@typedstandards/verify-core 0.9.0 → 0.11.0

package/CHANGELOG.md

@@ -1,11 +1,133 @@
 # Changelog — @typedstandards/verify-core
 
-Factual record of what changed per published version. Check numbers (#1–#15)
+Factual record of what changed per published version. Check numbers (#1–#16)
 refer to the Typed Standards specification §9.2 verification sequence. Issue
 references are to `npstorey/civic-ai-tools-website` (#119 is the offline-crypto
 hardening arc; #116 is the standalone-verifier arc this package was extracted
 in).
 
+## 0.11.0 — 2026-09-22
+
+The verifier follow-ons (anchored at `typedstandards#98`): specification check #6, the ratified
+`attestation/revises/v1` (specification v0.1.10), one fetch per referenced file, and a timestamp result
+that tells a token that does not verify from one whose only fault is its chain. **A minor bump** — new
+exports, `VerifyResult` gains a field, and `Rfc3161FailReason` gains a member, so a consumer that
+builds a `VerifyResult` literal (a test double, say), or has an exhaustive `switch` or `Record` over
+the reasons, needs the new cases.
+
+- **Check #6, `metadata.signingKeyId` consistency (`checkSigningKeyIdConsistency`,
+  `SIGNING_KEY_ID_CONSISTENCY_STATUSES`; typedstandards#88).** Specification §9.2 check #6 was
+  implemented nowhere. It compares the signature envelope's `kid` with the package's
+  `metadata.signingKeyId` and reports one of:
+  - `ok` — both present and equal;
+  - `signingKeyId_mismatch` — both present and different; the one failing status (§8.3.1: the field
+    MUST equal the envelope `kid`). The result carries `kid` and `signingKeyId`;
+  - `kid_absent` — the envelope carries no `kid`; legitimate under a key-derived identifier, and on
+    legacy packages, which carry neither field;
+  - `signingKeyId_absent` — a `kid` that the signed bytes do not name, so the check cannot confirm
+    it.
+
+  `signer.identifier` is not compared: under a key-derived identifier the `kid` SHOULD be the
+  identifier, which is not a condition of this check. `VerifyResult` gains `signingKeyIdConsistency`,
+  null when there is no package, no signature envelope, or a malformed one. The captured and
+  published packages measured for this change (the three captured commitment bundles, the
+  self-certified interop fixture, the two ADR-0028 eval-run packages, and two published example
+  bundles under a key-derived identifier) read `ok`, except the legacy capture, which carries neither
+  field and reads `kid_absent`.
+- **Check #12 registers `attestation/revises/v1` (typedstandards#96).** The ratified set is sixteen
+  attestation sub-types plus `content/analysis/v1`; a node of that type read `unknown_type` and now
+  reads `ok`.
+- **One fetch per BlobRef URL per `verifyRecord` (typedstandards#90).** Under `raw-bytes/v1` with a
+  BlobRef `output`, checks #9 and #4 each fetched the file. They now share one request per URL within a
+  `verifyRecord` call, and report exactly what they reported before, including when the fetch fails and
+  when the bytes do not match. No public signature changes, and no request is added.
+- **Check #7 evaluates the TSA signature when the chain does not reach a pinned root
+  (typedstandards#94).** `verifyRfc3161Timestamp` used to return at the chain step, so for a token
+  whose chain did not reach a pinned anchor `signatureValid` read `null` whether the signature was
+  genuine or not. It now reads `true` or `false` there as well. For a consumer:
+  - `signatureValid` is `null` when an earlier step returned first (`parse_error`,
+    `unexpected_algorithm`, `imprint_mismatch`, `no_message_digest`, `content_not_bound`,
+    `no_signing_cert`, `eku_not_timestamping`), or when the signing cert's key is not a P-384 key.
+    `true` means the signature verifies under the embedded signing cert's key; that key is trusted
+    only when `chainVerified` is `true`. `false` means a P-384 key under which the signature does
+    not verify, including a malformed signature encoding;
+  - `reason` reports the token's own faults ahead of the chain's: `genTime_outside_validity`, then
+    `unexpected_algorithm` for a signing-cert key that is not P-384, then `signature_invalid`, then
+    the chain reason. A token with an unpinned chain and a signature that does not verify used to
+    read `untrusted_root` (or another chain reason) and now reads `signature_invalid`. A signing-cert
+    key that is not P-384 used to read the chain reason, or `signature_invalid` under a pinned chain,
+    and now reads `unexpected_algorithm`. `untrusted_root`, `chain_incomplete`,
+    `chain_signature_invalid` and `chain_outside_validity` are now reported only for a token whose
+    TSA signature verifies and whose `genTime` is within the signing cert's validity;
+  - **new reason `chain_outside_validity`:** an intermediate or root certificate not valid at
+    `genTime`, a chain fault. `genTime_outside_validity` now means only the signing cert. A token
+    whose signing cert is valid at `genTime` and whose intermediate or root is not used to read
+    `genTime_outside_validity` and now reads `chain_outside_validity`;
+  - **the message imprint is compared before the SignerInfo algorithms:** a token that does not bind
+    this package's hash reads `imprint_mismatch` whatever algorithms it uses. One that did so with a
+    digest or signature algorithm outside the checked set used to read `unexpected_algorithm`, and
+    `imprintMatches` was `null` for any `unexpected_algorithm` result from that check; it is now
+    `true` there;
+  - each reason now names one kind of fault, so a consumer can classify a token by `reason` alone;
+  - `verified` is unchanged: `true` only for a fully verified token chained to a pinned anchor. No
+    request is added.
