chainlesschain 0.166.21 → 0.166.24

package/src/lib/evolution/governed-knowledge-artifact-lifecycle.js

@@ -0,0 +1,364 @@
+import { types as utilTypes } from "node:util";
+
+import evolvableArtifactProtocol from "@chainlesschain/session-core/evolvable-artifact";
+
+import {
+  isEvolvableArtifactReleaseResolver,
+  isEvolvableArtifactTransitionReader,
+} from "./evolvable-artifact-ledger-adapter.js";
+import { verifyGovernedKnowledgeRecord } from "./governed-knowledge-sync.js";
+
+const {
+  ARTIFACT_TYPE,
+  createEvolvableArtifactReceipt,
+  digestEvolvableArtifactValue,
+  isEvolvableArtifactCandidateGate,
+  isEvolvableArtifactReleaseGate,
+} = evolvableArtifactProtocol;
+
+export const GOVERNED_KNOWLEDGE_ARTIFACT_LIFECYCLE_SCHEMA =
+  "chainlesschain.governed-knowledge-artifact-lifecycle/v1";
+
+const LIFECYCLES = new WeakSet();
+const DIGEST = /^sha256:[a-f0-9]{64}$/u;
+const ID = /^[A-Za-z0-9][A-Za-z0-9._:@/-]{0,255}$/u;
+const OPERATIONS = new Set(["publish", "receive", "merge"]);
+
+function freeze(value) {
+  const result = structuredClone(value);
+  function visit(entry) {
+    if (entry && typeof entry === "object" && !Object.isFrozen(entry)) {
+      Object.freeze(entry);
+      for (const child of Object.values(entry)) visit(child);
+    }
+  }
+  visit(result);
+  return result;
+}
+
+function capture(owner, method, label) {
+  if (
+    !owner ||
+    typeof owner !== "object" ||
+    utilTypes.isProxy(owner) ||
+    typeof owner[method] !== "function"
+  )
+    throw new TypeError(`${label}.${method}() is required`);
+  return (...args) => Reflect.apply(owner[method], owner, args);
+}
+
+function manifest(body) {
+  return freeze({ ...body, digest: digestEvolvableArtifactValue(body) });
+}
+
+function receipt(artifact, kind, issuedAt, operationDigest, claims) {
+  return createEvolvableArtifactReceipt({
+    kind,
+    tenantId: artifact.tenantId,
+    artifactId: artifact.artifactId,
+    candidateId: artifact.candidate.candidateId,
+    contentDigest: artifact.contentDigest,
+    dependencyLockDigest: artifact.dependencyLock.digest,
+    issuerId: `governed-knowledge-lifecycle:${kind}`,
+    issuerRevision: "v1",
+    issuedAt,
+    decision: "allow",
+    claims: { operationDigest, ...claims },
+  });
+}
+
+export function createGovernedKnowledgeArtifactLifecycle({
+  tenantId,
+  artifactCandidateGate,
+  artifactReleaseGate,
+  artifactReleaseResolver,
+  verifierArtifactTransitionReader,
+} = {}) {
+  if (typeof tenantId !== "string" || tenantId.trim() === "")
+    throw new TypeError("tenantId is required");
+  if (
+    !isEvolvableArtifactCandidateGate(
+      artifactCandidateGate,
+      ARTIFACT_TYPE.KNOWLEDGE,
+    ) ||
+    artifactCandidateGate.tenantId !== tenantId
+  )
+    throw new TypeError("a tenant-bound Knowledge candidate gate is required");
+  if (
+    !isEvolvableArtifactReleaseGate(
+      artifactReleaseGate,
+      ARTIFACT_TYPE.KNOWLEDGE,
+    ) ||
+    artifactReleaseGate.tenantId !== tenantId ||
+    artifactReleaseGate.authorityScope !== artifactCandidateGate.authorityScope
+  )
+    throw new TypeError("a same-authority Knowledge release gate is required");
+  if (
+    !isEvolvableArtifactReleaseResolver(artifactReleaseResolver) ||
+    artifactReleaseResolver.tenantId !== tenantId
+  )
+    throw new TypeError("a tenant-bound artifact release resolver is required");
+  if (
+    !isEvolvableArtifactTransitionReader(verifierArtifactTransitionReader) ||
+    verifierArtifactTransitionReader.tenantId !== tenantId ||
+    verifierArtifactTransitionReader.readerScope ===
+      artifactReleaseGate.transitionReaderScope
+  )
+    throw new TypeError(
+      "an independent artifact transition reader is required",
+    );
+
+  const stageCandidate = capture(
+    artifactCandidateGate,
+    "stageCandidate",
+    "artifactCandidateGate",
+  );
+  const preparePromotion = capture(
+    artifactReleaseGate,
+    "preparePromotion",
+    "artifactReleaseGate",
