chainlesschain 0.166.20 → 0.166.22

package/src/lib/skill-vector-authority.js

@@ -0,0 +1,325 @@
+import { createHash } from "node:crypto";
+import { types as utilTypes } from "node:util";
+
+export const SKILL_VECTOR_REQUEST_SCHEMA =
+  "chainlesschain.skill-vector-request/v1";
+export const SKILL_VECTOR_RESULT_SCHEMA =
+  "chainlesschain.skill-vector-result/v1";
+export const SKILL_VECTOR_AUTHORITY_SCHEMA =
+  "chainlesschain.skill-vector-authority/v1";
+export const SKILL_VECTOR_ATTESTATION_SCHEMA =
+  "chainlesschain.skill-vector-attestation/v1";
+
+const AUTHORITIES = new WeakSet();
+const DIGEST = /^sha256:[a-f0-9]{64}$/u;
+const SAFE_ID = /^[A-Za-z0-9][A-Za-z0-9._:@/-]{0,255}$/u;
+const MAX_SKILLS = 10_000;
+const MAX_TEXT_BYTES = 8 * 1024 * 1024;
+const RESULT_KEYS = new Set([
+  "attestation",
+  "corpusDigest",
+  "indexDigest",
+  "modelId",
+  "modelRevision",
+  "requestDigest",
+  "resultDigest",
+  "schema",
+  "scores",
+  "tenantId",
+]);
+const SCORE_KEYS = new Set(["digest", "score"]);
+const ATTESTATION_KEYS = new Set(["algorithm", "keyId", "schema", "value"]);
+const VERIFICATION_KEYS = new Set([
+  "authenticated",
+  "durable",
+  "receiptDigest",
+  "requestDigest",
+  "resultDigest",
+  "tenantId",
+]);
+
+function canonical(value) {
+  if (value === null || typeof value !== "object") return JSON.stringify(value);
+  if (Array.isArray(value)) return `[${value.map(canonical).join(",")}]`;
+  return `{${Object.keys(value)
+    .sort()
+    .map((key) => `${JSON.stringify(key)}:${canonical(value[key])}`)
+    .join(",")}}`;
+}
+
+function hash(domain, value) {
+  return `sha256:${createHash("sha256")
+    .update(domain)
+    .update("\0")
+    .update(canonical(value))
+    .digest("hex")}`;
+}
+
+function exact(value, keys, label) {
+  if (
+    !value ||
+    typeof value !== "object" ||
+    Array.isArray(value) ||
+    utilTypes.isProxy(value) ||
+    Reflect.ownKeys(value).length !== keys.size ||
+    Reflect.ownKeys(value).some(
+      (key) => typeof key !== "string" || !keys.has(key),
+    )
+  ) {
+    throw new TypeError(`${label} is invalid`);
+  }
+  for (const key of Reflect.ownKeys(value)) {
+    const descriptor = Object.getOwnPropertyDescriptor(value, key);
+    if (!descriptor || !("value" in descriptor) || !descriptor.enumerable) {
+      throw new TypeError(`${label}.${String(key)} is invalid`);
+    }
+  }
+  return value;
+}
+
+function identifier(value, label) {
+  if (typeof value !== "string" || !SAFE_ID.test(value)) {
+    throw new TypeError(`${label} is invalid`);
+  }
+  return value;
+}
+
+function boundedText(value, label, maximum = 4096) {
+  if (
+    typeof value !== "string" ||
+    value.trim() === "" ||
+    value.length > maximum
+  ) {
+    throw new TypeError(`${label} is invalid or unbounded`);
+  }
+  return value.trim();
+}
+
+function capture(owner, method, label) {
+  if (!owner || typeof owner !== "object" || utilTypes.isProxy(owner)) {
+    throw new TypeError(`${label}.${method}() is required`);
+  }
+  const operation = owner[method];
+  if (typeof operation !== "function" || utilTypes.isProxy(operation)) {
+    throw new TypeError(`${label}.${method}() is required`);
+  }
+  return Object.freeze((...args) => Reflect.apply(operation, owner, args));
+}
+
+function corpusFor(skills) {
+  if (
+    !Array.isArray(skills) ||
+    utilTypes.isProxy(skills) ||
+    skills.length < 1 ||
+    skills.length > MAX_SKILLS
+  ) {
+    throw new TypeError("Skill vector corpus is invalid or unbounded");
+  }
+  let bytes = 0;
+  const digests = new Set();
+  const corpus = skills.map((skill, index) => {
+    if (!skill || typeof skill !== "object" || utilTypes.isProxy(skill)) {
+      throw new TypeError(`Skill vector corpus[${index}] is invalid`);
