attenu-guard 0.13.1 → 0.13.2

package/dist/esm/evidence.js

@@ -32,10 +32,10 @@
  */
 import { canonicalBytes, compareCodePoints, intOr, integral, parseJson, pyNumber, RawNumber, sortedStrings, toPlain, } from "./canonical.js";
 import { createHash } from "node:crypto";
-import { AuditLog, SCHEMA_VERSION, chainIdOf, hashEntry, GENESIS } from "./audit.js";
+import { AuditLog, SCHEMA_VERSION, chainIdOf, hashEntry, isLedgerObject, GENESIS, } from "./audit.js";
 import { Authority } from "./authority.js";
-import { describeInFinding, sameType, wireKeyOf } from "./ceilings.js";
-import { pyRepr, pyStr, pyStrRepr, shown } from "./display.js";
+import { describeInFinding, jsonKind, sameType, wireKeyOf } from "./ceilings.js";
+import { escaped, pyRepr, pyStr, pyStrRepr, shown } from "./display.js";
 import { CAPTURES, BODY_STATES, POLICIES, BodyState, Capture } from "./reasons.js";
 import { PARAMS_HASH_REASONS } from "./params.js";
 import { Ed25519Signer, Ed25519Verifier } from "./wire.js";
@@ -100,6 +100,26 @@ export const LEDGER_FIELDS = new Set([
     "receipt",
     "pending_at_kill",
 ]);
+/**
+ * The COMPLETE set of ledger event names, closed: the `event` enum of
+ * `schema/agent-audit.schema.json` (in the Python distribution). Every check in `verifyBundle`
+ * reads an entry by its event, so an entry whose event none of them reads was skipped by all of
+ * them: a `done` renamed `frobnicate` verified, and an `allow` renamed left containment without a
+ * word. `verifyBundle` reports such an entry as `unknown_ledger_event`. The Python implementation's
+ * `evidence.LEDGER_EVENTS`, name for name.
+ */
+export const LEDGER_EVENTS = new Set([
+    "root",
+    "spawn",
+    "spawn_denied",
+    "allow",
+    "deny",
+    "kill",
+    "done",
+    "outcome",
+]);
+/** `outcome` is v2-only (0.9.0, execution binding): a schemaVersion 1 chain has the other seven. */
+export const LEDGER_EVENTS_V1 = new Set([...LEDGER_EVENTS].filter((event) => event !== "outcome"));
 /**
  * Thrown by `exportBundle({strict: true})` when a bundle would carry a field or
  * context key outside the allow-list — potential customer data the custody
@@ -146,27 +166,60 @@ function redactTask(t) {
 export function redactionReport(entries, contextAllowlist) {
     const allow = contextAllowlist === undefined || contextAllowlist === null ? null : new Set(contextAllowlist);
     const violations = [];
-    entries.forEach((e, i) => {
+    // What it cannot read is a violation, never a throw, and never read by projection (a string's
+    // characters as fields). The Python implementation's same rule and shapes.
+    if (!Array.isArray(entries)) {
+        return { ok: false, violations: [{ event_index: null, event: null, entries: jsonKind(entries) }] };
+    }
+    for (let i = 0; i < entries.length; i++) {
+        const e = entries[i];
+        if (!isLedgerObject(e)) {
+            violations.push({ event_index: i, event: null, entry: jsonKind(e) });
+            continue;
+        }
         for (const f of Object.keys(e)) {
             if (!LEDGER_FIELDS.has(f)) {
-                violations.push({ event_index: i, event: toPlain(e["event"]), field: f });
+                violations.push({ event_index: i, event: orNull(e["event"]), field: f });
             }
         }
         if (allow !== null) {
-            const ctx = (e["context"] ?? {});
-            if (ctx !== null && typeof ctx === "object" && !Array.isArray(ctx)) {
-                for (const k of Object.keys(ctx)) {
-                    if (!allow.has(k)) {
-                        violations.push({ event_index: i, event: toPlain(e["event"]), context_key: k });
-                    }
+            // A context Python counts as false (null, "", 0, false, [] or {}) is no context, as
+            // `verifyBundle` reads it; any other context that is not an object is a violation.