+- **`KNOWN_TYPE_URIS` is exported.** The type URIs check #12 resolves `ok` (`content/analysis/v1` and
+  the sixteen attestation sub-types), frozen, so a check outside this package can compare them with the
+  specification's list.
+- **`RFC3161_FAIL_REASONS` is exported.** The thirteen reasons `verifyRfc3161Timestamp` can return,
+  as a frozen array; `Rfc3161FailReason` is now derived from it. It gains one member,
+  `chain_outside_validity`, so a consumer with an exhaustive `switch` or `Record` over it needs the
+  new case.
+
+## 0.10.0 — 2026-09-22
+
+Specification v0.1.9 (hub ADR-0029 and ADR-0030, anchored at `typedstandards#77`): a Producer Profile
+for deterministic tool output, a raw-bytes content rule, a content-profile check, and a self-certifying
+signer. **A minor bump** — new exports, and every type-level union below gains members, so a consumer
+with an exhaustive `switch` or `Record` over one of them needs the new cases.
+
+- **The `scripted-recomputation` Producer Profile (ADR-0029).** `PROFILE_CAPTURE_VOCAB` gains
+  `scripted-recomputation: ['script-run', 'tool-emitted']`, a second stand-in entry under hub Q32, and
+  `CaptureMethod` gains both values. Check #15 now resolves a `scripted-recomputation/<subtype>`
+  package's capture method instead of reporting `producerProfile_bundle_unresolved`. The two signed
+  ADR-0028 eval-run packages read `ok`.
+- **`raw-bytes/v1` (`RAW_BYTES_CANONICALIZATION`).** A third content-canonicalization rule, in
+  `KNOWN_CANONICALIZATION_RULES`: `contentHash` fingerprints the exact bytes of `output`.
+  - With inline `output`, check #4 hashes its UTF-8 bytes.
+  - With a BlobRef `output`, check #4 hashes the file's bytes obtained through the injected fetcher
+    (`verifyContentHashWithFetch`; `verifyRecord` runs it):
+    - `content_hash_mismatch` when they differ, or when `contentHash.sha256` differs from the hex of
+      `output.ref`;
+    - the new status `content_bytes_unavailable` when the bytes cannot be obtained. It is never `ok`
+      without hashing.
+  - `verifyContentHash` stays synchronous and I/O-free, with an optional `outputBytes` argument.
+- **Check #16, the content-profile label (`checkContentProfile`, `CONTENT_PROFILE_STATUSES`,
+  `KNOWN_CONTENT_PROFILES`).** Reads `metadata.contentProfile` and reports one of:
+  - `ok`;
+  - `contentProfile_absent` (read as `"default"`);
+  - `contentProfile_unknown`;
+  - `contentProfile_inconsistent` (compared with `producerProfile` only when both are present).
+
+  `VerifyResult` gains `contentProfile`.
+- **The self-certifying signer (ADR-0030).**
+  - **The identifier.** `deriveKeyDerivedIdentifier` derives `did:key:z…` from an Ed25519 SPKI
+    `publicKey`. `isKeyDerivedIdentifier` and `KEY_DERIVED_IDENTIFIER_PREFIX` recognize one.
+  - **Key trust.** `KEY_TRUST_STATUSES` gains `self_certified` (`verified: false`) for a
+    `pseudonymous` signer whose identifier matches its signing key.
+  - **Check #14.** It gains `key_derived_match` and `key_derived_mismatch` (fatal; the result carries
+    `claimed` and `derived`), and never reports `ok` under a key-derived identifier.
+    `checkSignerIdentity` takes an optional `publicKey`.
+  - **Registry provenance.** `VerifyDeps.registryProvenance` (`TRUST_REGISTRY_PROVENANCES`:
+    `'declared-url' | 'bundle'`; absent is treated as `'bundle'`) states where the caller's registry
+    came from.
+    - For a key-derived identifier, only a `'declared-url'` registry can raise the status.
+    - A bundle-carried registry contributes only `revoked` and `deprecated_invalid`.
+    - This holds at every tier, and under a mismatch too.
+  - **Base-58.** The encoder is written in place; there is no new runtime dependency.
+- **Signers whose identifier is not key-derived are unchanged.** Already-signed packages verify
+  exactly as before, apart from checks #15 and #16, which now resolve a `scripted-recomputation`
+  profile and report a content profile.