+    }
+    const digest = skill.executionIdentity?.contentDigest;
+    if (!DIGEST.test(digest ?? "") || digests.has(digest)) {
+      throw new TypeError(
+        "Skill vector corpus has a missing or duplicate digest",
+      );
+    }
+    digests.add(digest);
+    const entry = {
+      digest,
+      id: boundedText(skill.id, `skills[${index}].id`, 256),
+      displayName: boundedText(
+        skill.displayName || skill.id,
+        `skills[${index}].displayName`,
+        512,
+      ),
+      description: boundedText(
+        skill.description || "(no description)",
+        `skills[${index}].description`,
+        16_384,
+      ),
+      category: boundedText(
+        skill.category || "uncategorized",
+        `skills[${index}].category`,
+        128,
+      ),
+      tags: Array.isArray(skill.tags)
+        ? skill.tags.map((tag, tagIndex) =>
+            boundedText(tag, `skills[${index}].tags[${tagIndex}]`, 128),
+          )
+        : [],
+    };
+    if (
+      entry.tags.length > 64 ||
+      new Set(entry.tags).size !== entry.tags.length
+    ) {
+      throw new TypeError("Skill vector corpus tags are invalid or unbounded");
+    }
+    bytes += Buffer.byteLength(canonical(entry), "utf8");
+    if (bytes > MAX_TEXT_BYTES) {
+      throw new TypeError("Skill vector corpus is invalid or unbounded");
+    }
+    return Object.freeze({ ...entry, tags: Object.freeze(entry.tags) });
+  });
+  corpus.sort((left, right) => left.digest.localeCompare(right.digest));
+  return Object.freeze(corpus);
+}
+
+export function digestSkillVectorResult(value) {
+  return hash(SKILL_VECTOR_RESULT_SCHEMA, {
+    schema: value.schema,
+    tenantId: value.tenantId,
+    requestDigest: value.requestDigest,
+    corpusDigest: value.corpusDigest,
+    modelId: value.modelId,
+    modelRevision: value.modelRevision,
+    indexDigest: value.indexDigest,
+    scores: value.scores,
+  });
+}
+
+export function createSkillVectorAuthority({
+  tenantId: tenantIdInput,
+  provider,
+  verifier,
+} = {}) {
+  const tenantId = identifier(tenantIdInput, "tenantId");
+  const scoreProvider = capture(provider, "score", "Skill vector provider");
+  const verifyResult = capture(verifier, "verify", "Skill vector verifier");
+  const authority = Object.freeze({
+    tenantId,
+    async score({ query: queryInput, skills } = {}) {
+      const query = boundedText(queryInput, "Skill vector query");
+      const corpus = corpusFor(skills);
+      const corpusDigest = hash(
+        "chainlesschain.skill-vector-corpus/v1",
+        corpus,
+      );
+      const requestCore = {
+        schema: SKILL_VECTOR_REQUEST_SCHEMA,
+        tenantId,
+        query,
+        corpusDigest,
+        corpus,
+      };
+      const request = Object.freeze({
+        ...requestCore,
+        requestDigest: hash(SKILL_VECTOR_REQUEST_SCHEMA, requestCore),
+      });
+      const result = exact(
+        await scoreProvider(request),
+        RESULT_KEYS,
+        "Skill vector result",
+      );
+      if (
+        result.schema !== SKILL_VECTOR_RESULT_SCHEMA ||
+        result.tenantId !== tenantId ||
+        result.requestDigest !== request.requestDigest ||
+        result.corpusDigest !== corpusDigest ||
+        !SAFE_ID.test(result.modelId ?? "") ||
+        !SAFE_ID.test(result.modelRevision ?? "") ||
+        !DIGEST.test(result.indexDigest ?? "") ||
+        !DIGEST.test(result.resultDigest ?? "") ||
+        !Array.isArray(result.scores) ||
+        utilTypes.isProxy(result.scores) ||
+        result.scores.length !== corpus.length
+      ) {
+        throw new Error("Skill vector result is not authoritative");
+      }
+      const expected = new Set(corpus.map(({ digest }) => digest));