+            const raw = e["context"];
+            if (pyFalsy(toPlain(raw)))
+                continue;
+            if (!isLedgerObject(raw)) {
+                violations.push({ event_index: i, event: orNull(e["event"]), context: jsonKind(raw) });
+                continue;
+            }
+            for (const k of Object.keys(raw)) {
+                if (!allow.has(k)) {
+                    violations.push({ event_index: i, event: orNull(e["event"]), context_key: k });
                 }
             }
         }
-    });
+    }
     return { ok: violations.length === 0, violations };
 }
+/**
+ * `entries` as the functions that SIGN them take them: an array of JSON objects. These produce
+ * evidence rather than read it, so anything else is refused by name, with a TypeError, before
+ * anything is signed over it. Before, a TypeError in the runtime's own words, or a signature over
+ * whatever was read. The Python implementation's `export_bundle` takes an `AuditLog`, so it has no
+ * such input to refuse.
+ */
+function signable(entries) {
+    if (!Array.isArray(entries))
+        throw new TypeError(`entries is ${jsonKind(entries)}, not an array`);
+    for (let i = 0; i < entries.length; i++) {
+        if (!isLedgerObject(entries[i]))
+            throw new TypeError(`entries[${i}] is ${jsonKind(entries[i])}, not an object`);
+    }
+    return entries;
+}
 /** A signed commitment to the head of `entries` — mirrors `AuditLog.anchor`. */
-export function anchorFor(entries, signer, ts = 0) {
+export function anchorFor(given, signer, ts = 0) {
+    const entries = signable(given);
     let seq;
     let head;
     if (entries.length === 0) {
@@ -204,7 +257,7 @@ export function exportBundle(auditLog, signer, options = {}) {
         throw new Error("sign envelopes over the redacted ledger: export with redact_task=True first, then " +
             "sign_envelope over the exported entries");
     }
-    const source = auditLog instanceof AuditLog ? auditLog.entries : auditLog;
+    const source = signable(auditLog instanceof AuditLog ? auditLog.entries : auditLog);
     const entries = source.map((e) => ({ ...e }));
     if (options.redactTask) {
         for (const e of entries) {
@@ -353,6 +406,45 @@ function monotonicityDetail(child, parent) {
     // it exists so that such a dimension cannot fail SILENTLY.
     return "child not narrower than parent";
 }
+/**
+ * Why `value`, a root's `authority` or a spawn's `granted`, cannot be read as an authority by the
+ * type of one of its members, or null. The object itself is an object; `scopes` and `constraints`,
+ * when present, arrays, and a scope a string; `ttl`, when present and not null, a finite number.
+ * `Authority.fromWire` reports the rest, as before: a member it does not read, a scope outside the
+ * grammar, a constraint of the wrong shape.
+ *
+ * `fromWire` read a `ttl` that was not a number as unbounded, so a root `ttl: "x"` verified, and a
+ * null `scopes` or `constraints` as empty; the Python implementation raised on the first and on
+ * the null ones. The Python implementation's `_authority_wire_error`, message for message.
+ */
+function authorityWireError(value, member) {
+    if (!isLedgerObject(value))
+        return `${member} is ${jsonKind(value)}, not an object`;
+    if (Object.keys(value).some((k) => k !== "scopes" && k !== "constraints" && k !== "ttl")) {
+        return null; // fromWire names the members it does not read
+    }
+    if (Object.hasOwn(value, "scopes")) {
+        const scopes = value["scopes"];
+        if (!Array.isArray(scopes))
+            return `scopes is ${jsonKind(scopes)}, not an array`;
+        for (const scope of scopes) {
+            if (typeof scope !== "string")
+                return `a scope is ${jsonKind(scope)}, not a string`;
+        }
+    }
+    if (Object.hasOwn(value, "constraints") && !Array.isArray(value["constraints"])) {
+        return `constraints is ${jsonKind(value["constraints"])}, not an array`;
+    }
+    const ttl = value["ttl"];
+    if (ttl !== undefined && ttl !== null) {
+        const plain = toPlain(ttl);
+        if (typeof plain !== "number")
+            return `ttl is ${jsonKind(ttl)}, not a number`;
+        if (!Number.isFinite(plain))
+            return "ttl is not a finite number";
+    }
+    return null;
+}
 /**
  * `node -> Authority` and `node -> parent`, reconstructed from `root` and `spawn` events in ledger
  * order. No engine state.
