attenu-guard 0.5.0 → 0.7.0

package/dist/esm/evidence.js

@@ -18,14 +18,23 @@
  *     const bundle = exportBundle(guard.auditLog(), signer);
  *     const report = verifyBundle(bundle, signer);
  *
+ * `report.failures` is the human-readable list — its strings are a published
+ * contract, other implementations parse them — and `report.failure_details` is
+ * its machine-readable twin: one entry per string, same order, same count,
+ * `{reason, seq, node, call_id, detail}`. It exists so a conformance suite can
+ * assert WHICH check failed and WHERE, not merely that something did. The
+ * bundle-level interop vectors under `test/fixtures/vectors/bundles/` are scored
+ * against exactly that shape.
+ *
  * No engine state is consulted — the bundle is the whole input, which is the
  * point. This is byte-compatible with the Python library's
  * `attenu_guard.evidence`.
  */
-import { canonicalBytes, compareCodePoints, parseJson, toPlain, } from "./canonical.js";
+import { canonicalBytes, compareCodePoints, parseJson, pyNumber, toPlain, } from "./canonical.js";
 import { createHash } from "node:crypto";
 import { AuditLog, SCHEMA_VERSION, chainIdOf, hashEntry, GENESIS } from "./audit.js";
 import { Authority } from "./authority.js";
+import { describe as describeCeiling } from "./ceilings.js";
 import { CAPTURES, BODY_STATES, BodyState, Capture } from "./reasons.js";
 import { PARAMS_HASH_REASONS } from "./params.js";
 /**
@@ -217,36 +226,124 @@ function orNull(value) {
     const plain = toPlain(value);
     return plain === undefined ? null : plain;
 }
+/**
+ * The verifier's failure list, kept in two shapes that cannot drift apart.
+ *
+ * `messages` is the string list `verifyBundle` has always returned as
+ * `failures`; those exact strings are a published contract, so they are never
+ * reworded here. `details` is the structured twin of each one, appended in the
+ * same call. Every failure in this module goes through `add`, so a new check
+ * cannot add a message without its twin — `test/bundle-vectors.test.ts` greps
+ * this file for a direct append to a failure list and fails on one, and asserts
+ * the two lists stay in step at every site.
+ */
+class FailureLog {
+    messages = [];
+    details = [];
+    add(reason, detail, position = {}) {
+        const { seq = null, node = null, callId = null } = position;
+        this.messages.push(detail);
+        this.details.push({ reason, seq, node, call_id: callId, detail });
+    }
+    extend(other) {
+        this.messages.push(...other.messages);
+        this.details.push(...other.details);
+    }
+    get length() {
+        return this.messages.length;
+    }
+}
 /**
  * `node -> Authority` and `node -> parent`, reconstructed from `root` and
  * `spawn` events alone. No engine state.
  */
+/**
+ * Why `child` is not ⊆ `parent`, rendered for the monotonicity failure message.
+ *
+ * Called only once `Authority.isNarrowerThan` has already returned false, and it walks the
+ * dimensions in the ORDER that relation compares them — scopes, then ceilings by key, then ttl
+ * — so the message names the dimension that actually failed. Every dimension the relation can
+ * fail on has a branch here:
+ *
+ *   scopes    a scope the parent does not cover (wildcard-aware);
+ *   ceilings  a key the parent bounds and the child does not (child unbounded there, so MORE
+ *             powerful), or one the child bounds more loosely than the parent;
+ *   ttl       a child that never expires under a parent that does, or one that outlives it.
+ *
+ * Reports the FIRST failing dimension: one message per unsound delegation. Byte-identical to
+ * the Python `evidence._monotonicity_detail`, since these strings are a published contract that
+ * both implementations are scored against.
+ */
+function monotonicityDetail(child, parent) {
+    // Unchanged since 0.1.0, byte for byte. A scope failure always leaves this list non-empty:
+    // a scope literally present in the parent's set is covered by it, so anything the parent
+    // does not cover is also absent from that set.
