes of an inline string `output`.
+ *     An `output` that is not a string (a BlobRef, whose bytes live outside the
+ *     package) throws here: those bytes have to be obtained first, which is what
+ *     check #4's fetching path (`verifyContentHashWithFetch`) does.
  */
 export declare function computeContentHashSha256(pkg: Record<string, unknown>, rule: string): string;

package/dist/canonicalization.js

@@ -17,11 +17,15 @@ import { sha256Hex } from "./primitives.js";
 // targets — verifiers resolve them via the local registry below.
 export const LEGACY_JSON_CANONICALIZATION = 'https://typedstandards.org/canonicalization/legacy-json/v1';
 export const DATHERE_AG_JUPYTER_CANONICALIZATION = 'https://typedstandards.org/canonicalization/dathere-ag-jupyter/v1';
+/** hub ADR-0029 §4: the SHA-256 of the bytes of the package's `output`, with no
+ *  normalization — the digest `sha256sum` prints for the file. */
+export const RAW_BYTES_CANONICALIZATION = 'https://typedstandards.org/canonicalization/raw-bytes/v1';
 /** Canonicalization-rule URIs this implementation knows how to apply. An
  *  unknown URI fails verify check #3 (`unknown_canonicalization_rule`). */
 export const KNOWN_CANONICALIZATION_RULES = [
     LEGACY_JSON_CANONICALIZATION,
     DATHERE_AG_JUPYTER_CANONICALIZATION,
+    RAW_BYTES_CANONICALIZATION,
 ];
 /** Notebook extension whose object the dathere-ag-jupyter/v1 rule fingerprints
  *  (spec §8.2, §8.7.2). */
@@ -83,8 +87,19 @@ export function computeEnvelopeHash(pkg) {
  *     (and the sig envelope, which lives off-package here) omitted.
  *   - dathere-ag-jupyter/v1 → the executed notebook object
  *     (`extensions["org.civicaitools.notebook"]` and its rendered outputs).
+ *   - raw-bytes/v1          → the UTF-8 bytes of an inline string `output`.
+ *     An `output` that is not a string (a BlobRef, whose bytes live outside the
+ *     package) throws here: those bytes have to be obtained first, which is what
+ *     check #4's fetching path (`verifyContentHashWithFetch`) does.
  */
 export function computeContentHashSha256(pkg, rule) {
+    if (rule === RAW_BYTES_CANONICALIZATION) {
+        const output = pkg['output'];
+        if (typeof output !== 'string') {
+            throw new Error('raw-bytes/v1 content hash over a package alone requires an inline string output');
+        }
+        return sha256Hex(output);
+    }
     if (rule === DATHERE_AG_JUPYTER_CANONICALIZATION) {
         const extensions = pkg['extensions'];
         const notebook = extensions?.[NOTEBOOK_EXTENSION_KEY];