@@ -391,6 +483,9 @@ function nodeAuthorities(entries) {
         definedBy.set(node, e);
         if (ev === "root") {
             try {
+                const wrong = authorityWireError(e["authority"] ?? null, "authority");
+                if (wrong !== null)
+                    throw new Error(wrong);
                 auth.set(node, Authority.fromWire(e["authority"] ?? null));
             }
             catch (exc) {
@@ -400,6 +495,9 @@ function nodeAuthorities(entries) {
         else {
             parent.set(node, orNull(e["parent"]));
             try {
+                const wrong = authorityWireError(e["granted"] ?? null, "granted");
+                if (wrong !== null)
+                    throw new Error(wrong);
                 auth.set(node, Authority.fromWire(e["granted"] ?? null));
             }
             catch (exc) {
@@ -429,7 +527,10 @@ function noteRevoked(entry, revokedAt) {
  * renders. Derived from the ledger alone.
  */
 export function delegationGraph(bundle) {
-    const entries = bundle.entries ?? [];
+    // A view, not a verdict: it shows what it can read and throws on nothing. A bundle, or entries,
+    // it cannot read is an empty graph, and an entry that is not a JSON object names no node;
+    // `verifyBundle` is what reports either.
+    const entries = readableEntries(bundle);
     const { auth, parent } = nodeAuthorities(entries);
     const meta = {};
     for (const e of entries) {
@@ -459,9 +560,14 @@ export function delegationGraph(bundle) {
         }
         else if (ev === "deny" && Object.hasOwn(meta, n)) {
             meta[n].denies += 1;
-            // A deny without a disposition is named by its reason.
-            const d = (toPlain(e["disposition"]) ?? toPlain(e["reason"]) ?? "unstated");
-            meta[n].denials_by_disposition[d] = (meta[n].denials_by_disposition[d] ?? 0) + 1;
+            // A deny without a disposition is named by its reason, read as Python reads
+            // `disposition or reason`: an empty disposition (null, "", 0, false, [] or {}) names none.
+            // A key is a string; a value of another kind is filed by its printed form.
+            const disposition = toPlain(e["disposition"]);
+            const reason = toPlain(e["reason"]);
+            const picked = !pyFalsy(disposition) ? e["disposition"] : !pyFalsy(reason) ? e["reason"] : "unstated";
+            const d = typeof toPlain(picked) === "string" ? toPlain(picked) : shown(picked);
+            setOwn(meta[n].denials_by_disposition, d, (Object.hasOwn(meta[n].denials_by_disposition, d) ? meta[n].denials_by_disposition[d] : 0) + 1);
         }
         else if (ev === "done" && Object.hasOwn(meta, n)) {
             meta[n].complete = true;
@@ -480,7 +586,7 @@ export function delegationGraph(bundle) {
         if (typeof p === "string" && p !== "")
             edges.push({ parent: p, child });
     }
-    return { chain_id: orNull(bundle.chain_id), nodes: meta, edges };
+    return { chain_id: isLedgerObject(bundle) ? orNull(bundle["chain_id"]) : null, nodes: meta, edges };
 }
 /**
  * Every refusal on the ledger, grouped by (node, tool, scope, disposition, requested) — the rows
@@ -497,12 +603,16 @@ export function delegationGraph(bundle) {
  * larger event of the two.
  */
 export function denials(bundle) {
-    const entries = bundle.entries ?? [];
+    // A view, not a verdict, like `delegationGraph`: a bundle, or entries, it cannot read has no
+    // rows, an entry that is not a JSON object is no refusal, and it throws on nothing.
+    const entries = readableEntries(bundle);
     const agentOf = new Map();
     for (const e of entries) {
         const ev = toPlain(e["event"]);
-        if (ev === "root" || ev === "spawn") {
-            agentOf.set(toPlain(e["node"]), orNull(e["agent"]));
+        const node = toPlain(e["node"]);
+        // A node id is a string; anything else names no node.