+    if (!Array.from(child.scopes).every((s) => parent.coversScope(s))) {
+        const extra = Array.from(child.scopes).filter((s) => !parent.scopes.has(s));
+        return (`child scopes [${extra.sort(compareCodePoints).map((s) => `'${s}'`).join(", ")}] ` +
+            `not held by parent`);
+    }
+    const childByKey = new Map(child.ceilings.map((c) => [String(c.key), c]));
+    const parentKeys = parent.ceilings.map((c) => String(c.key)).sort(compareCodePoints);
+    for (const key of parentKeys) {
+        const parentCeiling = parent.ceilings.find((c) => String(c.key) === key);
+        const childCeiling = childByKey.get(key);
+        if (childCeiling === undefined) {
+            return `ceiling ${key} unbounded, parent holds ${describeCeiling(parentCeiling)}`;
+        }
+        if (!parentCeiling.subsumes(childCeiling)) {
+            return (`ceiling ${describeCeiling(childCeiling)} looser than parent ` +
+                `${describeCeiling(parentCeiling)}`);
+        }
+    }
+    if (parent.ttl !== null) {
+        if (child.ttl === null)
+            return `ttl unbounded, parent ${pyNumber(parent.ttl)}`;
+        if (child.ttl > parent.ttl) {
+            return `ttl ${pyNumber(child.ttl)} > parent ${pyNumber(parent.ttl)}`;
+        }
+    }
+    // Only reachable if a future dimension is added to `isNarrowerThan` without a branch here;
+    // it exists so that such a dimension cannot fail SILENTLY.
+    return "child not narrower than parent";
+}
 function nodeAuthorities(entries) {
     const auth = new Map();
     const parent = new Map();
-    const failures = [];
+    const failures = new FailureLog();
+    const definedBy = new Map();
     for (const e of entries) {
         const ev = toPlain(e["event"]);
         const node = toPlain(e["node"]);
         if (ev === "root") {
+            definedBy.set(node, e);
             try {
                 auth.set(node, Authority.fromWire(e["authority"] ?? null));
             }
             catch (exc) {
-                failures.push(`root ${node}: unreadable authority (${exc.message})`);
+                // One of the two historical messages that name a node before their colon rather than a
+                // reason token, so the reason is stated here instead of parsed out of the string.
+                failures.add("unreadable_authority", `root ${node}: unreadable authority (${exc.message})`, {
+                    seq: orNull(e["seq"]),
+                    node: orNull(e["node"]),
+                });
             }
         }
         else if (ev === "spawn") {
+            definedBy.set(node, e);
             parent.set(node, toPlain(e["parent"]) ?? null);
             try {
                 auth.set(node, Authority.fromWire(e["granted"] ?? null));
             }
             catch (exc) {
-                failures.push(`spawn ${node}: unreadable granted (${exc.message})`);
+                failures.add("unreadable_granted", `spawn ${node}: unreadable granted (${exc.message})`, {
+                    seq: orNull(e["seq"]),
+                    node: orNull(e["node"]),
+                });
             }
         }
     }
-    return { auth, parent, failures };
+    return { auth, parent, failures, definedBy };
 }
 /**
  * A view of the chain from the bundle: each node with its agent, task,
@@ -585,24 +682,31 @@ const V2_ONLY_FIELDS = [
  * invalid regardless of which field it is (merge-gate item 4/(c)).
  */
 function v2FieldLeaksOnV1(entries) {
-    const failures = [];
+    const failures = new FailureLog();
     for (const e of entries) {
         const leaked = V2_ONLY_FIELDS.filter((f) => f in e).sort();
         if (leaked.length > 0) {
-            failures.push(`v2_field_on_v1: seq=${pyRepr(toPlain(e["seq"]))} event=${pyRepr(toPlain(e["event"]))} ` +
-                `carries v2-only field(s) ${JSON.stringify(leaked)} on a schemaVersion: 1 entry`);
+            failures.add("v2_field_on_v1", `v2_field_on_v1: seq=${pyRepr(toPlain(e["seq"]))} event=${pyRepr(toPlain(e["event"]))} ` +
+                `carries v2-only field(s) ${JSON.stringify(leaked)} on a schemaVersion: 1 entry`, { seq: orNull(e["seq"]), node: orNull(e["node"]) });
         }
     }
     return failures;
 }
+/**
+ * `[the execution_binding report, its failures]`. The report's own `failures` key keeps its
+ * historical list-of-strings shape — the structured twins ride alongside it rather than inside
+ * it, so this sub-report's published shape is unchanged.