+      const scores = new Map();
+      for (const [index, input] of result.scores.entries()) {
+        const entry = exact(input, SCORE_KEYS, `Skill vector scores[${index}]`);
+        if (
+          !expected.has(entry.digest) ||
+          scores.has(entry.digest) ||
+          typeof entry.score !== "number" ||
+          !Number.isFinite(entry.score) ||
+          entry.score < 0 ||
+          entry.score > 1
+        ) {
+          throw new Error("Skill vector scores are invalid or incomplete");
+        }
+        scores.set(entry.digest, entry.score);
+      }
+      if (scores.size !== expected.size) {
+        throw new Error("Skill vector scores are invalid or incomplete");
+      }
+      exact(result.attestation, ATTESTATION_KEYS, "Skill vector attestation");
+      if (
+        result.attestation.schema !== SKILL_VECTOR_ATTESTATION_SCHEMA ||
+        !SAFE_ID.test(result.attestation.algorithm ?? "") ||
+        !SAFE_ID.test(result.attestation.keyId ?? "") ||
+        typeof result.attestation.value !== "string" ||
+        result.attestation.value.length < 16 ||
+        result.attestation.value.length > 4096
+      ) {
+        throw new Error("Skill vector attestation is invalid");
+      }
+      if (result.resultDigest !== digestSkillVectorResult(result)) {
+        throw new Error("Skill vector result integrity is invalid");
+      }
+      const verification = exact(
+        await verifyResult({
+          tenantId,
+          requestDigest: request.requestDigest,
+          resultDigest: result.resultDigest,
+          attestation: result.attestation,
+        }),
+        VERIFICATION_KEYS,
+        "Skill vector verification",
+      );
+      if (
+        verification.authenticated !== true ||
+        verification.durable !== true ||
+        verification.tenantId !== tenantId ||
+        verification.requestDigest !== request.requestDigest ||
+        verification.resultDigest !== result.resultDigest ||
+        !DIGEST.test(verification.receiptDigest ?? "")
+      ) {
+        throw new Error("Skill vector result is not independently verified");
+      }
+      return Object.freeze({
+        scores: Object.freeze(Object.fromEntries(scores)),
+        evidence: Object.freeze({
+          schema: SKILL_VECTOR_AUTHORITY_SCHEMA,
+          status: "verified",
+          tenantId,
+          requestDigest: request.requestDigest,
+          corpusDigest,
+          skillCount: corpus.length,
+          modelId: result.modelId,
+          modelRevision: result.modelRevision,
+          indexDigest: result.indexDigest,
+          resultDigest: result.resultDigest,
+          receiptDigest: verification.receiptDigest,
+        }),
+      });
+    },
+  });
+  AUTHORITIES.add(authority);
+  return authority;
+}
+
+export function captureSkillVectorAuthority(value) {
+  if (!AUTHORITIES.has(value)) {
+    throw new TypeError("a branded Skill vector authority is required");
+  }
+  return value;
+}
+
+export function unavailableSkillVectorEvidence(
+  code = "CC_SKILL_VECTOR_AUTHORITY_UNCONFIGURED",
+) {
+  if (!/^CC_SKILL_VECTOR_[A-Z0-9_]{1,96}$/u.test(code)) {
+    throw new TypeError("Skill vector unavailable code is invalid");
+  }
+  return Object.freeze({
+    schema: SKILL_VECTOR_AUTHORITY_SCHEMA,
+    status: "unavailable",
+    code,
+  });
+}

package/src/lib/skill-vector-process-authority.js

@@ -0,0 +1,386 @@
+import { createHash } from "node:crypto";
+import fs from "node:fs";
+import path from "node:path";
+import { types as utilTypes } from "node:util";
+
+import { executionBroker } from "./process-execution-broker/index.js";
+import { createSkillVectorAuthority } from "./skill-vector-authority.js";
+
+export const SKILL_VECTOR_PROCESS_REQUEST_SCHEMA =