+  );
+  const commitPromotion = capture(
+    artifactReleaseGate,
+    "commitPreparedPromotion",
+    "artifactReleaseGate",
+  );
+  const resolveDependency = capture(
+    artifactReleaseResolver,
+    "resolveDependency",
+    "artifactReleaseResolver",
+  );
+  const readTransition = capture(
+    verifierArtifactTransitionReader,
+    "readTransition",
+    "verifierArtifactTransitionReader",
+  );
+  const preparedHandles = new WeakSet();
+
+  async function resolveOne(dependency) {
+    const resolved = await resolveDependency({ tenantId, ...dependency });
+    if (
+      resolved?.authenticated !== true ||
+      resolved.durable !== true ||
+      resolved.tenantId !== tenantId ||
+      resolved.sourceKind !== dependency.kind ||
+      resolved.sourceDigest !== dependency.digest ||
+      resolved.sourceDisposition !== dependency.disposition ||
+      !DIGEST.test(resolved.artifactDigest ?? "")
+    )
+      throw new Error("Knowledge artifact dependency resolution is invalid");
+    return {
+      artifactId: resolved.artifactId,
+      type: resolved.type,
+      releaseId: resolved.releaseId,
+      contentDigest: resolved.contentDigest,
+    };
+  }
+
+  async function resolveBaseline(currentKnowledge) {
+    if (currentKnowledge === null) return null;
+    const resolved = await resolveOne({
+      kind: "active-knowledge",
+      digest: currentKnowledge.contentDigest,
+      disposition: "baseline",
+    });
+    if (resolved.artifactId !== currentKnowledge.knowledgeId)
+      throw new Error("Knowledge typed baseline resolved another artifact");
+    return resolved;
+  }
+
+  const lifecycle = Object.freeze({
+    schema: GOVERNED_KNOWLEDGE_ARTIFACT_LIFECYCLE_SCHEMA,
+    tenantId,
+    async prepare({
+      knowledge: knowledgeInput,
+      currentKnowledge: currentInput = null,
+      operation,
+      operationId,
+      authorizationReceiptDigest,
+      evidenceDigest = null,
+      issuedAt,
+      activate = true,
+      humanReviewed = false,
+    } = {}) {
+      if (!OPERATIONS.has(operation))
+        throw new TypeError("Knowledge lifecycle operation is invalid");
+      if (!ID.test(operationId ?? ""))
+        throw new TypeError("Knowledge lifecycle operationId is required");
+      if (!DIGEST.test(authorizationReceiptDigest ?? ""))
+        throw new TypeError("authorizationReceiptDigest is invalid");
+      if (!Number.isFinite(Date.parse(issuedAt)))
+        throw new TypeError("Knowledge lifecycle issuedAt is invalid");
+      const boundEvidenceDigest = evidenceDigest ?? authorizationReceiptDigest;
+      if (
+        !DIGEST.test(boundEvidenceDigest) ||
+        typeof humanReviewed !== "boolean"
+      )
+        throw new TypeError("Knowledge lifecycle evidence is invalid");
+      const knowledge = verifyGovernedKnowledgeRecord(knowledgeInput, {
+        tenantId,
+      });
+      const currentKnowledge =
+        currentInput === null
+          ? null
+          : verifyGovernedKnowledgeRecord(currentInput, { tenantId });
+      if (
+        currentKnowledge !== null &&
+        (currentKnowledge.knowledgeId !== knowledge.knowledgeId ||
+          currentKnowledge.scope !== knowledge.scope ||
+          currentKnowledge.scopeId !== knowledge.scopeId)
+      )
+        throw new Error("Knowledge lifecycle baseline boundary changed");
+      const baseline = await resolveBaseline(currentKnowledge);
+      const dependencies = [];
+      if (knowledge.action === "upsert") {
+        for (const dependency of knowledge.dependencies)
+          dependencies.push(await resolveOne(dependency));
+      }
+      dependencies.sort((left, right) =>
+        left.artifactId.localeCompare(right.artifactId),
+      );
+      const dependencyLock = {
+        dependencies,
+        digest: digestEvolvableArtifactValue({ dependencies }),
+      };
+      const operationCore = {
+        tenantId,
+        operation,
+        operationId,