package/dist/checks.d.ts

@@ -25,7 +25,7 @@ export interface ContentCanonicalizationResolution {
  * legacy-json/v1).
  */
 export declare function resolveContentCanonicalization(pkg: Record<string, unknown>): ContentCanonicalizationResolution;
-export declare const CONTENT_HASH_STATUSES: readonly ["ok", "content_hash_mismatch", "contentHash_no_supported_algorithm", "unresolved_rule", "legacy_relabeled"];
+export declare const CONTENT_HASH_STATUSES: readonly ["ok", "content_hash_mismatch", "contentHash_no_supported_algorithm", "unresolved_rule", "legacy_relabeled", "content_bytes_unavailable"];
 export type ContentHashStatus = (typeof CONTENT_HASH_STATUSES)[number];
 export interface ContentHashCheck {
     status: ContentHashStatus;
@@ -55,8 +55,53 @@ export interface ContentHashCheck {
  * single-SHA-256 is RELABELED as `{ sha256: <hex> }` per §8.2 rather than
  * recomputed; its integrity is established by check #1, so check #4 reports
  * `legacy_relabeled`.
+ *
+ * raw-bytes/v1 with a BlobRef `output` (hub ADR-0029 §4): the fingerprinted
+ * bytes live outside the package. `outputBytes` are those bytes when the caller
+ * holds them.
+ *   - `contentHash.sha256` differs from the hex of `output.ref` →
+ *     `content_hash_mismatch`, decided from the package alone.
+ *   - no `outputBytes` → `content_bytes_unavailable`: the bytes were not
+ *     checked. Never `ok` without hashing.
+ *   - otherwise the SHA-256 of `outputBytes` is compared with
+ *     `contentHash.sha256` → `ok` / `content_hash_mismatch`.
+ * This function does no I/O; `verifyContentHashWithFetch` obtains the bytes
+ * through the injected fetcher and passes them here.
+ */
+export declare function verifyContentHash(pkg: Record<string, unknown>, resolution: ContentCanonicalizationResolution, legacyExternalHash?: string, outputBytes?: Uint8Array): ContentHashCheck;
+/**
+ * Check #4 with the raw-bytes/v1 BlobRef path wired to the injected fetcher
+ * (hub ADR-0029 §4). Identical to `verifyContentHash` for every other rule and
+ * shape. For a raw-bytes/v1 package whose `output` is a BlobRef, it obtains the
+ * file's bytes through `options.fetch` (an offline verifier supplies a local
+ * copy through that fetcher) and hashes them; bytes it cannot obtain leave the
+ * status at `content_bytes_unavailable`.
  */
-export declare function verifyContentHash(pkg: Record<string, unknown>, resolution: ContentCanonicalizationResolution, legacyExternalHash?: string): ContentHashCheck;
+export declare function verifyContentHashWithFetch(pkg: Record<string, unknown>, resolution: ContentCanonicalizationResolution, legacyExternalHash?: string, options?: BlobFetchOptions): Promise<ContentHashCheck>;
+/** The known `metadata.contentProfile` values (spec §8.1.2). */
+export declare const KNOWN_CONTENT_PROFILES: readonly string[];
+export declare const CONTENT_PROFILE_STATUSES: readonly ["ok", "contentProfile_absent", "contentProfile_unknown", "contentProfile_inconsistent"];
+export type ContentProfileStatus = (typeof CONTENT_PROFILE_STATUSES)[number];
+export interface ContentProfileCheck {
+    status: ContentProfileStatus;
+    /** `metadata.contentProfile` as carried, when it is a string. */
+    contentProfile?: string;
+    /** `producerProfile` as carried, when present. */
+    producerProfile?: string;
+}
+/**
+ * Check #16 — `metadata.contentProfile` (hub ADR-0029 §5).
+ *   - key absent → `contentProfile_absent` (read as `"default"`, spec §8.1.2).
+ *   - present and neither `"default"` nor `"datHere"` → `contentProfile_unknown`
+ *     (reported, not passed; consistency is not judged).
+ *   - present, known, `producerProfile` present, and the ADR-0006 §2 invariant
+ *     fails (`contentProfile === "datHere"` iff `producerProfile` starts with
+ *     `ai-assisted-analysis/datHere`) → `contentProfile_inconsistent`.
+ *   - otherwise → `ok`.
+ * The invariant is compared only when both fields are present. No status is an
+ * integrity failure: both labels are signature-covered.
+ */
+export declare function checkContentProfile(pkg: Record<string, unknown>): ContentProfileCheck;
 export declare const TYPE_RESOLUTION_STATUSES: readonly ["ok", "implicit", "unknown_type"];
 export type TypeResolutionStatus = (typeof TYPE_RESOLUTION_STATUSES)[number];
 export interface TypeResolution {
@@ -70,7 +115,7 @@ export interface TypeResolution {
  * and renders as such — it does NOT fail verification.
  */
 export declare function resolvePackageType(pkg: Record<string, unknown>): TypeResolution;
-export declare const SIGNER_IDENTITY_CHECK_STATUSES: readonly ["ok", "signer_identity_mismatch", "no_signer", "no_registry_identity"];
+export declare const SIGNER_IDENTITY_CHECK_STATUSES: readonly ["ok", "signer_identity_mismatch", "no_signer", "no_registry_identity", "key_derived_match", "key_derived_mismatch"];
 export type SignerIdentityCheckStatus = (typeof SIGNER_IDENTITY_CHECK_STATUSES)[number];
 export interface SignerIdentityCheck {
     status: SignerIdentityCheckStatus;
@@ -78,6 +123,10 @@ export interface SignerIdentityCheck {
     claimed?: string;
     /** The identifier the registry records for the signing `kid`, when present. */
     registered?: string;
+    /** The identifier derived from the envelope's `publicKey`, under a
+     *  key-derived `signer.identifier` (hub ADR-0030 §2). Absent on a
+     *  `key_derived_mismatch` whose key could not be decoded. */
+    derived?: string;
 }
 /**
  * Check #14 — `signer.identifier` ↔ trust-registry `signerIdentity` cross-check
@@ -86,8 +135,25 @@ export interface SignerIdentityCheck {
  * verifier derives the signer from the registry and skips the cross-check. A
  * registry entry without a `signerIdentity` (legacy registry) yields
  * `no_registry_identity`.
+ *
+ * A key-derived `signer.identifier` (one beginning `did:key:`, hub ADR-0030 §3)
+ * is checked against the envelope's `publicKey` instead, whatever the
+ * `bindingTier` and whatever the registry's source:
+ *   - the identifier derived from `publicKey` differs → `key_derived_mismatch`,
+ *     fatal, carrying `claimed` and `derived`;
+ *   - it matches, and a registry entry for the `kid` records a different
+ *     identifier → `signer_identity_mismatch`, fatal (a contradiction only
+ *     lowers, so any registry may report it);
+ *   - it matches otherwise → `key_derived_match`.
+ * `ok` ("matches the registry") is never reported under a key-derived
+ * identifier. Without `publicKey` the derivation cannot run; the registry
+ * cross-check runs as for any signer, except that its `ok` reads
+ * `no_registry_identity`, since nothing established the identifier.
  */
-export declare function checkSignerIdentity(pkg: Record<string, unknown>, kid: string | undefined, registry: TrustRegistry | undefined): SignerIdentityCheck;
+export declare function checkSignerIdentity(pkg: Record<string, unknown>, kid: string | undefined, registry: TrustRegistry | undefined, 
+/** The signature envelope's base64 SPKI `publicKey`. Read only when the
+ *  signer's identifier is key-derived. */
+publicKey?: string): SignerIdentityCheck;
 export declare const CAPTURE_METHOD_VOCAB_STATUSES: readonly ["ok", "captureMethod_unknown", "producerProfile_bundle_unresolved", "no_capture_method"];
 export type CaptureMethodVocabStatus = (typeof CAPTURE_METHOD_VOCAB_STATUSES)[number];
 export interface CaptureMethodVocabCheck {