+  "chainlesschain.skill-vector-process-request/v1";
+
+const DIGEST = /^sha256:[a-f0-9]{64}$/u;
+const SAFE_ID = /^[A-Za-z0-9][A-Za-z0-9._:@/-]{0,255}$/u;
+const WORKER_KEYS = new Set([
+  "arguments",
+  "cwd",
+  "entryDigest",
+  "entryPath",
+  "environment",
+  "executableDigest",
+  "executablePath",
+  "identity",
+]);
+const DEFAULT_TIMEOUT_MS = 10_000;
+const DEFAULT_MAX_INPUT_BYTES = 12 * 1024 * 1024;
+const DEFAULT_MAX_OUTPUT_BYTES = 4 * 1024 * 1024;
+const MAX_STDERR_BYTES = 64 * 1024;
+const MAX_EXECUTABLE_BYTES = 512 * 1024 * 1024;
+const MAX_ENTRY_BYTES = 16 * 1024 * 1024;
+const PROCESS_DEPS = Object.freeze({
+  spawn: (...args) => executionBroker.spawn(...args),
+});
+
+function plainRecord(value, label, allowedKeys = null) {
+  if (
+    !value ||
+    typeof value !== "object" ||
+    Array.isArray(value) ||
+    utilTypes.isProxy(value) ||
+    ![Object.prototype, null].includes(Object.getPrototypeOf(value)) ||
+    (allowedKeys &&
+      Reflect.ownKeys(value).some(
+        (key) => typeof key !== "string" || !allowedKeys.has(key),
+      ))
+  ) {
+    throw new TypeError(`${label} is invalid`);
+  }
+  return value;
+}
+
+function identifier(value, label) {
+  if (typeof value !== "string" || !SAFE_ID.test(value)) {
+    throw new TypeError(`${label} is invalid`);
+  }
+  return value;
+}
+
+function pinnedDigest(value, label) {
+  if (typeof value !== "string" || !DIGEST.test(value)) {
+    throw new TypeError(`${label} must be sha256-bound`);
+  }
+  return value;
+}
+
+function absolutePath(value, label) {
+  if (
+    typeof value !== "string" ||
+    value.includes("\0") ||
+    !path.isAbsolute(value) ||
+    path.normalize(value) !== value
+  ) {
+    throw new TypeError(`${label} must be a normalized absolute path`);
+  }
+  return value;
+}
+
+function boundedInteger(value, fallback, label, maximum) {
+  const normalized = value === undefined ? fallback : value;
+  if (
+    !Number.isSafeInteger(normalized) ||
+    normalized < 1 ||
+    normalized > maximum
+  ) {
+    throw new TypeError(`${label} is invalid or unbounded`);
+  }
+  return normalized;
+}
+
+function normalizeArguments(value, label) {
+  if (value === undefined) return Object.freeze([]);
+  if (!Array.isArray(value) || utilTypes.isProxy(value) || value.length > 64) {
+    throw new TypeError(`${label} is invalid or unbounded`);
+  }
+  let bytes = 0;
+  const result = value.map((argument, index) => {
+    if (
+      typeof argument !== "string" ||
+      argument.includes("\0") ||
+      Buffer.byteLength(argument, "utf8") > 4096
+    ) {
+      throw new TypeError(`${label}[${index}] is invalid or unbounded`);
+    }
+    bytes += Buffer.byteLength(argument, "utf8");
+    return argument;
+  });
+  if (bytes > 32 * 1024) {
+    throw new TypeError(`${label} is invalid or unbounded`);
+  }
+  return Object.freeze(result);
+}
+
+function normalizeEnvironment(value, label) {
+  if (value === undefined) return Object.freeze({});
+  plainRecord(value, label);
+  const entries = Object.entries(value);
+  if (entries.length > 64) {
+    throw new TypeError(`${label} is invalid or unbounded`);
+  }
+  let bytes = 0;
+  const result = Object.create(null);
+  const normalizedKeys = new Set();
+  for (const [key, entry] of entries.sort(([left], [right]) =>
+    left.localeCompare(right),
+  )) {
+    const normalizedKey =
+      process.platform === "win32" ? key.toLowerCase() : key;
+    if (
+      !/^[A-Za-z_][A-Za-z0-9_]{0,127}$/u.test(key) ||
+      normalizedKeys.has(normalizedKey) ||
+      typeof entry !== "string" ||
+      entry.includes("\0") ||
+      Buffer.byteLength(entry, "utf8") > 16 * 1024
+    ) {
+      throw new TypeError(`${label}.${key} is invalid or unbounded`);
+    }