+
 ## 0.9.0 — 2026-08-19
 
 Vocabulary settlement (spec v0.1.5 Appendix J; registry Q50/Q66, ADR-0025,

package/dist/canonicalization.d.ts

@@ -1,5 +1,8 @@
 export declare const LEGACY_JSON_CANONICALIZATION = "https://typedstandards.org/canonicalization/legacy-json/v1";
 export declare const DATHERE_AG_JUPYTER_CANONICALIZATION = "https://typedstandards.org/canonicalization/dathere-ag-jupyter/v1";
+/** hub ADR-0029 §4: the SHA-256 of the bytes of the package's `output`, with no
+ *  normalization — the digest `sha256sum` prints for the file. */
+export declare const RAW_BYTES_CANONICALIZATION = "https://typedstandards.org/canonicalization/raw-bytes/v1";
 /** Canonicalization-rule URIs this implementation knows how to apply. An
  *  unknown URI fails verify check #3 (`unknown_canonicalization_rule`). */
 export declare const KNOWN_CANONICALIZATION_RULES: readonly string[];
@@ -43,5 +46,9 @@ export declare function computeEnvelopeHash(pkg: Record<string, unknown>): strin
  *     (and the sig envelope, which lives off-package here) omitted.
  *   - dathere-ag-jupyter/v1 → the executed notebook object
  *     (`extensions["org.civicaitools.notebook"]` and its rendered outputs).
+ *   - raw-bytes/v1          → the UTF-8 bytes of an inline string `output`.
+ *     An `output` that is not a string (a BlobRef, whose bytes live outside the
+ *     package) throws here: those bytes have to be obtained first, which is what
+ *     check #4's fetching path (`verifyContentHashWithFetch`) does.
  */
 export declare function computeContentHashSha256(pkg: Record<string, unknown>, rule: string): string;

package/dist/canonicalization.js

@@ -17,11 +17,15 @@ import { sha256Hex } from "./primitives.js";
 // targets — verifiers resolve them via the local registry below.
 export const LEGACY_JSON_CANONICALIZATION = 'https://typedstandards.org/canonicalization/legacy-json/v1';
 export const DATHERE_AG_JUPYTER_CANONICALIZATION = 'https://typedstandards.org/canonicalization/dathere-ag-jupyter/v1';
+/** hub ADR-0029 §4: the SHA-256 of the bytes of the package's `output`, with no
+ *  normalization — the digest `sha256sum` prints for the file. */
+export const RAW_BYTES_CANONICALIZATION = 'https://typedstandards.org/canonicalization/raw-bytes/v1';
 /** Canonicalization-rule URIs this implementation knows how to apply. An
  *  unknown URI fails verify check #3 (`unknown_canonicalization_rule`). */
 export const KNOWN_CANONICALIZATION_RULES = [
     LEGACY_JSON_CANONICALIZATION,
     DATHERE_AG_JUPYTER_CANONICALIZATION,
+    RAW_BYTES_CANONICALIZATION,
 ];
 /** Notebook extension whose object the dathere-ag-jupyter/v1 rule fingerprints
  *  (spec §8.2, §8.7.2). */
@@ -83,8 +87,19 @@ export function computeEnvelopeHash(pkg) {
  *     (and the sig envelope, which lives off-package here) omitted.
  *   - dathere-ag-jupyter/v1 → the executed notebook object
  *     (`extensions["org.civicaitools.notebook"]` and its rendered outputs).
+ *   - raw-bytes/v1          → the UTF-8 bytes of an inline string `output`.
+ *     An `output` that is not a string (a BlobRef, whose bytes live outside the
+ *     package) throws here: those bytes have to be obtained first, which is what
+ *     check #4's fetching path (`verifyContentHashWithFetch`) does.
  */
 export function computeContentHashSha256(pkg, rule) {
+    if (rule === RAW_BYTES_CANONICALIZATION) {
+        const output = pkg['output'];
+        if (typeof output !== 'string') {
+            throw new Error('raw-bytes/v1 content hash over a package alone requires an inline string output');
+        }
+        return sha256Hex(output);
+    }
     if (rule === DATHERE_AG_JUPYTER_CANONICALIZATION) {
         const extensions = pkg['extensions'];
         const notebook = extensions?.[NOTEBOOK_EXTENSION_KEY];

package/dist/checks.d.ts

@@ -25,7 +25,7 @@ export interface ContentCanonicalizationResolution {
  * legacy-json/v1).
  */
 export declare function resolveContentCanonicalization(pkg: Record<string, unknown>): ContentCanonicalizationResolution;
-export declare const CONTENT_HASH_STATUSES: readonly ["ok", "content_hash_mismatch", "contentHash_no_supported_algorithm", "unresolved_rule", "legacy_relabeled"];
+export declare const CONTENT_HASH_STATUSES: readonly ["ok", "content_hash_mismatch", "contentHash_no_supported_algorithm", "unresolved_rule", "legacy_relabeled", "content_bytes_unavailable"];
 export type ContentHashStatus = (typeof CONTENT_HASH_STATUSES)[number];
 export interface ContentHashCheck {
     status: ContentHashStatus;
@@ -55,8 +55,54 @@ export interface ContentHashCheck {
  * single-SHA-256 is RELABELED as `{ sha256: <hex> }` per §8.2 rather than
  * recomputed; its integrity is established by check #1, so check #4 reports
  * `legacy_relabeled`.
+ *
+ * raw-bytes/v1 with a BlobRef `output` (hub ADR-0029 §4): the fingerprinted
+ * bytes live outside the package. `outputBytes` are those bytes when the caller
+ * holds them.