package/dist/checks.js

@@ -1,14 +1,17 @@
 // Content-canonicalization, content-hash, and typed-standards envelope checks
-// (spec §9.2 checks #3, #4, #12, #13, #14, #15) + the package-level blob-ref
-// walker (#9) — browser-safe.
+// (spec §9.2 checks #3, #4, #12, #13, #14, #15, #16) + the package-level
+// blob-ref walker (#9) — browser-safe.
 //
 // Factored verbatim from the server `verify.ts` (WS2); these functions were
 // already pure JS over the package object. The only environmental change is the
 // blob-ref walker now threads an injected fetcher. Each check degrades gracefully
 // for pre-v0.1 packages that omit the corresponding field.
-import { computeEnvelopeHash, computeContentHashSha256, isMultihashContentHash, KNOWN_CANONICALIZATION_RULES, LEGACY_JSON_CANONICALIZATION, DATHERE_AG_JUPYTER_CANONICALIZATION, } from "./canonicalization.js";
+import { computeEnvelopeHash, computeContentHashSha256, isMultihashContentHash, KNOWN_CANONICALIZATION_RULES, LEGACY_JSON_CANONICALIZATION, DATHERE_AG_JUPYTER_CANONICALIZATION, RAW_BYTES_CANONICALIZATION, } from "./canonicalization.js";
+import { sha256Hex } from "./primitives.js";
 import { captureVocabForProfile, resolveProfileType } from "./profiles.js";
-import { isBlobRef, verifyBlobRef, } from "./blob-ref.js";
+import { isBlobRef, parseBlobRef, verifyBlobRef, } from "./blob-ref.js";
+import { isKeyDerivedIdentifier } from "./did-key.js";
+import { compareKeyDerivedIdentifier } from "./self-certifying.js";
 /**
  * Recompute a package's envelope hash, routed by the §8.2 detection rule: v0.1
  * packages (multihash `contentHash` present) hash via RFC 8785 JCS; pre-v0.1
@@ -65,6 +68,7 @@ export const CONTENT_HASH_STATUSES = [
     'contentHash_no_supported_algorithm',
     'unresolved_rule',
     'legacy_relabeled',
+    'content_bytes_unavailable',
 ];
 /** Multihash algorithms this verifier can recompute today (spec §8.2 lists
  *  sha256 required + sha3-256 / blake3 as registered alternates). */
@@ -86,8 +90,20 @@ const SUPPORTED_CONTENT_HASH_ALGORITHMS = ['sha256'];
  * single-SHA-256 is RELABELED as `{ sha256: <hex> }` per §8.2 rather than
  * recomputed; its integrity is established by check #1, so check #4 reports
  * `legacy_relabeled`.
+ *
+ * raw-bytes/v1 with a BlobRef `output` (hub ADR-0029 §4): the fingerprinted
+ * bytes live outside the package. `outputBytes` are those bytes when the caller
+ * holds them.
+ *   - `contentHash.sha256` differs from the hex of `output.ref` →
+ *     `content_hash_mismatch`, decided from the package alone.
+ *   - no `outputBytes` → `content_bytes_unavailable`: the bytes were not
+ *     checked. Never `ok` without hashing.
+ *   - otherwise the SHA-256 of `outputBytes` is compared with
+ *     `contentHash.sha256` → `ok` / `content_hash_mismatch`.
+ * This function does no I/O; `verifyContentHashWithFetch` obtains the bytes
+ * through the injected fetcher and passes them here.
  */
-export function verifyContentHash(pkg, resolution, legacyExternalHash) {
+export function verifyContentHash(pkg, resolution, legacyExternalHash, outputBytes) {
     const contentHash = pkg['contentHash'];
     if (!isMultihashContentHash(contentHash)) {
         return {
@@ -107,6 +123,21 @@ export function verifyContentHash(pkg, resolution, legacyExternalHash) {
             contentHash,
         };
     }
+    const output = pkg['output'];
+    if (resolution.rule === RAW_BYTES_CANONICALIZATION && isBlobRef(output)) {
+        // sha256 is the only supported algorithm, so `checkable` is ['sha256'] here.
+        const signed = contentHash['sha256'];
+        if (signed !== parseBlobRef(output.ref).hash) {
+            // No file can hash to two different signed digests.
+            return { status: 'content_hash_mismatch', algorithms, contentHash };
+        }
+        if (outputBytes === undefined) {
+            return { status: 'content_bytes_unavailable', algorithms, contentHash };
+        }
+        return sha256Hex(outputBytes) === signed
+            ? { status: 'ok', algorithms, matched: 'sha256', contentHash }
+            : { status: 'content_hash_mismatch', algorithms, contentHash };
+    }
     for (const algo of checkable) {
         let recomputed;
         try {
@@ -130,6 +161,88 @@ export function verifyContentHash(pkg, resolution, legacyExternalHash) {
     }
     return { status: 'content_hash_mismatch', algorithms, contentHash };
 }
+/** Fetch a BlobRef's bytes through the injected fetcher (defaulting to
+ *  `globalThis.fetch`, the same default check #9 uses). `undefined` on any
+ *  failure. */
+async function fetchBlobRefBytes(ref, options) {
+    try {
+        const fetcher = options.fetch ?? globalThis.fetch;
+        const response = await fetcher(ref.url, {
+            signal: options.signal ?? AbortSignal.timeout(15_000),
+        });
+        if (!response.ok)
+            return undefined;
+        return new Uint8Array(await response.arrayBuffer());
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Check #4 with the raw-bytes/v1 BlobRef path wired to the injected fetcher
+ * (hub ADR-0029 §4). Identical to `verifyContentHash` for every other rule and
+ * shape. For a raw-bytes/v1 package whose `output` is a BlobRef, it obtains the
+ * file's bytes through `options.fetch` (an offline verifier supplies a local
+ * copy through that fetcher) and hashes them; bytes it cannot obtain leave the
+ * status at `content_bytes_unavailable`.
+ */
+export async function verifyContentHashWithFetch(pkg, resolution, legacyExternalHash, options = {}) {
+    const first = verifyContentHash(pkg, resolution, legacyExternalHash);
+    const output = pkg['output'];
+    if (first.status !== 'content_bytes_unavailable' || !isBlobRef(output)) {
+        return first;
+    }
+    const bytes = await fetchBlobRefBytes(output, options);
+    if (bytes === undefined)
+        return first;
+    return verifyContentHash(pkg, resolution, legacyExternalHash, bytes);
+}
+// --- Content-profile check (spec §9.2 check #16; hub ADR-0029 §5) ---
+/** The known `metadata.contentProfile` values (spec §8.1.2). */
+export const KNOWN_CONTENT_PROFILES = ['default', 'datHere'];
+export const CONTENT_PROFILE_STATUSES = [
+    'ok',
+    'contentProfile_absent',
+    'contentProfile_unknown',
+    'contentProfile_inconsistent',
+];
+/**
+ * Check #16 — `metadata.contentProfile` (hub ADR-0029 §5).
+ *   - key absent → `contentProfile_absent` (read as `"default"`, spec §8.1.2).
+ *   - present and neither `"default"` nor `"datHere"` → `contentProfile_unknown`
+ *     (reported, not passed; consistency is not judged).
+ *   - present, known, `producerProfile` present, and the ADR-0006 §2 invariant
+ *     fails (`contentProfile === "datHere"` iff `producerProfile` starts with
+ *     `ai-assisted-analysis/datHere`) → `contentProfile_inconsistent`.
+ *   - otherwise → `ok`.
+ * The invariant is compared only when both fields are present. No status is an
+ * integrity failure: both labels are signature-covered.
+ */
+export function checkContentProfile(pkg) {
+    const metadata = pkg['metadata'];
+    const raw = typeof metadata === 'object' && metadata !== null && !Array.isArray(metadata)
+        ? metadata['contentProfile']
+        : undefined;
+    const producerProfile = typeof pkg['producerProfile'] === 'string' ? pkg['producerProfile'] : undefined;
+    const base = {
+        ...(typeof raw === 'string' ? { contentProfile: raw } : {}),
+        ...(producerProfile !== undefined ? { producerProfile } : {}),
+    };
+    if (raw === undefined) {
+        return { status: 'contentProfile_absent', ...base };
+    }
+    if (typeof raw !== 'string' || !KNOWN_CONTENT_PROFILES.includes(raw)) {
+        return { status: 'contentProfile_unknown', ...base };
+    }
+    if (producerProfile !== undefined) {
+        const isDatHere = raw === 'datHere';
+        const profileIsDatHere = producerProfile.startsWith('ai-assisted-analysis/datHere');
+        if (isDatHere !== profileIsDatHere) {
+            return { status: 'contentProfile_inconsistent', ...base };
+        }
+    }
+    return { status: 'ok', ...base };
+}
 // --- Typed-standards envelope checks (spec §9.2 checks #12, #14, #15) ---
 // v0.1 ratified node type URIs (spec §8.12.1). Recognized so check #12 resolves
 // them; only `content/analysis/v1` (+ the lifecycle sub-types) are operationalized
@@ -174,6 +287,8 @@ export const SIGNER_IDENTITY_CHECK_STATUSES = [
     'signer_identity_mismatch',
     'no_signer',
     'no_registry_identity',
+    'key_derived_match',
+    'key_derived_mismatch',
 ];
 /**
  * Check #14 — `signer.identifier` ↔ trust-registry `signerIdentity` cross-check
@@ -182,14 +297,53 @@ export const SIGNER_IDENTITY_CHECK_STATUSES = [
  * verifier derives the signer from the registry and skips the cross-check. A
  * registry entry without a `signerIdentity` (legacy registry) yields
  * `no_registry_identity`.
+ *
+ * A key-derived `signer.identifier` (one beginning `did:key:`, hub ADR-0030 §3)
+ * is checked against the envelope's `publicKey` instead, whatever the
+ * `bindingTier` and whatever the registry's source:
+ *   - the identifier derived from `publicKey` differs → `key_derived_mismatch`,
+ *     fatal, carrying `claimed` and `derived`;
+ *   - it matches, and a registry entry for the `kid` records a different
+ *     identifier → `signer_identity_mismatch`, fatal (a contradiction only
+ *     lowers, so any registry may report it);
+ *   - it matches otherwise → `key_derived_match`.
+ * `ok` ("matches the registry") is never reported under a key-derived
+ * identifier. Without `publicKey` the derivation cannot run; the registry
+ * cross-check runs as for any signer, except that its `ok` reads
+ * `no_registry_identity`, since nothing established the identifier.
  */
-export function checkSignerIdentity(pkg, kid, registry) {
+export function checkSignerIdentity(pkg, kid, registry, 
+/** The signature envelope's base64 SPKI `publicKey`. Read only when the
+ *  signer's identifier is key-derived. */
+publicKey) {
     const signer = pkg['signer'];
     if (!signer || typeof signer !== 'object' || typeof signer.identifier !== 'string') {
         return { status: 'no_signer' };
     }
     const entry = kid && registry ? registry.keys.find((k) => k.kid === kid) : undefined;
     const registered = entry?.signerIdentity?.identifier;
+    if (isKeyDerivedIdentifier(signer.identifier)) {
+        const comparison = compareKeyDerivedIdentifier(signer, publicKey);
+        if (comparison && !comparison.match) {
+            return {
+                status: 'key_derived_mismatch',
+                claimed: comparison.claimed,
+                ...(comparison.derived !== undefined ? { derived: comparison.derived } : {}),
+            };
+        }
+        if (registered && registered !== signer.identifier) {
+            return { status: 'signer_identity_mismatch', claimed: signer.identifier, registered };
+        }
+        if (comparison) {
+            return {
+                status: 'key_derived_match',
+                claimed: signer.identifier,
+                derived: comparison.derived,
+                ...(registered ? { registered } : {}),
+            };
+        }
+        return { status: 'no_registry_identity', claimed: signer.identifier };
+    }
     if (!registered) {
         return { status: 'no_registry_identity', claimed: signer.identifier };
     }