+        knowledgeId: knowledge.knowledgeId,
+        contentDigest: knowledge.contentDigest,
+        currentContentDigest: currentKnowledge?.contentDigest ?? null,
+        authorizationReceiptDigest,
+        evidenceDigest: boundEvidenceDigest,
+        humanReviewed,
+      };
+      const operationDigest = digestEvolvableArtifactValue(operationCore);
+      const staged = await stageCandidate({
+        tenantId,
+        artifactId: knowledge.knowledgeId,
+        type: ARTIFACT_TYPE.KNOWLEDGE,
+        contentDigest: knowledge.contentDigest,
+        parent:
+          baseline === null
+            ? null
+            : {
+                artifactId: baseline.artifactId,
+                releaseId: baseline.releaseId,
+                contentDigest: baseline.contentDigest,
+              },
+        lineage: [
+          ...(currentKnowledge ? [currentKnowledge.contentDigest] : []),
+          knowledge.contentDigest,
+        ],
+        dependencyLock,
+        runtimeManifest: manifest({
+          executable: false,
+          operation,
+          operationId,
+          operationDigest,
+          action: knowledge.action,
+          scope: knowledge.scope,
+          scopeId: knowledge.scopeId,
+          vectorClock: knowledge.vectorClock,
+          dependencyDispositionDigest: digestEvolvableArtifactValue(
+            knowledge.dependencies,
+          ),
+        }),
+        permissionManifest: manifest({
+          authorizationReceiptDigest,
+          approvalReceiptDigest: knowledge.approvalReceiptDigest,
+          revocationReceiptDigest: knowledge.revocationReceiptDigest,
+          capabilities: [`knowledge:${knowledge.scope}:${operation}`],
+        }),
+        candidateId: `knowledge-candidate:${operationDigest.slice(7)}`,
+        activeReleaseId: baseline?.releaseId ?? null,
+        lastKnownGoodReleaseId: null,
+      });
+      const promotion = activate
+        ? preparePromotion({
+            artifact: staged.artifact,
+            candidatePersistenceReceipt: staged.receipt,
+            evaluationReceipt: receipt(
+              staged.artifact,
+              "eval",
+              issuedAt,
+              operationDigest,
+              { authorizationReceiptDigest },
+            ),
+            reviewReceipt: receipt(
+              staged.artifact,
+              "review",
+              issuedAt,
+              operationDigest,
+              {
+                approvalReceiptDigest: knowledge.approvalReceiptDigest,
+                automated: !humanReviewed,
+                evidenceDigest: boundEvidenceDigest,
+              },
+            ),
+            promotionReceipt: receipt(
+              staged.artifact,
+              "promotion",
+              issuedAt,
+              operationDigest,
+              { operationId },
+            ),
+            releaseId: `knowledge-release:${operationDigest.slice(7)}`,
+          })
+        : null;
+      const prepared = Object.freeze({
+        operationDigest,
+        operation,
+        operationId,
+        candidate: staged,
+        promotion,
+        activate,
+      });
+      preparedHandles.add(prepared);
+      return prepared;
+    },
+    async commit(prepared) {
+      if (!preparedHandles.has(prepared))
+        throw new TypeError(
+          "a prepared Knowledge lifecycle handle is required",
+        );
+      if (!prepared.activate)
+        return freeze({
+          candidateOnly: true,
+          artifactCandidateDigest: prepared.candidate.artifact.artifactDigest,
+          operationDigest: prepared.operationDigest,
+        });
+      const committed = await commitPromotion(prepared.promotion);
+      const readback = await readTransition({
+        operationId: committed.receipt.operationId,
+      });
+      if (
+        readback?.request?.previousArtifactDigest !==
+          prepared.candidate.artifact.artifactDigest ||
+        readback.request.nextArtifactDigest !==