+ *   - `contentHash.sha256` differs from the hex of `output.ref` →
+ *     `content_hash_mismatch`, decided from the package alone.
+ *   - no `outputBytes` → `content_bytes_unavailable`: the bytes were not
+ *     checked. Never `ok` without hashing.
+ *   - otherwise the SHA-256 of `outputBytes` is compared with
+ *     `contentHash.sha256` → `ok` / `content_hash_mismatch`.
+ * This function does no I/O; `verifyContentHashWithFetch` obtains the bytes
+ * through the injected fetcher and passes them here.
+ */
+export declare function verifyContentHash(pkg: Record<string, unknown>, resolution: ContentCanonicalizationResolution, legacyExternalHash?: string, outputBytes?: Uint8Array): ContentHashCheck;
+/**
+ * Check #4 with the raw-bytes/v1 BlobRef path wired to the injected fetcher
+ * (hub ADR-0029 §4). Identical to `verifyContentHash` for every other rule and
+ * shape. For a raw-bytes/v1 package whose `output` is a BlobRef, it obtains the
+ * file's bytes through `options.fetch` (an offline verifier supplies a local
+ * copy through that fetcher) and hashes them; bytes it cannot obtain leave the
+ * status at `content_bytes_unavailable`.
+ */
+export declare function verifyContentHashWithFetch(pkg: Record<string, unknown>, resolution: ContentCanonicalizationResolution, legacyExternalHash?: string, options?: BlobFetchOptions): Promise<ContentHashCheck>;
+/** The known `metadata.contentProfile` values (spec §8.1.2). */
+export declare const KNOWN_CONTENT_PROFILES: readonly string[];
+export declare const CONTENT_PROFILE_STATUSES: readonly ["ok", "contentProfile_absent", "contentProfile_unknown", "contentProfile_inconsistent"];
+export type ContentProfileStatus = (typeof CONTENT_PROFILE_STATUSES)[number];
+export interface ContentProfileCheck {
+    status: ContentProfileStatus;
+    /** `metadata.contentProfile` as carried, when it is a string. */
+    contentProfile?: string;
+    /** `producerProfile` as carried, when present. */
+    producerProfile?: string;
+}
+/**
+ * Check #16 — `metadata.contentProfile` (hub ADR-0029 §5).
+ *   - key absent → `contentProfile_absent` (read as `"default"`, spec §8.1.2).
+ *   - present and neither `"default"` nor `"datHere"` → `contentProfile_unknown`
+ *     (reported, not passed; consistency is not judged).
+ *   - present, known, `producerProfile` present, and the ADR-0006 §2 invariant
+ *     fails (`contentProfile === "datHere"` iff `producerProfile` starts with
+ *     `ai-assisted-analysis/datHere`) → `contentProfile_inconsistent`.
+ *   - otherwise → `ok`.
+ * The invariant is compared only when both fields are present. No status is an
+ * integrity failure: both labels are signature-covered.
  */
-export declare function verifyContentHash(pkg: Record<string, unknown>, resolution: ContentCanonicalizationResolution, legacyExternalHash?: string): ContentHashCheck;
+export declare function checkContentProfile(pkg: Record<string, unknown>): ContentProfileCheck;
+export declare const KNOWN_TYPE_URIS: readonly string[];
 export declare const TYPE_RESOLUTION_STATUSES: readonly ["ok", "implicit", "unknown_type"];
 export type TypeResolutionStatus = (typeof TYPE_RESOLUTION_STATUSES)[number];
 export interface TypeResolution {
@@ -70,7 +116,47 @@ export interface TypeResolution {
  * and renders as such — it does NOT fail verification.
  */
 export declare function resolvePackageType(pkg: Record<string, unknown>): TypeResolution;
-export declare const SIGNER_IDENTITY_CHECK_STATUSES: readonly ["ok", "signer_identity_mismatch", "no_signer", "no_registry_identity"];
+export declare const SIGNING_KEY_ID_CONSISTENCY_STATUSES: readonly ["ok", "signingKeyId_mismatch", "kid_absent", "signingKeyId_absent"];
+export type SigningKeyIdConsistencyStatus = (typeof SIGNING_KEY_ID_CONSISTENCY_STATUSES)[number];
+export interface SigningKeyIdConsistencyCheck {
+    status: SigningKeyIdConsistencyStatus;
+    /** On `signingKeyId_mismatch`: the signature envelope's `kid`. */
+    kid?: string;
+    /** On `signingKeyId_mismatch`: `metadata.signingKeyId` as carried, when it is
+     *  a string. */
+    signingKeyId?: string;
+}
+/**
+ * Check #6 — the signature envelope's `kid` against `metadata.signingKeyId`
+ * (spec §9.2 check #6, §8.3.1). The package's `signingKeyId` is inside the
+ * signed bytes and the envelope's `kid` is not, so a `kid` swapped on the
+ * envelope after signing leaves the signature valid; this comparison is what
+ * detects it.
+ *   - both present and equal → `ok`.
+ *   - both present and different → `signingKeyId_mismatch`, the one failing
+ *     status: §8.3.1 says `metadata.signingKeyId` MUST equal the envelope's
+ *     `kid`, and the spec reads a mismatch as envelope-vs-canonical drift. The
+ *     comparison is exact (no case or whitespace folding), and a present value
+ *     that is not a string is a mismatch.