package/dist/did-key.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Base-58 encoding, Bitcoin alphabet: big-endian base conversion, one leading
+ * `1` per leading zero byte (draft-msporny-base58-03). Not exported from the
+ * package entry point; the derivation below is its one shipped caller.
+ */
+export declare function base58btcEncode(bytes: Uint8Array): string;
+/** The prefix that makes a `signer.identifier` key-derived (ADR-0030 §3). */
+export declare const KEY_DERIVED_IDENTIFIER_PREFIX = "did:key:";
+/**
+ * Derive the key-derived identifier from a base64 SPKI DER Ed25519 public key
+ * (the signature envelope's `publicKey`), per ADR-0030 §2:
+ *   1. base64-decode to 44 bytes whose first 12 are the Ed25519 SPKI prefix;
+ *   2. take the trailing 32 bytes (the raw RFC 8032 public key);
+ *   3. prepend `ed 01`;
+ *   4. base58btc-encode;
+ *   5. prefix `did:key:z`.
+ * Steps 1-2 are `extractRawPublicKey`, which throws on a malformed key; so
+ * does this function.
+ */
+export declare function deriveKeyDerivedIdentifier(publicKeyB64Der: string): string;
+/**
+ * Whether a `signer.identifier` is key-derived: it begins `did:key:`
+ * (ADR-0030 §3). The prefix alone decides — a `did:key:u…` spelling, or a
+ * `did:key:z…` for another key type, is key-derived and can never equal an
+ * Ed25519 derivation, so it is a fatal mismatch. `bindingTier` does not enter
+ * this decision.
+ */
+export declare function isKeyDerivedIdentifier(identifier: unknown): identifier is string;