+ */
 function executionBinding(entries, bundleV) {
     if (bundleV === 1) {
         const leaked = v2FieldLeaksOnV1(entries);
-        return leaked.length > 0 ? { status: "not applicable", failures: leaked } : { status: "not applicable" };
+        return leaked.length > 0
+            ? [{ status: "not applicable", failures: leaked.messages }, leaked]
+            : [{ status: "not applicable" }, new FailureLog()];
     }
     if (bundleV !== 2)
-        return { status: "not applicable" };
-    const failures = [];
+        return [{ status: "not applicable" }, new FailureLog()];
+    const failures = new FailureLog();
     const seenCallIds = new Map(); // callId -> [event, node, seq]
     const allows = new Map();
     const outcomes = new Map();
@@ -618,8 +722,12 @@ function executionBinding(entries, bundleV) {
             if (node !== null)
                 nodes.add(node);
             const err = validateRoot(e);
-            if (err)
-                failures.push(`invalid_root: ${err} (seq ${pyRepr(seqForEvent)})`);
+            if (err) {
+                failures.add("invalid_root", `invalid_root: ${err} (seq ${pyRepr(seqForEvent)})`, {
+                    seq: orNull(e["seq"]),
+                    node: orNull(e["node"]),
+                });
+            }
         }
         else if (ev === "spawn") {
             if (node !== null)
@@ -633,8 +741,12 @@ function executionBinding(entries, bundleV) {
             for (const r of toPlain(e["revoked"]) ?? [])
                 revokedNodes.add(r);
             const err = validateKill(e);
-            if (err)
-                failures.push(`invalid_kill: ${err} (seq ${pyRepr(seqForEvent)})`);
+            if (err) {
+                failures.add("invalid_kill", `invalid_kill: ${err} (seq ${pyRepr(seqForEvent)})`, {
+                    seq: orNull(e["seq"]),
+                    node: orNull(e["node"]),
+                });
+            }
         }
         if (ev === "allow" || ev === "deny") {
             const cid = toPlain(e["call_id"]);
@@ -642,8 +754,10 @@ function executionBinding(entries, bundleV) {
             if (cid !== null && cid !== undefined) {
                 const prior = seenCallIds.get(cid);
                 if (prior !== undefined) {
-                    failures.push(`duplicate_call_id: call_id ${cid} on seq ${pyRepr(seq)} (${ev}) already used at seq ` +
-                        `${pyRepr(prior[2])} (${prior[0]})`);
+                    // Positioned on the SECOND sighting: the entry that re-used a call_id is the offending
+                    // record, the first one having been legitimate when it was written.
+                    failures.add("duplicate_call_id", `duplicate_call_id: call_id ${cid} on seq ${pyRepr(seq)} (${ev}) already used at seq ` +
+                        `${pyRepr(prior[2])} (${prior[0]})`, { seq: orNull(e["seq"]), node: orNull(e["node"]), callId: cid });
                 }
                 else {
                     seenCallIds.set(cid, [ev, node, seq]);
@@ -651,7 +765,11 @@ function executionBinding(entries, bundleV) {
             }
             const err = ev === "allow" ? validateAllow(e) : validateDeny(e);
             if (err) {
-                failures.push(`invalid_${ev}: ${err} (seq ${pyRepr(seq)})`);
+                failures.add(`invalid_${ev}`, `invalid_${ev}: ${err} (seq ${pyRepr(seq)})`, {
+                    seq: orNull(e["seq"]),
+                    node: orNull(e["node"]),
+                    callId: cid ?? null,
+                });
                 if (ev === "allow" && cid !== null && cid !== undefined)
                     invalidAllowIds.add(cid);
                 continue;
@@ -664,12 +782,16 @@ function executionBinding(entries, bundleV) {
             const seq = toPlain(e["seq"]);
             const err = validateOutcome(e);
             if (err) {
-                failures.push(`invalid_outcome: ${err} (seq ${pyRepr(seq)})`);
+                failures.add("invalid_outcome", `invalid_outcome: ${err} (seq ${pyRepr(seq)})`, {
+                    seq: orNull(e["seq"]),
+                    node: orNull(e["node"]),
+                    callId: cid ?? null,
+                });
                 continue;
             }
             if (cid !== null && outcomes.has(cid)) {
-                failures.push(`duplicate_outcome: call_id ${cid} at seq ${pyRepr(seq)} (first at seq ` +
-                    `${pyRepr(toPlain(outcomes.get(cid)["seq"]))})`);
+                failures.add("duplicate_outcome", `duplicate_outcome: call_id ${cid} at seq ${pyRepr(seq)} (first at seq ` +
+                    `${pyRepr(toPlain(outcomes.get(cid)["seq"]))})`, { seq: orNull(e["seq"]), node: orNull(e["node"]), callId: cid });
                 continue;
             }
             if (cid !== null)
@@ -683,29 +805,32 @@ function executionBinding(entries, bundleV) {
     // its recorded content disagrees with what was authorized (spec: "parameter equality is
     // established only for calls where both hashes are present; elsewhere only identity and order
     // binding was checked" — params_mismatch is that separate concern).