+ *   - the envelope carries no `kid` → `kid_absent`: there is nothing to compare.
+ *     Under a key-derived `signer.identifier` (§8.5.1) `kid` is optional, and
+ *     legacy packages carry neither field; for a registry signer, check #5
+ *     carries the consequence of a missing `kid`.
+ *   - the envelope carries a `kid` and the package no `metadata.signingKeyId`
+ *     → `signingKeyId_absent`: the `kid` is bound by nothing signed, so the
+ *     check cannot confirm it. The package does not meet §8.3.1, which requires
+ *     the field; that is not evidence the envelope was changed.
+ * `undefined`, `null` and `''` count as absent on either side. Only a mismatch
+ * carries the two values, which are then the finding; otherwise they are
+ * `VerifyResult.kid` and the package's own field.
+ *
+ * `signer.identifier` is not read. Under a key-derived identifier the `kid`
+ * SHOULD be the identifier string (§8.3.1); that is not a condition of this
+ * check, and for a registry signer `kid` and `signer.identifier` differ by
+ * design. The identity cross-check is check #14's.
+ */
+export declare function checkSigningKeyIdConsistency(pkg: Record<string, unknown>, kid: string | undefined): SigningKeyIdConsistencyCheck;
+export declare const SIGNER_IDENTITY_CHECK_STATUSES: readonly ["ok", "signer_identity_mismatch", "no_signer", "no_registry_identity", "key_derived_match", "key_derived_mismatch"];
 export type SignerIdentityCheckStatus = (typeof SIGNER_IDENTITY_CHECK_STATUSES)[number];
 export interface SignerIdentityCheck {
     status: SignerIdentityCheckStatus;
@@ -78,6 +164,10 @@ export interface SignerIdentityCheck {
     claimed?: string;
     /** The identifier the registry records for the signing `kid`, when present. */
     registered?: string;
+    /** The identifier derived from the envelope's `publicKey`, under a
+     *  key-derived `signer.identifier` (hub ADR-0030 §2). Absent on a
+     *  `key_derived_mismatch` whose key could not be decoded. */
+    derived?: string;
 }
 /**
  * Check #14 — `signer.identifier` ↔ trust-registry `signerIdentity` cross-check
@@ -86,8 +176,25 @@ export interface SignerIdentityCheck {
  * verifier derives the signer from the registry and skips the cross-check. A
  * registry entry without a `signerIdentity` (legacy registry) yields
  * `no_registry_identity`.
+ *
+ * A key-derived `signer.identifier` (one beginning `did:key:`, hub ADR-0030 §3)
+ * is checked against the envelope's `publicKey` instead, whatever the
+ * `bindingTier` and whatever the registry's source:
+ *   - the identifier derived from `publicKey` differs → `key_derived_mismatch`,
+ *     fatal, carrying `claimed` and `derived`;
+ *   - it matches, and a registry entry for the `kid` records a different
+ *     identifier → `signer_identity_mismatch`, fatal (a contradiction only
+ *     lowers, so any registry may report it);
+ *   - it matches otherwise → `key_derived_match`.
+ * `ok` ("matches the registry") is never reported under a key-derived
+ * identifier. Without `publicKey` the derivation cannot run; the registry
+ * cross-check runs as for any signer, except that its `ok` reads
+ * `no_registry_identity`, since nothing established the identifier.
  */
-export declare function checkSignerIdentity(pkg: Record<string, unknown>, kid: string | undefined, registry: TrustRegistry | undefined): SignerIdentityCheck;
+export declare function checkSignerIdentity(pkg: Record<string, unknown>, kid: string | undefined, registry: TrustRegistry | undefined, 
+/** The signature envelope's base64 SPKI `publicKey`. Read only when the
+ *  signer's identifier is key-derived. */
+publicKey?: string): SignerIdentityCheck;
 export declare const CAPTURE_METHOD_VOCAB_STATUSES: readonly ["ok", "captureMethod_unknown", "producerProfile_bundle_unresolved", "no_capture_method"];
 export type CaptureMethodVocabStatus = (typeof CAPTURE_METHOD_VOCAB_STATUSES)[number];
 export interface CaptureMethodVocabCheck {

package/dist/checks.js

@@ -1,14 +1,17 @@
 // Content-canonicalization, content-hash, and typed-standards envelope checks
-// (spec §9.2 checks #3, #4, #12, #13, #14, #15) + the package-level blob-ref
-// walker (#9) — browser-safe.
+// (spec §9.2 checks #3, #4, #6, #12, #13, #14, #15, #16) + the package-level
+// blob-ref walker (#9) — browser-safe.
 //
 // Factored verbatim from the server `verify.ts` (WS2); these functions were
 // already pure JS over the package object. The only environmental change is the
 // blob-ref walker now threads an injected fetcher. Each check degrades gracefully
 // for pre-v0.1 packages that omit the corresponding field.