package/dist/did-key.js

@@ -0,0 +1,74 @@
+// The key-derived signer identifier (hub ADR-0030 §2, §3) — browser-safe.
+//
+// A signer with no domain names itself by its public key: `did:key` in its
+// base58btc (`z`) form for an Ed25519 key (The did:key Method v0.9, W3C CCG
+// draft; multicodec `ed25519-pub` 0xed; multibase `z`). A verifier recomputes
+// the identifier from the envelope's `publicKey` and compares it with the
+// package's `signer.identifier` byte for byte. It never decodes the claimed
+// string, so this module has an encoder and no decoder.
+//
+// The base-58 encoder is written in place (ADR-0030 §6): no runtime
+// dependency, no `Buffer`, no Node built-in.
+import { extractRawPublicKey } from "./signature.js";
+/** The Bitcoin base-58 alphabet (draft-msporny-base58-03). */
+const BASE58_ALPHABET = '123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz';
+/**
+ * Base-58 encoding, Bitcoin alphabet: big-endian base conversion, one leading
+ * `1` per leading zero byte (draft-msporny-base58-03). Not exported from the
+ * package entry point; the derivation below is its one shipped caller.
+ */
+export function base58btcEncode(bytes) {
+    let zeros = 0;
+    while (zeros < bytes.length && bytes[zeros] === 0)
+        zeros++;
+    // Base-58 digits, least significant first.
+    const digits = [];
+    for (let i = zeros; i < bytes.length; i++) {
+        let carry = bytes[i];
+        for (let j = 0; j < digits.length; j++) {
+            carry += digits[j] * 256;
+            digits[j] = carry % 58;
+            carry = Math.floor(carry / 58);
+        }
+        while (carry > 0) {
+            digits.push(carry % 58);
+            carry = Math.floor(carry / 58);
+        }
+    }
+    let out = '1'.repeat(zeros);
+    for (let k = digits.length - 1; k >= 0; k--)
+        out += BASE58_ALPHABET[digits[k]];
+    return out;
+}
+/** The prefix that makes a `signer.identifier` key-derived (ADR-0030 §3). */
+export const KEY_DERIVED_IDENTIFIER_PREFIX = 'did:key:';
+/** The unsigned-varint encoding of multicodec `ed25519-pub` (0xed). */
+const ED25519_PUB_MULTICODEC = Uint8Array.from([0xed, 0x01]);
+/**
+ * Derive the key-derived identifier from a base64 SPKI DER Ed25519 public key
+ * (the signature envelope's `publicKey`), per ADR-0030 §2:
+ *   1. base64-decode to 44 bytes whose first 12 are the Ed25519 SPKI prefix;
+ *   2. take the trailing 32 bytes (the raw RFC 8032 public key);
+ *   3. prepend `ed 01`;
+ *   4. base58btc-encode;
+ *   5. prefix `did:key:z`.
+ * Steps 1-2 are `extractRawPublicKey`, which throws on a malformed key; so
+ * does this function.
+ */
+export function deriveKeyDerivedIdentifier(publicKeyB64Der) {
+    const raw = extractRawPublicKey(publicKeyB64Der);
+    const mc = new Uint8Array(ED25519_PUB_MULTICODEC.length + raw.length);
+    mc.set(ED25519_PUB_MULTICODEC, 0);
+    mc.set(raw, ED25519_PUB_MULTICODEC.length);
+    return `${KEY_DERIVED_IDENTIFIER_PREFIX}z${base58btcEncode(mc)}`;
+}
+/**
+ * Whether a `signer.identifier` is key-derived: it begins `did:key:`
+ * (ADR-0030 §3). The prefix alone decides — a `did:key:u…` spelling, or a
+ * `did:key:z…` for another key type, is key-derived and can never equal an
+ * Ed25519 derivation, so it is a fatal mismatch. `bindingTier` does not enter
+ * this decision.
+ */
+export function isKeyDerivedIdentifier(identifier) {
+    return typeof identifier === 'string' && identifier.startsWith(KEY_DERIVED_IDENTIFIER_PREFIX);
+}

package/dist/index.d.ts

@@ -6,6 +6,7 @@ export * from './attestation.ts';
 export * from './blob-ref.ts';
 export * from './signature.ts';
 export * from './trust-registry.ts';
+export { deriveKeyDerivedIdentifier, isKeyDerivedIdentifier, KEY_DERIVED_IDENTIFIER_PREFIX, } from './did-key.ts';
 export * from './checks.ts';
 export * from './lifecycle.ts';
 export * from './rekor.ts';

package/dist/index.js

@@ -20,6 +20,7 @@ export * from "./attestation.js";
 export * from "./blob-ref.js";
 export * from "./signature.js";
 export * from "./trust-registry.js";
+export { deriveKeyDerivedIdentifier, isKeyDerivedIdentifier, KEY_DERIVED_IDENTIFIER_PREFIX, } from "./did-key.js";
 export * from "./checks.js";
 export * from "./lifecycle.js";
 export * from "./rekor.js";

package/dist/profiles.js

@@ -10,6 +10,12 @@ export const PROFILE_CAPTURE_VOCAB = {
         'claude-code-jsonl-readback',
         'claude-code-self-report',
     ],
+    // Status note, 2026-09-21 (hub ADR-0029 §2, Q32 still open): a second
+    // stand-in entry. A program computed the content from inputs pinned by hash;
+    // `script-run` = a packaging program read files already on disk, `tool-emitted`
+    // = the computing program wrote the package itself. The guidance-bundle routing
+    // convention that replaces this table is not settled by this entry.
+    'scripted-recomputation': ['script-run', 'tool-emitted'],
 };
 /**
  * Resolve a package's Producer Profile *type* (the segment before the first `/`