+        if ((ev === "root" || ev === "spawn") && typeof node === "string") {
+            agentOf.set(node, orNull(e["agent"]));
         }
     }
     const rows = new Map();
@@ -514,19 +624,22 @@ export function denials(bundle) {
         // what was refused), so it is folded onto the node that asked.
         const node = ev === "spawn_denied" ? orNull(e["parent"]) : orNull(e["node"]);
         const requested = ev === "spawn_denied" ? orNull(e["agent"]) : null;
-        const key = JSON.stringify([
-            node,
-            orNull(e["tool"]),
-            orNull(e["scope"]),
-            orNull(e["disposition"]),
-            requested,
+        // Grouped by the escaped JSON text of the five values, as the Python implementation groups
+        // them, which tells `true` from 1 and 1.0 from 1 as written.
+        const asWritten = (v) => (v === undefined ? null : v);
+        const key = escaped([
+            asWritten(ev === "spawn_denied" ? e["parent"] : e["node"]),
+            asWritten(e["tool"]),
+            asWritten(e["scope"]),
+            asWritten(e["disposition"]),
+            ev === "spawn_denied" ? asWritten(e["agent"]) : null,
         ]);
-        const seq = toPlain(e["seq"]);
+        const seq = orNull(e["seq"]);
         const existing = rows.get(key);
         if (existing === undefined) {
             rows.set(key, {
                 node,
-                agent: agentOf.get(node) ?? null,
+                agent: typeof node === "string" ? (agentOf.get(node) ?? null) : null,
                 tool: orNull(e["tool"]),
                 scope: orNull(e["scope"]),
                 disposition: orNull(e["disposition"]),
@@ -543,7 +656,9 @@ export function denials(bundle) {
             existing.last_seq = seq;
         }
     }
-    return Array.from(rows.values()).sort((a, b) => a.first_seq - b.first_seq);
+    // In the order each row first occurs. Sorting by `first_seq` said the same on a well-formed
+    // ledger, and ordered a seq that is not a number by NaN.
+    return Array.from(rows.values());
 }
 // `pyRepr` and `pyStr` (display.ts) are Python's `repr` and `str` for the values these failure
 // messages carry. Both implementations report the same failure bytes, so the distinction between
@@ -630,6 +745,10 @@ export const ENVELOPE_FAILURES = [
  * implementation, not a second one for envelopes.
  */
 export function envelopeSigningInput(envelope) {
+    // An envelope that is not a JSON object has no members to sign. The Python implementation raises
+    // ValueError with the same words.
+    if (!isLedgerObject(envelope))
+        throw new Error(`an envelope is ${jsonKind(envelope)}, not an object`);
     const body = {};
     for (const [k, v] of Object.entries(envelope))
         if (k !== "sig")
@@ -643,7 +762,12 @@ export function envelopeSigningInput(envelope) {
  * envelope finds the entry it covers through `subjectIndex`.
  */
 export function stateKey(e, index) {
-    return String("seq" in e ? orNull(intOr(e["seq"])) : index);
+    // An entry that is not a JSON object has no seq member, so it is filed by its index; a seq that
+    // is a list or an object by its escaped JSON text, as the Python implementation files it.
+    if (!isLedgerObject(e) || !("seq" in e))
+        return String(index);
+    const seq = orNull(intOr(e["seq"]));
+    return seq !== null && typeof seq === "object" ? escaped(seq) : String(seq);
 }
 /**
  * Each entry's hash RECOMPUTED from the bundle, by index, never read off the entry.
@@ -790,14 +914,20 @@ function compareVersions(a, b) {
  * verifier will check it against. Throws when `seq` names no entry, or names one whose `event` v1
  * defines no subject for.
  */
-export function envelopeSubject(entries, seq) {
+export function envelopeSubject(given, seq) {
+    // `entries` that are not an array are refused, and an entry that is not a JSON object is read as
+    // one with no members, as the verifier reads it. The Python implementation's ValueError, worded
+    // the same.