-import { computeEnvelopeHash, computeContentHashSha256, isMultihashContentHash, KNOWN_CANONICALIZATION_RULES, LEGACY_JSON_CANONICALIZATION, DATHERE_AG_JUPYTER_CANONICALIZATION, } from "./canonicalization.js";
+import { computeEnvelopeHash, computeContentHashSha256, isMultihashContentHash, KNOWN_CANONICALIZATION_RULES, LEGACY_JSON_CANONICALIZATION, DATHERE_AG_JUPYTER_CANONICALIZATION, RAW_BYTES_CANONICALIZATION, } from "./canonicalization.js";
+import { sha256Hex } from "./primitives.js";
 import { captureVocabForProfile, resolveProfileType } from "./profiles.js";
-import { isBlobRef, verifyBlobRef, } from "./blob-ref.js";
+import { isBlobRef, parseBlobRef, verifyBlobRef, } from "./blob-ref.js";
+import { isKeyDerivedIdentifier } from "./did-key.js";
+import { compareKeyDerivedIdentifier } from "./self-certifying.js";
 /**
  * Recompute a package's envelope hash, routed by the §8.2 detection rule: v0.1
  * packages (multihash `contentHash` present) hash via RFC 8785 JCS; pre-v0.1
@@ -65,6 +68,7 @@ export const CONTENT_HASH_STATUSES = [
     'contentHash_no_supported_algorithm',
     'unresolved_rule',
     'legacy_relabeled',
+    'content_bytes_unavailable',
 ];
 /** Multihash algorithms this verifier can recompute today (spec §8.2 lists
  *  sha256 required + sha3-256 / blake3 as registered alternates). */
@@ -86,8 +90,20 @@ const SUPPORTED_CONTENT_HASH_ALGORITHMS = ['sha256'];
  * single-SHA-256 is RELABELED as `{ sha256: <hex> }` per §8.2 rather than
  * recomputed; its integrity is established by check #1, so check #4 reports
  * `legacy_relabeled`.
+ *
+ * raw-bytes/v1 with a BlobRef `output` (hub ADR-0029 §4): the fingerprinted
+ * bytes live outside the package. `outputBytes` are those bytes when the caller
+ * holds them.
+ *   - `contentHash.sha256` differs from the hex of `output.ref` →
+ *     `content_hash_mismatch`, decided from the package alone.
+ *   - no `outputBytes` → `content_bytes_unavailable`: the bytes were not
+ *     checked. Never `ok` without hashing.
+ *   - otherwise the SHA-256 of `outputBytes` is compared with
+ *     `contentHash.sha256` → `ok` / `content_hash_mismatch`.
+ * This function does no I/O; `verifyContentHashWithFetch` obtains the bytes
+ * through the injected fetcher and passes them here.
  */
-export function verifyContentHash(pkg, resolution, legacyExternalHash) {
+export function verifyContentHash(pkg, resolution, legacyExternalHash, outputBytes) {
     const contentHash = pkg['contentHash'];
     if (!isMultihashContentHash(contentHash)) {
         return {
@@ -107,6 +123,21 @@ export function verifyContentHash(pkg, resolution, legacyExternalHash) {
             contentHash,
         };
     }
+    const output = pkg['output'];
+    if (resolution.rule === RAW_BYTES_CANONICALIZATION && isBlobRef(output)) {
+        // sha256 is the only supported algorithm, so `checkable` is ['sha256'] here.
+        const signed = contentHash['sha256'];
+        if (signed !== parseBlobRef(output.ref).hash) {
+            // No file can hash to two different signed digests.
+            return { status: 'content_hash_mismatch', algorithms, contentHash };
+        }
+        if (outputBytes === undefined) {
+            return { status: 'content_bytes_unavailable', algorithms, contentHash };
+        }
+        return sha256Hex(outputBytes) === signed
+            ? { status: 'ok', algorithms, matched: 'sha256', contentHash }
+            : { status: 'content_hash_mismatch', algorithms, contentHash };
+    }
     for (const algo of checkable) {
         let recomputed;
         try {
@@ -130,16 +161,102 @@ export function verifyContentHash(pkg, resolution, legacyExternalHash) {
     }
     return { status: 'content_hash_mismatch', algorithms, contentHash };
 }
+/** Fetch a BlobRef's bytes through the injected fetcher (defaulting to
+ *  `globalThis.fetch`, the same default check #9 uses). `undefined` on any
+ *  failure. */
+async function fetchBlobRefBytes(ref, options) {
+    try {
+        const fetcher = options.fetch ?? globalThis.fetch;
+        const response = await fetcher(ref.url, {
+            signal: options.signal ?? AbortSignal.timeout(15_000),
+        });
+        if (!response.ok)
+            return undefined;
+        return new Uint8Array(await response.arrayBuffer());
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Check #4 with the raw-bytes/v1 BlobRef path wired to the injected fetcher
+ * (hub ADR-0029 §4). Identical to `verifyContentHash` for every other rule and
+ * shape. For a raw-bytes/v1 package whose `output` is a BlobRef, it obtains the
+ * file's bytes through `options.fetch` (an offline verifier supplies a local
+ * copy through that fetcher) and hashes them; bytes it cannot obtain leave the
+ * status at `content_bytes_unavailable`.