package/dist/self-certifying.d.ts

@@ -0,0 +1,46 @@
+import type { KeyTrustResult, TrustRegistryProvenance } from './trust-registry.ts';
+/** The outcome of comparing a key-derived `signer.identifier` with the
+ *  identifier derived from the envelope's `publicKey` (ADR-0030 §2). */
+export interface KeyDerivedComparison {
+    claimed: string;
+    /** Absent when the derivation failed (a malformed key). */
+    derived?: string;
+    match: boolean;
+}
+/**
+ * Compare the package's `signer.identifier` with the identifier derived from
+ * the envelope's `publicKey`. Returns `null` when the self-certifying check
+ * does not run: no signer, an identifier that is not key-derived, or no
+ * envelope key. A failed derivation is a mismatch with no `derived` value.
+ */
+export declare function compareKeyDerivedIdentifier(signer: unknown, publicKey: string | undefined): KeyDerivedComparison | null;
+/**
+ * G2-B for a key-derived identifier, whether or not it matched its envelope
+ * key (ADR-0030 §4 rule 3 as amended; spec v0.1.9 §9.4): only a registry
+ * fetched from the declared `trustRegistryUrl` can raise the status. Returns
+ * `base` unless it is a raising verdict (`active`, `deprecated_valid`) from a
+ * bundle-carried or provenance-less registry; that verdict is ignored and the
+ * status is what the envelope alone yields with no registry supplied
+ * (`registry_unavailable` with a `kid`, `legacy_embedded` without),
+ * `verified: false`. Lowering and unlisted verdicts pass through.
+ */
+export declare function applyKeyDerivedRegistryRule(base: KeyTrustResult, provenance: TrustRegistryProvenance | undefined): KeyTrustResult;
+/**
+ * Apply ADR-0030 §4 rules 2-3, as amended at gate G2, to the registry-path
+ * verdict `base`, for a package whose key-derived identifier MATCHED its
+ * envelope key. (A mismatch takes `applyKeyDerivedRegistryRule` alone.)
+ *
+ * For a key-derived identifier, at any `bindingTier`:
+ *   - A registry from the declared `trustRegistryUrl` that lists the
+ *     envelope's `(kid, publicKey)` decides: its verdict stands.
+ *   - Any other registry (bundle-carried, or no stated provenance)
+ *     contributes only a lowering verdict (`revoked`, `deprecated_invalid`).
+ *     A raising one (`active`, `deprecated_valid`) is ignored.
+ *   - With no registry listing the key, or a raising verdict ignored, the
+ *     status is `self_certified` at `pseudonymous`; at any other tier it is
+ *     what the envelope alone yields with no registry supplied
+ *     (`registry_unavailable` with a `kid`, `legacy_embedded` without) — never
+ *     `active`, never `verified: true`. `self_certified` is reserved for the
+ *     `pseudonymous` rung (§3).
+ */
+export declare function applySelfCertifiedKeyTrust(base: KeyTrustResult, bindingTier: unknown, provenance: TrustRegistryProvenance | undefined): KeyTrustResult;

package/dist/self-certifying.js

@@ -0,0 +1,89 @@
+// The self-certifying signer's key-trust rule (hub ADR-0030 §3, §4) —
+// browser-safe. Internal to verify-core: `verifyRecord` applies it; the
+// package entry point does not re-export it.
+import { deriveKeyDerivedIdentifier, isKeyDerivedIdentifier } from "./did-key.js";
+/** The one `bindingTier` under which a derived match is `self_certified`. */
+const SELF_CERTIFYING_TIER = 'pseudonymous';
+/** Verdicts that say the key must not be trusted for this signature. A
+ *  bundle-carried registry may report these about a self-certified signer. */
+const LOWERING_STATUSES = new Set(['revoked', 'deprecated_invalid']);
+/** Verdicts that mean no registry listed the envelope's `(kid, publicKey)`. */
+const UNLISTED_STATUSES = new Set([
+    'registry_unavailable',
+    'unknown_key',
+    'legacy_embedded',
+]);
+/**
+ * Compare the package's `signer.identifier` with the identifier derived from
+ * the envelope's `publicKey`. Returns `null` when the self-certifying check
+ * does not run: no signer, an identifier that is not key-derived, or no
+ * envelope key. A failed derivation is a mismatch with no `derived` value.
+ */
+export function compareKeyDerivedIdentifier(signer, publicKey) {
+    if (!signer || typeof signer !== 'object')
+        return null;
+    const claimed = signer.identifier;
+    if (!isKeyDerivedIdentifier(claimed) || !publicKey)
+        return null;
+    let derived;
+    try {
+        derived = deriveKeyDerivedIdentifier(publicKey);
+    }
+    catch {
+        return { claimed, match: false };
+    }
+    return { claimed, derived, match: derived === claimed };
+}
+/**
+ * G2-B for a key-derived identifier, whether or not it matched its envelope
+ * key (ADR-0030 §4 rule 3 as amended; spec v0.1.9 §9.4): only a registry
+ * fetched from the declared `trustRegistryUrl` can raise the status. Returns
+ * `base` unless it is a raising verdict (`active`, `deprecated_valid`) from a
+ * bundle-carried or provenance-less registry; that verdict is ignored and the
+ * status is what the envelope alone yields with no registry supplied
+ * (`registry_unavailable` with a `kid`, `legacy_embedded` without),
+ * `verified: false`. Lowering and unlisted verdicts pass through.
+ */
+export function applyKeyDerivedRegistryRule(base, provenance) {
+    if (provenance === 'declared-url')
+        return base;
+    if (UNLISTED_STATUSES.has(base.status) || LOWERING_STATUSES.has(base.status))
+        return base;
+    return base.kid !== undefined
+        ? { status: 'registry_unavailable', verified: false, kid: base.kid }
+        : { status: 'legacy_embedded', verified: false };
+}
+/**
+ * Apply ADR-0030 §4 rules 2-3, as amended at gate G2, to the registry-path
+ * verdict `base`, for a package whose key-derived identifier MATCHED its
+ * envelope key. (A mismatch takes `applyKeyDerivedRegistryRule` alone.)
+ *
+ * For a key-derived identifier, at any `bindingTier`:
+ *   - A registry from the declared `trustRegistryUrl` that lists the
+ *     envelope's `(kid, publicKey)` decides: its verdict stands.
+ *   - Any other registry (bundle-carried, or no stated provenance)
+ *     contributes only a lowering verdict (`revoked`, `deprecated_invalid`).
+ *     A raising one (`active`, `deprecated_valid`) is ignored.
+ *   - With no registry listing the key, or a raising verdict ignored, the
+ *     status is `self_certified` at `pseudonymous`; at any other tier it is
+ *     what the envelope alone yields with no registry supplied
+ *     (`registry_unavailable` with a `kid`, `legacy_embedded` without) — never
+ *     `active`, never `verified: true`. `self_certified` is reserved for the
+ *     `pseudonymous` rung (§3).
+ */
+export function applySelfCertifiedKeyTrust(base, bindingTier, provenance) {
+    const listed = !UNLISTED_STATUSES.has(base.status);
+    if (listed && (provenance === 'declared-url' || LOWERING_STATUSES.has(base.status))) {
+        return base;
+    }
+    if (bindingTier !== SELF_CERTIFYING_TIER) {
+        // Unlisted: the registry path's own verdict is unchanged. Listed with a
+        // raising verdict from a registry that may not raise: the envelope alone.
+        return applyKeyDerivedRegistryRule(base, provenance);
+    }
+    return {
+        status: 'self_certified',
+        verified: false,
+        ...(base.kid !== undefined ? { kid: base.kid } : {}),
+    };
+}