+    // Every failure in this loop is about a PAIR, and is positioned on the `outcome` entry: the
+    // allow was a complete, valid record when it was written, and it is the outcome that fails to
+    // bind to it (or reports different arguments than were authorized).
     const boundOk = new Set();
     for (const [cid, oc] of outcomes) {
         const allowE = allows.get(cid);
         if (allowE === undefined) {
-            failures.push(`outcome_without_allow: call_id ${cid} at seq ${pyRepr(toPlain(oc["seq"]))} has no allow in this chain`);
+            failures.add("outcome_without_allow", `outcome_without_allow: call_id ${cid} at seq ${pyRepr(toPlain(oc["seq"]))} has no allow in this chain`, { seq: orNull(oc["seq"]), node: orNull(oc["node"]), callId: cid });
             continue;
         }
         const nodeOk = toPlain(allowE["node"]) === toPlain(oc["node"]);
         if (!nodeOk) {
-            failures.push(`cross_ref: call_id ${cid} allow on node ${pyRepr(toPlain(allowE["node"]))} but ` +
-                `outcome on node ${pyRepr(toPlain(oc["node"]))}`);
+            failures.add("cross_ref", `cross_ref: call_id ${cid} allow on node ${pyRepr(toPlain(allowE["node"]))} but ` +
+                `outcome on node ${pyRepr(toPlain(oc["node"]))}`, { seq: orNull(oc["seq"]), node: orNull(oc["node"]), callId: cid });
         }
         const ocSeq = toPlain(oc["seq"]);
         const allowSeq = toPlain(allowE["seq"]);
         const orderOk = typeof ocSeq === "number" && typeof allowSeq === "number" && ocSeq > allowSeq;
         if (!orderOk) {
-            failures.push(`outcome_before_allow: call_id ${cid} outcome seq ${pyRepr(ocSeq ?? null)} not ` +
-                `after allow seq ${pyRepr(allowSeq ?? null)}`);
+            failures.add("outcome_before_allow", `outcome_before_allow: call_id ${cid} outcome seq ${pyRepr(ocSeq ?? null)} not ` +
+                `after allow seq ${pyRepr(allowSeq ?? null)}`, { seq: orNull(oc["seq"]), node: orNull(oc["node"]), callId: cid });
         }
         const ah = toPlain(allowE["authorized_params_hash"]);
         const ih = toPlain(oc["invoked_params_hash"]);
         if (ah !== null && ah !== undefined && ih !== null && ih !== undefined && ah !== ih) {
-            failures.push(`params_mismatch: call_id ${cid} authorized_params_hash ${ah} != invoked_params_hash ${ih}`);
+            failures.add("params_mismatch", `params_mismatch: call_id ${cid} authorized_params_hash ${ah} != invoked_params_hash ${ih}`, { seq: orNull(oc["seq"]), node: orNull(oc["node"]), callId: cid });
         }
         if (nodeOk && orderOk)
             boundOk.add(cid);
@@ -775,13 +900,52 @@ function executionBinding(entries, bundleV) {
     }
     if (Object.values(perCall).some((s) => s === "unobserved"))
         escalate("incomplete");
-    return {
-        aggregate,
-        params_coverage: paramsCoverage(allows, outcomes, invalidAllowIds),
-        per_call: perCall,
-        per_node_lifecycle: lifecycle,
+    return [
+        {
+            aggregate,
+            params_coverage: paramsCoverage(allows, outcomes, invalidAllowIds),
+            per_call: perCall,
+            per_node_lifecycle: lifecycle,
+            failures: failures.messages,
+        },
         failures,
-    };
+    ];
+}
+/**
+ * `[seq, node]` of the FIRST entry the hash chain does not reproduce at — position only.