+    if (!Array.isArray(given))
+        throw new Error(`entries is ${jsonKind(given)}, not an array`);
+    const entries = Array.from(given, (e) => (isLedgerObject(e) ? e : {}));
     const n = integral(seq);
     const at = n === null ? undefined : subjectIndex(entries).get(n);
     if (n === null || at === undefined)
         throw new Error(`no entry at seq ${seq}`);
     const entry = entries[at];
     const event = toPlain(entry["event"]);
-    if (!ENVELOPE_SUBJECT_MEMBERS.has(event)) {
+    if (typeof event !== "string" || !ENVELOPE_SUBJECT_MEMBERS.has(event)) {
         throw new Error(`envelope v${ENVELOPE_VERSION} defines no subject for event '${event}'`);
     }
     const subject = {
@@ -1373,7 +1503,30 @@ function scoreEnvelope(envelope, index, entries, subjectAt, recomputed, trust, r
  * one the witness signed is in it.
  */
 export function verifyEnvelopes(bundle, options = {}) {
-    const entries = bundle.entries ?? [];
+    // A bundle it cannot read, or whose `entries` or `envelopes` it cannot (the anchor is not read
+    // here), is reported, `ok` false and status "not checked", one `invalid_bundle` failure per
+    // member, as `verifyBundle` reports it. An entry that is not a JSON object is read as one with
+    // no members, filed by its index. The Python implementation's same report.
+    const unreadable = unreadableBundle(bundle, ["entries", "envelopes"]);
+    if (unreadable.length > 0) {
+        const log = new FailureLog();
+        for (const detail of unreadable)
+            log.add("invalid_bundle", detail);
+        return {
+            ok: false,
+            status: "not checked",
+            count: 0,
+            witness_signed: [],
+            states: {},
+            results: {},
+            witnesses: {},
+            lines: {},
+            failures: log.messages,
+            failure_details: log.details,
+            failure_entries: unreadable.map(() => null),
+        };
+    }
+    const entries = readableEntries(bundle);
     const [summary, fail] = scoreEnvelopes(entries, bundle.envelopes ?? [], trustedWitnesses(options.witnessKeys ?? null, verificationTime(options.now)), options.envelopeBytes ?? null);
     return { ok: fail.length === 0, ...summary, failure_details: fail.details, failure_entries: fail.entryIndices(entries) };
 }
@@ -1924,9 +2077,16 @@ function executionBinding(entries, bundleV) {
  * re-hashed ledger fails against the signed anchor, not here, and that failure is chain-level.
  */
 export function integrityBreak(entries) {
+    // `entries` that are not an array are no chain, and no entry is where it breaks.
+    if (!Array.isArray(entries))
+        return null;
     let prev = GENESIS;
     for (let i = 0; i < entries.length; i++) {
         const e = entries[i];
+        // An entry that is not a JSON object carries no member, so the chain breaks at it, as
+        // `AuditLog.verify` reads it.
+        if (!isLedgerObject(e))
+            return i;
         const payload = {};
         for (const [k, v] of Object.entries(e)) {
             if (k !== "hash")
@@ -1949,8 +2109,118 @@ export function integrityBreak(entries) {
     }
     return null;
 }
+/** What each bundle member this module reads has to be, when it is present and not null. */
+const BUNDLE_MEMBERS = {
+    entries: ["an array", (v) => Array.isArray(v)],
+    anchor: ["an object", (v) => isLedgerObject(v)],
+    envelopes: ["an array", (v) => Array.isArray(v)],
+};
+/**
+ * The `invalid_bundle` messages for a bundle this module cannot read: one when the bundle is not a
+ * JSON object, or one for each member in `members` that is present, not null, and not the type the
+ * format gives it. Empty when there is nothing of the kind. Reading such a member anyway reads it
+ * by projection (a string's characters as entries) or throws. The Python implementation's
+ * `_unreadable_bundle`.