package/dist/trust-registry.d.ts

@@ -16,14 +16,30 @@ export interface TrustRegistryKey {
 export interface TrustRegistry {
     keys: TrustRegistryKey[];
 }
-export declare const KEY_TRUST_STATUSES: readonly ["active", "deprecated_valid", "deprecated_invalid", "revoked", "unknown_key", "registry_unavailable", "legacy_embedded"];
+export declare const KEY_TRUST_STATUSES: readonly ["active", "deprecated_valid", "deprecated_invalid", "revoked", "unknown_key", "registry_unavailable", "legacy_embedded", "self_certified"];
 export type KeyTrustStatus = (typeof KEY_TRUST_STATUSES)[number];
+/**
+ * Where a supplied registry came from (hub ADR-0030 §4 rule 3). This module
+ * still has no opinion on HOW a registry is obtained; the caller states it,
+ * because for a signer with a key-derived identifier the answer decides what
+ * the registry may do:
+ *   - `declared-url` — fetched from the view's declared `trustRegistryUrl` (or
+ *     `trustRegistryUrlLegacy`). Its verdict about the key stands.
+ *   - `bundle` — carried in the bundle (the `?inline=1` form's
+ *     `trustRegistry`), or obtained any other way. It may lower a
+ *     self-certified signer's status (`revoked`, `deprecated_invalid`) and
+ *     never raise it.
+ * A registry supplied with no stated provenance is treated as `bundle`.
+ * Signers whose identifier is not key-derived are unaffected by provenance.
+ */
+export declare const TRUST_REGISTRY_PROVENANCES: readonly ["declared-url", "bundle"];
+export type TrustRegistryProvenance = (typeof TRUST_REGISTRY_PROVENANCES)[number];
 export interface KeyTrustResult {
     status: KeyTrustStatus;
     /** `true` iff the status is `active` or `deprecated_valid`. Legacy-embedded
-     *  signatures are intentionally surfaced as `verified: false` because the
-     *  trust registry cannot vouch for them — the UI renders them as neutral
-     *  rather than failed. */
+     *  and self-certified signatures are intentionally surfaced as
+     *  `verified: false` because no trust registry vouches for them — the UI
+     *  renders them as neutral rather than failed. */
     verified: boolean;
     /** The registry `kid` when available. Omitted for `legacy_embedded` /
      *  pre-registry packages because the signature has no kid to report. */

package/dist/trust-registry.js

@@ -22,7 +22,23 @@ export const KEY_TRUST_STATUSES = [
     'unknown_key', // (kid, publicKey) pair not found in registry
     'registry_unavailable', // registry could not be loaded
     'legacy_embedded', // signed with an embedded key, no registry kid stored
+    'self_certified', // key-derived identifier matches the key; no registry vouches (hub ADR-0030 §3)
 ];
+/**
+ * Where a supplied registry came from (hub ADR-0030 §4 rule 3). This module
+ * still has no opinion on HOW a registry is obtained; the caller states it,
+ * because for a signer with a key-derived identifier the answer decides what
+ * the registry may do:
+ *   - `declared-url` — fetched from the view's declared `trustRegistryUrl` (or
+ *     `trustRegistryUrlLegacy`). Its verdict about the key stands.
+ *   - `bundle` — carried in the bundle (the `?inline=1` form's
+ *     `trustRegistry`), or obtained any other way. It may lower a
+ *     self-certified signer's status (`revoked`, `deprecated_invalid`) and
+ *     never raise it.
+ * A registry supplied with no stated provenance is treated as `bundle`.
+ * Signers whose identifier is not key-derived are unaffected by provenance.
+ */
+export const TRUST_REGISTRY_PROVENANCES = ['declared-url', 'bundle'];
 /**
  * Build a `KeyTrustResult` for a package whose signature predates the trust
  * registry — i.e. has a valid public key but no `kid`. We accept that the

package/dist/types.d.ts

@@ -16,7 +16,7 @@ export interface SignerIdentity {
  * the per-profile vocabulary table in `profiles.ts` is the single source that
  * enumerates these.
  */
-export type CaptureMethod = 'chat-flow-stream' | 'claude-code-jsonl-readback' | 'claude-code-self-report';
+export type CaptureMethod = 'chat-flow-stream' | 'claude-code-jsonl-readback' | 'claude-code-self-report' | 'script-run' | 'tool-emitted';
 /**
  * The subset of the WHATWG `fetch` signature verify-core depends on. Network
  * I/O is INJECTED rather than imported so the same code runs on the server (its

package/dist/verify.d.ts

@@ -1,7 +1,7 @@
 import { type RekorInclusionProof, type RekorInclusionResult } from './rekor-inclusion.ts';
 import { type Rfc3161VerifyResult } from './rfc3161.ts';
-import { type KeyTrustResult, type TrustRegistry } from './trust-registry.ts';
-import { type ContentCanonicalizationResolution, type ContentHashCheck, type TypeResolution, type SignerIdentityCheck, type CaptureMethodVocabCheck, type BlobRefVerification } from './checks.ts';
+import { type KeyTrustResult, type TrustRegistry, type TrustRegistryProvenance } from './trust-registry.ts';
+import { type ContentCanonicalizationResolution, type ContentHashCheck, type TypeResolution, type SignerIdentityCheck, type CaptureMethodVocabCheck, type ContentProfileCheck, type BlobRefVerification } from './checks.ts';
 import { type LifecycleResolution } from './lifecycle.ts';
 import type { FetchLike } from './types.ts';
 /** The parsed signature envelope (`buildCommitmentView`'s `signature`). */
@@ -97,7 +97,13 @@ export interface VerifyDeps {
     /** Parsed trust registry (server: loaded; browser: fetched from the sidecar's
      *  `trustRegistryUrl`). */
     registry: TrustRegistry | undefined;
-    /** Injected fetcher for #8 / #9. Defaults to `globalThis.fetch`. */
+    /** Where `registry` came from (hub ADR-0030 §4 rule 3): `declared-url` when
+     *  it was fetched from the view's declared `trustRegistryUrl`, `bundle` when
+     *  it was carried in the bundle. Read only for a signer whose identifier is
+     *  key-derived; absent is treated as `bundle`. */
+    registryProvenance?: TrustRegistryProvenance;
+    /** Injected fetcher for #8 / #9, and for #4 under raw-bytes/v1 when `output`
+     *  is a BlobRef. Defaults to `globalThis.fetch`. */
     fetch?: FetchLike;
     /** Optional server-deeper lifecycle resolution (the signed attestation chain).
      *  When provided it is surfaced verbatim, preserving the server route's current
@@ -144,6 +150,8 @@ export interface VerifyResult {
     typeResolution: TypeResolution | null;
     signerIdentity: SignerIdentityCheck | null;
     captureMethodVocab: CaptureMethodVocabCheck | null;
+    /** Check #16 — `metadata.contentProfile` (hub ADR-0029 §5). */
+    contentProfile: ContentProfileCheck | null;
     lifecycle: LifecycleResolution;
 }
 /**