+ *
+ * `AuditLog.verify` stays the authority on WHETHER the chain is broken and on the message this
+ * module reports; this walk exists so the structured twin of that message can say WHERE, which
+ * the message's own text does not expose in a parseable form. Mirrors `AuditLog.verify`'s walk
+ * exactly (same seq/prev_hash/hash order). `[null, null]` when nothing entry-local is wrong — a
+ * consistently re-hashed ledger fails against the signed anchor, not here, and that failure is
+ * chain-level.
+ */
+function integrityPosition(entries) {
+    let prev = GENESIS;
+    for (let i = 0; i < entries.length; i++) {
+        const e = entries[i];
+        const payload = {};
+        for (const [k, v] of Object.entries(e)) {
+            if (k !== "hash")
+                payload[k] = v;
+        }
+        let broken;
+        try {
+            broken =
+                orNull(e["seq"]) !== i ||
+                    orNull(payload["prev_hash"]) !== prev ||
+                    hashEntry(prev, payload) !== orNull(e["hash"]);
+        }
+        catch {
+            // An unhashable payload is itself the break, at this entry.
+            return [orNull(e["seq"]), orNull(e["node"])];
+        }
+        if (broken)
+            return [orNull(e["seq"]), orNull(e["node"])];
+        prev = orNull(e["hash"]);
+    }
+    return [null, null];
 }
 export function verifyBundle(bundle, signer = null, options = {}) {
     const entries = bundle.entries ?? [];
@@ -797,38 +961,41 @@ export function verifyBundle(bundle, signer = null, options = {}) {
         root: false,
         expected_anchor: "not checked",
     };
-    const failures = [];
+    const log = new FailureLog();
     // (0) version: the bundle must declare a schema version this build understands, and — when
     // an anchor is present — the anchor must be anchoring THAT version, not a different one.
     const bundleV = toPlain(bundle.v);
     let versionOk = typeof bundleV === "number" && SUPPORTED_BUNDLE_VERSIONS.has(bundleV);
     if (!versionOk) {
         const supported = Array.from(SUPPORTED_BUNDLE_VERSIONS).sort((a, b) => a - b);
-        failures.push(`unsupported_version: bundle v=${pyRepr(bundleV)} not in [${supported.join(", ")}]`);
+        log.add("unsupported_version", `unsupported_version: bundle v=${pyRepr(bundleV)} not in [${supported.join(", ")}]`);
     }
     const anchorV = toPlain(anchor["v"]);
     if (anchorPresent && anchorV !== bundleV) {
         versionOk = false;
-        failures.push(`anchor_version_mismatch: anchor v=${pyRepr(anchorV)} != bundle v=${pyRepr(bundleV)}`);
+        log.add("anchor_version_mismatch", `anchor_version_mismatch: anchor v=${pyRepr(anchorV)} != bundle v=${pyRepr(bundleV)}`);
     }
     // (0a) exactly one root: a rootless bundle (or one splicing in a second root) would otherwise
     // sail through monotonicity/containment trivially — there is nothing to anchor those checks to.
     const rootEvents = entries.filter((e) => toPlain(e["event"]) === "root");
     checks.root = rootEvents.length === 1;
     if (!checks.root) {
-        failures.push(`missing_root: bundle has ${rootEvents.length} root event(s), expected exactly 1`);
+        log.add("missing_root", `missing_root: bundle has ${rootEvents.length} root event(s), expected exactly 1`);
     }
     const rootEntry = rootEvents.length === 1 ? rootEvents[0] : undefined;
     // 0.9.0: a chain is created at ONE schema version and never mixes (spec section 9) — the root
     // entry's v must equal the bundle's declared v, and no OTHER entry may carry a different v.
     if (rootEntry !== undefined && toPlain(rootEntry["v"]) !== bundleV) {
         versionOk = false;
-        failures.push(`root_version_mismatch: root v=${pyRepr(toPlain(rootEntry["v"]))} != bundle v=${pyRepr(bundleV)}`);
+        log.add("root_version_mismatch", `root_version_mismatch: root v=${pyRepr(toPlain(rootEntry["v"]))} != bundle v=${pyRepr(bundleV)}`, { seq: orNull(rootEntry["seq"]), node: orNull(rootEntry["node"]) });
     }
-    const mixed = Array.from(new Set(entries.map((e) => toPlain(e["v"])).filter((v) => v !== bundleV))).sort((a, b) => (typeof a === "number" && typeof b === "number" ? a - b : String(a).localeCompare(String(b))));
+    const mixedEntries = entries.filter((e) => toPlain(e["v"]) !== bundleV);
+    const mixed = Array.from(new Set(mixedEntries.map((e) => toPlain(e["v"])))).sort((a, b) => (typeof a === "number" && typeof b === "number" ? a - b : String(a).localeCompare(String(b))));
     if (mixed.length > 0) {
         versionOk = false;
-        failures.push(`mixed_entry_versions: entries declare v in [${mixed.map((v) => pyRepr(v)).join(", ")}], bundle v=${pyRepr(bundleV)}`);
+        // One aggregate message over every offending entry (unchanged); the twin is positioned on
+        // the first of them, which is where a reader looks.