+ */
+export async function verifyContentHashWithFetch(pkg, resolution, legacyExternalHash, options = {}) {
+    const first = verifyContentHash(pkg, resolution, legacyExternalHash);
+    const output = pkg['output'];
+    if (first.status !== 'content_bytes_unavailable' || !isBlobRef(output)) {
+        return first;
+    }
+    const bytes = await fetchBlobRefBytes(output, options);
+    if (bytes === undefined)
+        return first;
+    return verifyContentHash(pkg, resolution, legacyExternalHash, bytes);
+}
+// --- Content-profile check (spec §9.2 check #16; hub ADR-0029 §5) ---
+/** The known `metadata.contentProfile` values (spec §8.1.2). */
+export const KNOWN_CONTENT_PROFILES = ['default', 'datHere'];
+export const CONTENT_PROFILE_STATUSES = [
+    'ok',
+    'contentProfile_absent',
+    'contentProfile_unknown',
+    'contentProfile_inconsistent',
+];
+/**
+ * Check #16 — `metadata.contentProfile` (hub ADR-0029 §5).
+ *   - key absent → `contentProfile_absent` (read as `"default"`, spec §8.1.2).
+ *   - present and neither `"default"` nor `"datHere"` → `contentProfile_unknown`
+ *     (reported, not passed; consistency is not judged).
+ *   - present, known, `producerProfile` present, and the ADR-0006 §2 invariant
+ *     fails (`contentProfile === "datHere"` iff `producerProfile` starts with
+ *     `ai-assisted-analysis/datHere`) → `contentProfile_inconsistent`.
+ *   - otherwise → `ok`.
+ * The invariant is compared only when both fields are present. No status is an
+ * integrity failure: both labels are signature-covered.
+ */
+export function checkContentProfile(pkg) {
+    const metadata = pkg['metadata'];
+    const raw = typeof metadata === 'object' && metadata !== null && !Array.isArray(metadata)
+        ? metadata['contentProfile']
+        : undefined;
+    const producerProfile = typeof pkg['producerProfile'] === 'string' ? pkg['producerProfile'] : undefined;
+    const base = {
+        ...(typeof raw === 'string' ? { contentProfile: raw } : {}),
+        ...(producerProfile !== undefined ? { producerProfile } : {}),
+    };
+    if (raw === undefined) {
+        return { status: 'contentProfile_absent', ...base };
+    }
+    if (typeof raw !== 'string' || !KNOWN_CONTENT_PROFILES.includes(raw)) {
+        return { status: 'contentProfile_unknown', ...base };
+    }
+    if (producerProfile !== undefined) {
+        const isDatHere = raw === 'datHere';
+        const profileIsDatHere = producerProfile.startsWith('ai-assisted-analysis/datHere');
+        if (isDatHere !== profileIsDatHere) {
+            return { status: 'contentProfile_inconsistent', ...base };
+        }
+    }
+    return { status: 'ok', ...base };
+}
 // --- Typed-standards envelope checks (spec §9.2 checks #12, #14, #15) ---
 // v0.1 ratified node type URIs (spec §8.12.1). Recognized so check #12 resolves
 // them; only `content/analysis/v1` (+ the lifecycle sub-types) are operationalized
 // today, but the full ratified set is registered so conformant packages don't
-// render as `unknown_type`.
-const KNOWN_TYPE_URIS = [
+// render as `unknown_type`. The sixteen attestation sub-types are in the order
+// of the §8.12.1 table; `type-resolution.test.ts` holds that table's copy.
+// Exported and frozen so a check outside this package can compare the registered
+// set with the specification's list without being able to change it.
+export const KNOWN_TYPE_URIS = Object.freeze([
     'content/analysis/v1',
     'attestation/withdraws/v1',
     'attestation/reinstates/v1',
     'attestation/supersedes/v1',
+    'attestation/revises/v1',
     'attestation/publishes/v1',
     'attestation/locatedAt/v1',
     'attestation/corroborates/v1',
@@ -152,7 +269,7 @@ const KNOWN_TYPE_URIS = [
     'attestation/certifies/v1',
     'attestation/evaluates/v1',
     'attestation/conforms/v1',
-];
+]);
 export const TYPE_RESOLUTION_STATUSES = ['ok', 'implicit', 'unknown_type'];
 /**
  * Check #12 — `type` resolution. An absent field resolves to the implicit
@@ -169,11 +286,70 @@ export function resolvePackageType(pkg) {
     }
     return { status: 'unknown_type', type: raw };
 }
+// --- Envelope kid ↔ metadata.signingKeyId (spec §9.2 check #6) ---
+export const SIGNING_KEY_ID_CONSISTENCY_STATUSES = [
+    'ok',
+    'signingKeyId_mismatch',
+    'kid_absent',
+    'signingKeyId_absent',
+];
+const isAbsent = (v) => v === undefined || v === null || v === '';
+/**
+ * Check #6 — the signature envelope's `kid` against `metadata.signingKeyId`
+ * (spec §9.2 check #6, §8.3.1). The package's `signingKeyId` is inside the
+ * signed bytes and the envelope's `kid` is not, so a `kid` swapped on the
+ * envelope after signing leaves the signature valid; this comparison is what
+ * detects it.
+ *   - both present and equal → `ok`.