package/dist/verify.js

@@ -19,7 +19,7 @@
 // name is still exported, still the same function object, and still works;
 // see the deprecated alias at the bottom of this file.
 //
-// Check depth: fully client-side for #1/#2/#3/#4/#5/#6/#9/#12/#13/#14/#15; #7 (RFC
+// Check depth: fully client-side for #1/#2/#3/#4/#5/#6/#9/#12/#13/#14/#15/#16; #7 (RFC
 // 3161) is PRESENCE (`hasTimestamp`) AND, when a token is present, cryptographic TSA
 // verification against the pinned FreeTSA anchor (civic-ai-tools-website#119 P2a —
 // ECDSA-P384 over the signed TSTInfo, message-imprint match, genTime-in-validity);
@@ -34,7 +34,8 @@ import { verifyRekorEntry } from "./rekor.js";
 import { verifyRekorInclusion, } from "./rekor-inclusion.js";
 import { verifyRfc3161Timestamp } from "./rfc3161.js";
 import { verifyKeyTrust, legacyEmbeddedKeyTrust, } from "./trust-registry.js";
-import { resolveContentCanonicalization, verifyContentHash, resolvePackageType, checkSignerIdentity, checkCaptureMethodVocab, verifyPackageBlobRefs, } from "./checks.js";
+import { applyKeyDerivedRegistryRule, applySelfCertifiedKeyTrust, compareKeyDerivedIdentifier, } from "./self-certifying.js";
+import { resolveContentCanonicalization, verifyContentHashWithFetch, resolvePackageType, checkSignerIdentity, checkCaptureMethodVocab, checkContentProfile, verifyPackageBlobRefs, } from "./checks.js";
 import { resolveLifecycleFromLegacyColumns, } from "./lifecycle.js";
 /**
  * Run the §9.2 check suite. The step order mirrors the server route exactly
@@ -140,18 +141,38 @@ export async function verifyRecord(input, deps) {
     else if (sigPublicKey) {
         keyTrust = legacyEmbeddedKeyTrust();
     }
-    // Step 5 — canonicalization, content-hash, and envelope checks (#3/#4/#12/#14/#15).
+    // Step 4b — the self-certifying signer (hub ADR-0030 §3-§4, rule 3 as
+    // amended at G2; spec v0.1.9 §9.4). Runs only when the package is present,
+    // its `signer.identifier` is key-derived, and the envelope carries a
+    // `publicKey`. For a key-derived identifier, match or mismatch, only a
+    // registry fetched from the declared URL can raise the status; a
+    // bundle-carried or provenance-less one contributes only lowering verdicts.
+    // On a match, rules 2-3 then decide the status (`self_certified` at
+    // `pseudonymous`); on a mismatch (fatal at check #14) the lowering-only rule
+    // applies to the registry-path verdict. A signer whose identifier is not
+    // key-derived is untouched.
+    const pkgSigner = pkg ? pkg['signer'] : undefined;
+    const keyDerived = compareKeyDerivedIdentifier(pkgSigner, sigPublicKey);
+    if (keyTrust && keyDerived) {
+        keyTrust = keyDerived.match
+            ? applySelfCertifiedKeyTrust(keyTrust, pkgSigner.bindingTier, deps.registryProvenance)
+            : applyKeyDerivedRegistryRule(keyTrust, deps.registryProvenance);
+    }
+    // Step 5 — canonicalization, content-hash, and envelope checks
+    // (#3/#4/#12/#14/#15/#16). #4 fetches only for a raw-bytes/v1 BlobRef output.
     let contentCanonicalization = null;
     let contentHashCheck = null;
     let typeResolution = null;
     let signerIdentity = null;
     let captureMethodVocab = null;
+    let contentProfile = null;
     if (pkg) {
         contentCanonicalization = resolveContentCanonicalization(pkg);
-        contentHashCheck = verifyContentHash(pkg, contentCanonicalization, input.legacyExternalHash ?? packageHash);
+        contentHashCheck = await verifyContentHashWithFetch(pkg, contentCanonicalization, input.legacyExternalHash ?? packageHash, { fetch: deps.fetch });
         typeResolution = resolvePackageType(pkg);
-        signerIdentity = checkSignerIdentity(pkg, sigKid, deps.registry);
+        signerIdentity = checkSignerIdentity(pkg, sigKid, deps.registry, sigPublicKey);
         captureMethodVocab = checkCaptureMethodVocab(pkg);
+        contentProfile = checkContentProfile(pkg);
     }
     // Step 6 — lifecycle (check #10). Server-deeper resolution wins when supplied;
     // otherwise derive STATE from the sidecar's lifecycle (the portable depth).
@@ -185,6 +206,7 @@ export async function verifyRecord(input, deps) {
         typeResolution,
         signerIdentity,
         captureMethodVocab,
+        contentProfile,
         lifecycle,
     };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@typedstandards/verify-core",
-  "version": "0.9.0",
+  "version": "0.10.0",
   "description": "Portable, browser-safe verification core for Typed Standards record packages — the §9.2 check suite, single-sourced so it verifies identically on a server and in the browser.",
   "license": "MIT",
   "author": "Nathan Storey",
@@ -26,7 +26,7 @@
   "scripts": {
     "build": "tsc -p tsconfig.json",
     "clean": "rm -rf dist tsconfig.tsbuildinfo",
-    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "typecheck": "tsc -p tsconfig.json --noEmit && tsc -p tsconfig.test.json",
     "test": "node --test --experimental-strip-types \"src/**/*.test.ts\"",
     "prepublishOnly": "npm run clean && npm run build"
   },
@@ -36,6 +36,7 @@
     "canonicalize": "^3.0.0"
   },
   "devDependencies": {
+    "@types/node": "^20",
     "typescript": "^5.9.3"
   },
   "engines": {