+          committed.artifact.artifactDigest ||
+        readback.artifact.artifactDigest !==
+          committed.artifact.artifactDigest ||
+        readback.receipt.receiptDigest !== committed.receipt.receiptDigest ||
+        readback.receipt.durable !== true
+      )
+        throw new Error("Knowledge artifact transition readback is invalid");
+      return freeze({
+        candidateOnly: false,
+        operationDigest: prepared.operationDigest,
+        artifactCandidateDigest: prepared.candidate.artifact.artifactDigest,
+        artifactDigest: committed.artifact.artifactDigest,
+        artifactReleaseId: committed.artifact.activeReleaseId,
+        artifactTransitionOperationId: committed.receipt.operationId,
+        artifactTransitionReceiptDigest: committed.receipt.receiptDigest,
+      });
+    },
+  });
+  LIFECYCLES.add(lifecycle);
+  return lifecycle;
+}
+
+export function isGovernedKnowledgeArtifactLifecycle(value) {
+  return LIFECYCLES.has(value);
+}

package/src/lib/evolution/governed-knowledge-candidate-rejection.js

@@ -0,0 +1,343 @@
+import { captureSkillCandidateRegistryReader } from "./skill-candidate-registry.js";
+import { captureSkillReleaseRegistryReader } from "./skill-release-registry.js";
+import { captureSkillReleaseOperationReader } from "./evolution-ledger-ports.js";
+import { captureWikiRevisionReader } from "./wiki-maintainer-ledger-adapter.js";
+import { governedKnowledgeSourceRef } from "./governed-knowledge-skill-rollback.js";
+import {
+  createGovernedKnowledgeDependencyAuthority,
+  GOVERNED_KNOWLEDGE_DEPENDENCY_RESULT_SCHEMA,
+  digestGovernedKnowledgeDependencyResult,
+} from "./governed-knowledge-dependency-authority.js";
+import {
+  capturePruningData as captureData,
+  pruningDigest as digest,
+  pruningCanonical as canonical,
+} from "./governed-wiki-pruning-journal.js";
+
+const VERIFICATION_SCHEMA =
+  "chainlesschain.knowledge-candidate-rejection-verification/v1";
+const QUARANTINE_VERIFICATION_SCHEMA =
+  "chainlesschain.knowledge-candidate-quarantine-verification/v1";
+function fail(message) {
+  throw new Error(`knowledge candidate disposition: ${message}`);
+}
+
+function bindReader(
+  candidateRegistry,
+  releaseRegistry,
+  transactionLedger,
+  tenantId,
+  wikiAdapter,
+) {
+  const candidates = captureSkillCandidateRegistryReader(candidateRegistry);
+  const releases = captureSkillReleaseRegistryReader(releaseRegistry);
+  if (
+    candidates.tenantId !== tenantId ||
+    releases.tenantId !== tenantId ||
+    !releases.matchesTransactionLedger(transactionLedger)
+  ) {
+    throw new TypeError(
+      "candidate rejection registry/ledger tenant binding differs",
+    );
+  }
+  const operations = captureSkillReleaseOperationReader(transactionLedger);
+  const wiki =
+    wikiAdapter == null ? null : captureWikiRevisionReader(wikiAdapter);
+  if (
+    wiki &&
+    (wiki.descriptor.tenantId !== tenantId ||
+      !operations.matchesWikiAdapter(wikiAdapter))
+  )
+    throw new TypeError("candidate Wiki tenant differs");
+  return Object.freeze({ candidates, releases, operations, wiki });
+}
+
+function sourceProof(reader, candidate, request, admission) {
+  const ref = governedKnowledgeSourceRef(request);
+  const direct = candidate.sourceEvidenceRefs.some(
+    (entry) => entry.ref === ref && entry.digest === request.contentDigest,
+  );
+  let wiki = null;
+  if (candidate.derivationMode === "wiki") {
+    if (!reader.wiki)
+      fail("Wiki-derived candidate requires an authenticated Wiki reader");
+    const revision = reader.wiki.readKnowledgeProvenance({
+      tenantId: request.tenantId,
+      revisionId: candidate.wikiRevision,
+      knowledgeId: request.knowledgeId,
+      contentDigest: request.contentDigest,
+    });
+    if (
+      ["epoch", "ledgerId", "identityDigest"].some(
+        (key) => revision.checkpoint[key] !== admission.checkpoint[key],
+      ) ||
+      revision.checkpoint.sequence >= admission.fence.sequence ||