+ */
+function unreadableBundle(bundle, members = ["entries", "anchor", "envelopes"]) {
+    if (!isLedgerObject(bundle))
+        return [`invalid_bundle: the bundle is ${jsonKind(bundle)}, not an object`];
+    const out = [];
+    for (const member of members) {
+        const [want, ok] = BUNDLE_MEMBERS[member];
+        const value = bundle[member];
+        if (value !== undefined && value !== null && !ok(value)) {
+            out.push(`invalid_bundle: ${member} is ${jsonKind(value)}, not ${want}`);
+        }
+    }
+    return out;
+}
+/**
+ * A bundle's entries as the readers that never fail read them: none when the bundle or its
+ * `entries` cannot be read (`unreadableBundle`), and an entry that is not a JSON object read as one
+ * with no members, which names no node, no event and no seq. The Python implementation's
+ * `_readable_entries`.
+ */
+function readableEntries(bundle) {
+    if (!isLedgerObject(bundle))
+        return [];
+    const entries = bundle["entries"];
+    if (!Array.isArray(entries))
+        return [];
+    return Array.from(entries, (e) => (isLedgerObject(e) ? e : {}));
+}
+/**
+ * The report on a bundle this verifier cannot read at all (`unreadableBundle`): one
+ * `invalid_bundle` failure per member it cannot read, each about no single entry; every check
+ * false, and every status `"not checked"`, since none ran. The report has every member a full
+ * verification's has, so a reader of it needs no second shape. The Python implementation's
+ * `_invalid_bundle_report`, member for member.
+ */
+function invalidBundleReport(bundle, details, verifiedAgainst) {
+    const log = new FailureLog();
+    for (const detail of details)
+        log.add("invalid_bundle", detail);
+    return {
+        ok: false,
+        checks: {
+            integrity: false,
+            monotonicity: false,
+            containment: false,
+            anchor: "not checked",
+            version: false,
+            ledger_fields: false,
+            chain_id: false,
+            root: false,
+            expected_anchor: "not checked",
+            envelopes: "not checked",
+        },
+        failures: log.messages,
+        failure_details: log.details,
+        failure_entries: details.map(() => null),
+        nodes: 0,
+        actions_checked: 0,
+        ungated: 0,
+        chain_id: isLedgerObject(bundle) ? orNull(bundle["chain_id"]) : null,
+        execution_binding: { status: "not applicable" },
+        envelopes: {
+            status: "not checked",
+            count: 0,
+            witness_signed: [],
+            states: {},
+            results: {},
+            witnesses: {},
+            lines: {},
+            failures: [],
+        },
+        verified_against: verifiedAgainst,
+    };
+}
 export function verifyBundle(bundle, signer = null, options = {}) {
-    const entries = bundle.entries ?? [];
+    const verifiedAgainst = (options.expectedAnchor ?? null) !== null || (options.expectedHead ?? null) !== null
+        ? "expected_anchor"
+        : "bundle_anchor";
+    // A bundle is a JSON object, its `entries` and `envelopes` arrays and its `anchor` an object.
+    // Anything else threw out of this function (a TypeError), whose 0.8.0 note says it never throws,
+    // or was read by projection (a string anchor's characters as its members). Such a bundle is
+    // reported alone, as `invalid_bundle`, once per member it cannot read. An absent or null member
+    // is absent. The Python implementation's same rule, message for message.
+    const given = bundle;
+    const unreadable = unreadableBundle(given);
+    if (unreadable.length > 0 || !isLedgerObject(given))
+        return invalidBundleReport(given, unreadable, verifiedAgainst);
+    const rawEntries = (given["entries"] ?? []);
+    // An entry that is not a JSON object is reported once, as `invalid_ledger_entry` in (0b2), and
+    // read everywhere else as an entry with no members: the checks that read an entry's fields skip
+    // it, and the hash chain breaks at it. Each stand-in is a new object, so `failure_entries` finds
+    // its index by identity, as it finds every other entry's. `Array.from` visits a hole as well.