+ *   - both present and different → `signingKeyId_mismatch`, the one failing
+ *     status: §8.3.1 says `metadata.signingKeyId` MUST equal the envelope's
+ *     `kid`, and the spec reads a mismatch as envelope-vs-canonical drift. The
+ *     comparison is exact (no case or whitespace folding), and a present value
+ *     that is not a string is a mismatch.
+ *   - the envelope carries no `kid` → `kid_absent`: there is nothing to compare.
+ *     Under a key-derived `signer.identifier` (§8.5.1) `kid` is optional, and
+ *     legacy packages carry neither field; for a registry signer, check #5
+ *     carries the consequence of a missing `kid`.
+ *   - the envelope carries a `kid` and the package no `metadata.signingKeyId`
+ *     → `signingKeyId_absent`: the `kid` is bound by nothing signed, so the
+ *     check cannot confirm it. The package does not meet §8.3.1, which requires
+ *     the field; that is not evidence the envelope was changed.
+ * `undefined`, `null` and `''` count as absent on either side. Only a mismatch
+ * carries the two values, which are then the finding; otherwise they are
+ * `VerifyResult.kid` and the package's own field.
+ *
+ * `signer.identifier` is not read. Under a key-derived identifier the `kid`
+ * SHOULD be the identifier string (§8.3.1); that is not a condition of this
+ * check, and for a registry signer `kid` and `signer.identifier` differ by
+ * design. The identity cross-check is check #14's.
+ */
+export function checkSigningKeyIdConsistency(pkg, kid) {
+    const metadata = pkg['metadata'];
+    const signingKeyId = typeof metadata === 'object' && metadata !== null && !Array.isArray(metadata)
+        ? metadata['signingKeyId']
+        : undefined;
+    if (kid === undefined || isAbsent(kid)) {
+        return { status: 'kid_absent' };
+    }
+    if (isAbsent(signingKeyId)) {
+        return { status: 'signingKeyId_absent' };
+    }
+    if (signingKeyId === kid) {
+        return { status: 'ok' };
+    }
+    return {
+        status: 'signingKeyId_mismatch',
+        kid,
+        ...(typeof signingKeyId === 'string' ? { signingKeyId } : {}),
+    };
+}
 export const SIGNER_IDENTITY_CHECK_STATUSES = [
     'ok',
     'signer_identity_mismatch',
     'no_signer',
     'no_registry_identity',
+    'key_derived_match',
+    'key_derived_mismatch',
 ];
 /**
  * Check #14 — `signer.identifier` ↔ trust-registry `signerIdentity` cross-check
@@ -182,14 +358,53 @@ export const SIGNER_IDENTITY_CHECK_STATUSES = [
  * verifier derives the signer from the registry and skips the cross-check. A
  * registry entry without a `signerIdentity` (legacy registry) yields
  * `no_registry_identity`.
+ *
+ * A key-derived `signer.identifier` (one beginning `did:key:`, hub ADR-0030 §3)
+ * is checked against the envelope's `publicKey` instead, whatever the
+ * `bindingTier` and whatever the registry's source:
+ *   - the identifier derived from `publicKey` differs → `key_derived_mismatch`,
+ *     fatal, carrying `claimed` and `derived`;
+ *   - it matches, and a registry entry for the `kid` records a different
+ *     identifier → `signer_identity_mismatch`, fatal (a contradiction only
+ *     lowers, so any registry may report it);
+ *   - it matches otherwise → `key_derived_match`.
+ * `ok` ("matches the registry") is never reported under a key-derived
+ * identifier. Without `publicKey` the derivation cannot run; the registry
+ * cross-check runs as for any signer, except that its `ok` reads
+ * `no_registry_identity`, since nothing established the identifier.
  */
-export function checkSignerIdentity(pkg, kid, registry) {
+export function checkSignerIdentity(pkg, kid, registry, 
+/** The signature envelope's base64 SPKI `publicKey`. Read only when the
+ *  signer's identifier is key-derived. */
+publicKey) {
     const signer = pkg['signer'];
     if (!signer || typeof signer !== 'object' || typeof signer.identifier !== 'string') {
         return { status: 'no_signer' };
     }
     const entry = kid && registry ? registry.keys.find((k) => k.kid === kid) : undefined;
     const registered = entry?.signerIdentity?.identifier;
+    if (isKeyDerivedIdentifier(signer.identifier)) {
+        const comparison = compareKeyDerivedIdentifier(signer, publicKey);
+        if (comparison && !comparison.match) {
+            return {
+                status: 'key_derived_mismatch',
+                claimed: comparison.claimed,
+                ...(comparison.derived !== undefined ? { derived: comparison.derived } : {}),
+            };
+        }
+        if (registered && registered !== signer.identifier) {
+            return { status: 'signer_identity_mismatch', claimed: signer.identifier, registered };
+        }
+        if (comparison) {
+            return {
+                status: 'key_derived_match',
+                claimed: signer.identifier,
+                derived: comparison.derived,
+                ...(registered ? { registered } : {}),
+            };
+        }
+        return { status: 'no_registry_identity', claimed: signer.identifier };
+    }
     if (!registered) {
         return { status: 'no_registry_identity', claimed: signer.identifier };
     }