+        log.add("mixed_entry_versions", `mixed_entry_versions: entries declare v in [${mixed.map((v) => pyRepr(v)).join(", ")}], bundle v=${pyRepr(bundleV)}`, { seq: orNull(mixedEntries[0]["seq"]), node: orNull(mixedEntries[0]["node"]) });
     }
     checks.version = versionOk;
     // (0c) independently retained expected anchor/head: verified against the BUNDLE's actual
@@ -842,7 +1009,7 @@ export function verifyBundle(bundle, signer = null, options = {}) {
             const [expSeq, expHash] = expectedHead;
             if (actualSeq !== expSeq || actualHead !== expHash) {
                 expectedOk = false;
-                failures.push(`expected_head_mismatch: bundle head is (seq=${actualSeq}, hash=${actualHead}) but the ` +
+                log.add("expected_head_mismatch", `expected_head_mismatch: bundle head is (seq=${actualSeq}, hash=${actualHead}) but the ` +
                     `independently retained expected head is (seq=${expSeq}, hash=${expHash})`);
             }
         }
@@ -853,7 +1020,7 @@ export function verifyBundle(bundle, signer = null, options = {}) {
                 toPlain(ea["chain_id"]) !== toPlain(bundle.chain_id) ||
                 toPlain(ea["v"]) !== bundleV) {
                 expectedOk = false;
-                failures.push("expected_anchor_mismatch: the bundle's actual (seq, head, chainId, v) does not match " +
+                log.add("expected_anchor_mismatch", "expected_anchor_mismatch: the bundle's actual (seq, head, chainId, v) does not match " +
                     "the independently retained expected anchor");
             }
         }
@@ -863,32 +1030,40 @@ export function verifyBundle(bundle, signer = null, options = {}) {
     // must all name the SAME chain. Without this a correctly-signed, internally-consistent bundle
     // for a DIFFERENT chain could be handed to a verifier who believes it is checking this one.
     const bundleChainId = orNull(bundle.chain_id);
-    const entriesOk = entries.every((e) => orNull(e["chain_id"]) === bundleChainId);
-    if (!entriesOk) {
-        failures.push(`chain_id_mismatch: an entry does not carry chain_id=${pyRepr(bundleChainId)}`);
+    const foreign = entries.find((e) => orNull(e["chain_id"]) !== bundleChainId);
+    const entriesOk = foreign === undefined;
+    if (foreign !== undefined) {
+        log.add("chain_id_mismatch", `chain_id_mismatch: an entry does not carry chain_id=${pyRepr(bundleChainId)}`, {
+            seq: orNull(foreign["seq"]),
+            node: orNull(foreign["node"]),
+        });
     }
     const anchorChainId = orNull(anchor["chain_id"]);
     const anchorChainOk = !anchorPresent || anchorChainId === bundleChainId;
     if (!anchorChainOk) {
-        failures.push(`chain_id_mismatch: anchor chain_id=${pyRepr(anchorChainId)} != bundle chain_id=${pyRepr(bundleChainId)}`);
+        log.add("chain_id_mismatch", `chain_id_mismatch: anchor chain_id=${pyRepr(anchorChainId)} != bundle chain_id=${pyRepr(bundleChainId)}`);
     }
     checks.chain_id = entriesOk && anchorChainOk;
     // (1) integrity: the hash chain, plus the signed anchor when a key is given.
     const [okChain, err] = AuditLog.verify(entries);
-    if (!okChain)
-        failures.push(`integrity: ${err}`);
+    if (!okChain) {
+        const [badSeq, badNode] = integrityPosition(entries);
+        log.add("integrity", `integrity: ${err}`, { seq: badSeq, node: badNode });
+    }
     if (signer !== null) {
         const [okAnchor, aerr] = AuditLog.verifyAnchor(entries, anchor, signer);
         checks.anchor = okAnchor ? "verified" : "FAILED";
+        // Chain-level by construction: the anchor commits to the head of the WHOLE ledger, so a
+        // consistently re-hashed chain has no single offending entry to point at.