+    const unread = new Set();
+    const entries = Array.from(rawEntries, (e) => {
+        if (isLedgerObject(e))
+            return e;
+        const standIn = {};
+        unread.add(standIn);
+        return standIn;
+    });
     const anchor = (bundle.anchor ?? {});
     const anchorPresent = Object.keys(anchor).length > 0;
     const checks = {
@@ -1994,7 +2264,7 @@ export function verifyBundle(bundle, signer = null, options = {}) {
         versionOk = false;
         log.add("root_version_mismatch", `root_version_mismatch: root v=${reprIntOr(rootEntry["v"])} != bundle v=${reprIntOr(rawV)}`, { seq: orNull(rootEntry["seq"]), node: orNull(rootEntry["node"]), entry: rootEntry });
     }
-    const mixedEntries = entries.filter((e) => !sameNumber(e["v"], rawV));
+    const mixedEntries = entries.filter((e) => !unread.has(e) && !sameNumber(e["v"], rawV));
     // An entry without `v` is Python's None in the list. Numbers come first in numeric order, then
     // everything else by its repr, compared by code point as Python compares strings, never by locale.
     const mixed = pySetOf(mixedEntries.map((e) => (intOr(e["v"]) ?? null))).sort(compareVersions);
@@ -2020,8 +2290,32 @@ export function verifyBundle(bundle, signer = null, options = {}) {
     // is a property of the bundle, not an error in the call.
     //
     // Kept in step with the Python port (`evidence._verify_bundle`, same check, same reason string).
+    //
+    // The same pass reads every entry's shape and event, and reports each defect an entry has. An
+    // entry that is not a JSON object is `invalid_ledger_entry`, chain-level since it has no seq or
+    // node, its index in the message. An event that is absent, not a string, or not one its chain's
+    // version defines (`outcome` is v2-only) is `unknown_ledger_event`: every check below reads an
+    // entry by its event, so such an entry was read by none of them.
     let unknownOk = true;
-    for (const e of entries) {
+    const events = bundleV === 1 ? LEDGER_EVENTS_V1 : LEDGER_EVENTS;
+    for (let index = 0; index < entries.length; index++) {
+        const e = entries[index];
+        if (unread.has(e)) {
+            unknownOk = false;
+            log.add("invalid_ledger_entry", `invalid_ledger_entry: entries[${index}] is ${jsonKind(rawEntries[index])}, not an object`, { entry: e });
+            continue;
+        }
+        const ev = toPlain(e["event"]);
+        if (typeof ev !== "string" || !events.has(ev)) {
+            unknownOk = false;
+            const why = typeof ev !== "string"
+                ? ", which is not a string"
+                : LEDGER_EVENTS.has(ev)
+                    ? ", a v2-only event on a schema_version=1 chain"
+                    : "";
+            log.add("unknown_ledger_event", `unknown_ledger_event: entry carries an event this verifier does not evaluate and will not ` +
+                `ignore: ${shown(e["event"])}${why}`, { seq: orNull(e["seq"]), node: orNull(e["node"]), entry: e });
+        }
         const extra = Object.keys(e)
             .filter((f) => !LEDGER_FIELDS.has(f))
             .sort();
@@ -2078,7 +2372,7 @@ export function verifyBundle(bundle, signer = null, options = {}) {
     // must all name the SAME chain. Without this a correctly-signed, internally-consistent bundle
     // for a DIFFERENT chain could be handed to a verifier who believes it is checking this one.
     const bundleChainId = orNull(bundle.chain_id);
-    const foreign = entries.find((e) => orNull(e["chain_id"]) !== bundleChainId);
+    const foreign = entries.find((e) => !unread.has(e) && orNull(e["chain_id"]) !== bundleChainId);
     const entriesOk = foreign === undefined;
     if (foreign !== undefined) {
         log.add("chain_id_mismatch", `chain_id_mismatch: an entry does not carry chain_id=${pyRepr(bundleChainId)}`, {
@@ -2290,7 +2584,7 @@ export function verifyBundle(bundle, signer = null, options = {}) {
         chain_id: orNull(bundle.chain_id),
         execution_binding: eb,
         envelopes: envelopeSummary,
-        verified_against: expectedAnchor !== null || expectedHead !== null ? "expected_anchor" : "bundle_anchor",
+        verified_against: verifiedAgainst,
     };
 }
 /** Read a bundle from JSON text, keeping every number's original literal. */