+    bytes += Buffer.byteLength(key, "utf8") + Buffer.byteLength(entry, "utf8");
+    normalizedKeys.add(normalizedKey);
+    result[key] = entry;
+  }
+  if (bytes > 32 * 1024) {
+    throw new TypeError(`${label} is invalid or unbounded`);
+  }
+  return Object.freeze(result);
+}
+
+function normalizeWorker(value, label) {
+  plainRecord(value, label, WORKER_KEYS);
+  return Object.freeze({
+    identity: identifier(value.identity, `${label}.identity`),
+    executablePath: absolutePath(
+      value.executablePath,
+      `${label}.executablePath`,
+    ),
+    executableDigest: pinnedDigest(
+      value.executableDigest,
+      `${label}.executableDigest`,
+    ),
+    entryPath: absolutePath(value.entryPath, `${label}.entryPath`),
+    entryDigest: pinnedDigest(value.entryDigest, `${label}.entryDigest`),
+    arguments: normalizeArguments(value.arguments, `${label}.arguments`),
+    cwd: absolutePath(value.cwd, `${label}.cwd`),
+    environment: normalizeEnvironment(
+      value.environment,
+      `${label}.environment`,
+    ),
+  });
+}
+
+function fileDigest(filePath) {
+  return `sha256:${createHash("sha256").update(fs.readFileSync(filePath)).digest("hex")}`;
+}
+
+function samePath(left, right) {
+  return process.platform === "win32"
+    ? left.toLowerCase() === right.toLowerCase()
+    : left === right;
+}
+
+function assertPinnedFile(filePath, expectedDigest, label, maximumBytes) {
+  const stat = fs.lstatSync(filePath);
+  if (
+    !stat.isFile() ||
+    stat.isSymbolicLink() ||
+    stat.size < 1 ||
+    stat.size > maximumBytes
+  ) {
+    throw new Error(`${label} is not a regular pinned file`);
+  }
+  const realPath = fs.realpathSync.native(filePath);
+  if (!samePath(realPath, filePath)) {
+    throw new Error(`${label} does not resolve to its pinned path`);
+  }
+  if (fileDigest(filePath) !== expectedDigest) {
+    throw new Error(`${label} digest changed`);
+  }
+}
+
+function assertWorkerIdentity(worker, label) {
+  assertPinnedFile(
+    worker.executablePath,
+    worker.executableDigest,
+    `${label} executable`,
+    MAX_EXECUTABLE_BYTES,
+  );
+  assertPinnedFile(
+    worker.entryPath,
+    worker.entryDigest,
+    `${label} entry`,
+    MAX_ENTRY_BYTES,
+  );
+  const cwd = fs.realpathSync.native(worker.cwd);
+  if (!samePath(cwd, worker.cwd) || !fs.statSync(cwd).isDirectory()) {
+    throw new Error(`${label} cwd does not resolve to its pinned directory`);
+  }
+}
+
+function processFailure(code) {
+  const error = new Error(`Skill vector process failed closed (${code})`);
+  error.code = code;
+  return error;
+}
+
+async function invokeWorker(
+  worker,
+  role,
+  payload,
+  { timeoutMs, maxInputBytes, maxOutputBytes },
+) {
+  assertWorkerIdentity(worker, role);
+  const input = Buffer.from(
+    `${JSON.stringify({
+      schema: SKILL_VECTOR_PROCESS_REQUEST_SCHEMA,
+      role,
+      payload,
+    })}\n`,
+    "utf8",
+  );
+  if (input.length > maxInputBytes) {
+    throw processFailure("CC_SKILL_VECTOR_PROCESS_INPUT_LIMIT");
+  }
+
+  const output = await new Promise((resolve, reject) => {
+    let settled = false;
+    let pendingFailure = null;
+    let timer = null;
+    let stdoutBytes = 0;
+    let stderrBytes = 0;
+    const stdout = [];
+    const child = PROCESS_DEPS.spawn(
+      worker.executablePath,
+      [worker.entryPath, ...worker.arguments],
+      {
+        cwd: worker.cwd,
+        env: { ...worker.environment },
+        shell: false,
+        windowsHide: true,
+        stdio: ["pipe", "pipe", "pipe"],
+        origin: "skill-vector-process-authority",
+        scope: "evolution",
+        policy: "allow",
+        auditRedactArgIndexes: worker.arguments.map((_, index) => index + 1),
+      },
+    );
+    const terminate = (error) => {