         if (!okAnchor)
-            failures.push(`integrity(anchor): ${aerr}`);
+            log.add("integrity(anchor)", `integrity(anchor): ${aerr}`);
         checks.integrity = okChain && okAnchor;
     }
     else {
         checks.integrity = okChain;
     }
-    const { auth, parent, failures: afail } = nodeAuthorities(entries);
-    failures.push(...afail);
+    const { auth, parent, failures: afail, definedBy } = nodeAuthorities(entries);
+    log.extend(afail);
     // (2) monotonicity: every child ⊆ its parent.
     let mono = true;
     for (const [node, pid] of parent) {
@@ -896,11 +1071,14 @@ export function verifyBundle(bundle, signer = null, options = {}) {
             continue;
         const child = auth.get(node);
         const p = auth.get(pid);
-        const extra = Array.from(child.scopes).filter((s) => !p.scopes.has(s));
-        if (!child.isNarrowerThan(p) && extra.length > 0) {
+        // 0.6.x: the subsumption relation ALONE decides. This used to be gated on a literal,
+        // non-wildcard-aware scope difference, which silently accepted a delegation that widened
+        // only ttl or a ceiling whenever the child's scopes happened to be literally a subset of
+        // the parent's — the child was more powerful and the bundle verified clean.
+        if (!child.isNarrowerThan(p)) {
             mono = false;
-            failures.push(`monotonicity: ${node} not ⊆ parent ${pid} (child scopes ` +
-                `[${extra.sort(compareCodePoints).map((s) => `'${s}'`).join(", ")}] not held by parent)`);
+            const spawnE = definedBy.get(node);
+            log.add("monotonicity", `monotonicity: ${node} not ⊆ parent ${pid} (${monotonicityDetail(child, p)})`, { seq: spawnE === undefined ? null : orNull(spawnE["seq"]), node });
         }
     }
     checks.monotonicity = mono && afail.length === 0;
@@ -917,19 +1095,25 @@ export function verifyBundle(bundle, signer = null, options = {}) {
         const a = auth.get(node);
         if (a === undefined) {
             contained = false;
-            failures.push(`containment: allow on unknown node ${node}`);
+            log.add("containment", `containment: allow on unknown node ${node}`, {
+                seq: orNull(e["seq"]),
+                node: orNull(e["node"]),
+                callId: orNull(e["call_id"]),
+            });
             continue;
         }
         if (!a.permits(scope, ctx).allowed) {
             contained = false;
-            failures.push(`containment: allow of '${scope}' on ${node} outside its authority ` +
-                `[${Array.from(a.scopes).sort(compareCodePoints).map((s) => `'${s}'`).join(", ")}]`);
+            log.add("containment", `containment: allow of '${scope}' on ${node} outside its authority ` +
+                `[${Array.from(a.scopes).sort(compareCodePoints).map((s) => `'${s}'`).join(", ")}]`, { seq: orNull(e["seq"]), node: orNull(e["node"]), callId: orNull(e["call_id"]) });
         }
     }
     checks.containment = contained;
-    const eb = versionOk ? executionBinding(entries, bundleV) : { status: "not applicable" };
-    if (eb.failures !== undefined)
-        failures.push(...eb.failures);
+    const [eb, ebFailures] = versionOk
+        ? executionBinding(entries, bundleV)
+        : [{ status: "not applicable" }, new FailureLog()];
+    if (eb.failures !== undefined && eb.failures.length > 0)
+        log.extend(ebFailures);
     // "anchor" and "expected_anchor" are excluded here — both carry a tri-state status string
     // ("not checked"/"verified"/"FAILED"), not a plain pass/fail boolean, and a failed check on
     // either already lands its own entry in `failures`, which the `ok` computation still gates on.
@@ -939,11 +1123,12 @@ export function verifyBundle(bundle, signer = null, options = {}) {
         checks.version &&
         checks.chain_id &&
         checks.root &&
-        failures.length === 0;
+        log.length === 0;
     return {
         ok,
         checks,
-        failures,
+        failures: log.messages,
+        failure_details: log.details,
         nodes: auth.size,
         actions_checked: actions,
         chain_id: orNull(bundle.chain_id),