+      if (settled || pendingFailure) return;
+      pendingFailure = error;
+      if (child.exitCode === null) child.kill("SIGKILL");
+    };
+    timer = setTimeout(() => {
+      terminate(processFailure("CC_SKILL_VECTOR_PROCESS_TIMEOUT"));
+    }, timeoutMs);
+    timer.unref?.();
+    child.once("error", () => {
+      terminate(processFailure("CC_SKILL_VECTOR_PROCESS_SPAWN_FAILED"));
+    });
+    child.stdout.on("data", (chunk) => {
+      if (pendingFailure) return;
+      stdoutBytes += chunk.length;
+      if (stdoutBytes > maxOutputBytes) {
+        terminate(processFailure("CC_SKILL_VECTOR_PROCESS_OUTPUT_LIMIT"));
+        return;
+      }
+      stdout.push(chunk);
+    });
+    child.stderr.on("data", (chunk) => {
+      if (pendingFailure) return;
+      stderrBytes += chunk.length;
+      if (stderrBytes > MAX_STDERR_BYTES) {
+        terminate(processFailure("CC_SKILL_VECTOR_PROCESS_STDERR_LIMIT"));
+      }
+    });
+    child.once("close", (code, signal) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      if (pendingFailure) {
+        reject(pendingFailure);
+        return;
+      }
+      if (code !== 0 || signal !== null) {
+        reject(processFailure("CC_SKILL_VECTOR_PROCESS_EXITED"));
+        return;
+      }
+      resolve(Buffer.concat(stdout).toString("utf8"));
+    });
+    child.stdin.once("error", () => {
+      terminate(processFailure("CC_SKILL_VECTOR_PROCESS_STDIN_FAILED"));
+    });
+    child.stdin.end(input);
+  });
+
+  assertWorkerIdentity(worker, role);
+  const text = output.trim();
+  if (text === "" || Buffer.byteLength(text, "utf8") > maxOutputBytes) {
+    throw processFailure("CC_SKILL_VECTOR_PROCESS_EMPTY_OUTPUT");
+  }
+  try {
+    const parsed = JSON.parse(text);
+    plainRecord(parsed, `${role} process result`);
+    return parsed;
+  } catch (error) {
+    if (error?.code?.startsWith?.("CC_SKILL_VECTOR_")) throw error;
+    throw processFailure("CC_SKILL_VECTOR_PROCESS_INVALID_JSON");
+  }
+}
+
+/**
+ * Creates the existing branded vector authority over two independently pinned
+ * JSON worker processes. The host supplies all executable and entry digests;
+ * no PATH lookup, shell, inherited environment, local key or permissive
+ * verifier fallback is used.
+ */
+export function createSkillVectorProcessAuthority({
+  tenantId,
+  provider: providerInput,
+  verifier: verifierInput,
+  timeoutMs: timeoutInput,
+  maxInputBytes: maxInputInput,
+  maxOutputBytes: maxOutputInput,
+} = {}) {
+  const provider = normalizeWorker(providerInput, "provider");
+  const verifier = normalizeWorker(verifierInput, "verifier");
+  if (
+    provider.identity === verifier.identity ||
+    provider.entryDigest === verifier.entryDigest
+  ) {
+    throw new TypeError(
+      "Skill vector provider and verifier must be independent",
+    );
+  }
+  const limits = Object.freeze({
+    timeoutMs: boundedInteger(
+      timeoutInput,
+      DEFAULT_TIMEOUT_MS,
+      "timeoutMs",
+      60_000,
+    ),
+    maxInputBytes: boundedInteger(
+      maxInputInput,
+      DEFAULT_MAX_INPUT_BYTES,
+      "maxInputBytes",
+      16 * 1024 * 1024,
+    ),
+    maxOutputBytes: boundedInteger(
+      maxOutputInput,
+      DEFAULT_MAX_OUTPUT_BYTES,
+      "maxOutputBytes",
+      8 * 1024 * 1024,
+    ),
+  });
+  assertWorkerIdentity(provider, "provider");
+  assertWorkerIdentity(verifier, "verifier");
+  return createSkillVectorAuthority({
+    tenantId,
+    provider: Object.freeze({
+      score: Object.freeze((request) =>
+        invokeWorker(provider, "provider", request, limits),
+      ),
+    }),
+    verifier: Object.freeze({
+      verify: Object.freeze((request) =>
+        invokeWorker(verifier, "verifier", request, limits),
+      ),
+    }),
+  });
+}