+      admission.history.some(
+        (entry) => revision.checkpoint.sequence >= entry.preparationSequence,
+      )
+    ) {
+      fail(
+        "Wiki provenance must precede revocation and every original promotion",
+      );
+    }
+    wiki = {
+      revisionId: revision.revisionId,
+      stateDigest: revision.stateDigest,
+      checkpoint: revision.checkpoint,
+      affectedPatternIds: revision.affectedPatternIds,
+    };
+  }
+  if (!direct && !wiki?.affectedPatternIds.length)
+    fail("candidate source lineage does not identify the revoked Knowledge");
+  return captureData({ direct, wiki });
+}
+
+function prove(reader, request, context, disposition) {
+  if (
+    request.dependency.kind !== "candidate" ||
+    request.dependency.disposition !== disposition
+  ) {
+    fail(`this provider requires a candidate / ${disposition} dependency`);
+  }
+  const candidate = reader.candidates.read(request.dependency.digest);
+  if (
+    candidate.tenantId !== request.tenantId ||
+    candidate.candidateId !== request.dependency.digest
+  )
+    fail("candidate identity differs");
+  const resolve =
+    disposition === "quarantine"
+      ? reader.operations.resolveCandidateQuarantine
+      : reader.operations.resolveCandidateRevocation;
+  const admission = resolve({
+    tenantId: request.tenantId,
+    skillName: candidate.skillName,
+    candidateId: candidate.candidateId,
+    operationDigest: request.operationDigest,
+    context,
+  });
+  if (!admission.fence || admission.fence.record.deviceId !== request.deviceId)
+    fail("no exact durable candidate admission fence");
+  const knowledge = admission.fence.record.knowledge;
+  for (const key of [
+    "tenantId",
+    "knowledgeId",
+    "action",
+    "contentDigest",
+    "revocationReceiptDigest",
+  ]) {
+    if (knowledge[key] !== request[key])
+      fail("prepared revocation differs from request");
+  }
+  if (admission.pendingTransactions.length)
+    fail(
+      "in-flight release transition requires recovery before candidate disposition can settle",
+    );
+  const active = reader.releases.readActive(candidate.skillName);
+  if (
+    Boolean(active) !== Boolean(admission.current) ||
+    (active &&
+      (active.release.releaseDigest !== admission.current.releaseDigest ||
+        active.state.stateDigest !== admission.current.stateDigest ||
+        active.state.revision !== admission.current.revision ||
+        admission.current.projection.current !== true))
+  )
+    fail("actual active state differs from authenticated release history");
+  let lastKnownGood = null;
+  if (active) {
+    lastKnownGood = reader.releases.readRelease(
+      active.state.lastKnownGoodReleaseDigest,
+    );
+    if (
+      active.release.candidate.candidateId === candidate.candidateId ||
+      lastKnownGood.candidate.candidateId === candidate.candidateId
+    ) {
+      fail(
+        "active or rollback-eligible candidate requires real release rollback first",
+      );
+    }
+  }
+  const source = sourceProof(reader, candidate, request, admission);
+  if (canonical(reader.operations.currentContext()) !== canonical(context))
+    fail("ledger changed during candidate verification");
+  return captureData({
+    candidateId: candidate.candidateId,
+    skillName: candidate.skillName,
+    source,
+    admission,
+    active: active
+      ? {
+          releaseDigest: active.release.releaseDigest,
+          stateDigest: active.state.stateDigest,
+          lastKnownGoodReleaseDigest: lastKnownGood.releaseDigest,
+        }
+      : null,
+  });
+}
+
+export function createGovernedKnowledgeCandidateRejectionAuthority(
+  options = {},
+) {
+  return createCandidateDispositionAuthority(options, "reject-candidate");
+}
+
+// Quarantine is a distinct, persistent admission disposition, not rejection or
+// a draft-label rewrite. Neither factory may certify an active/LKG candidate.
+export function createGovernedKnowledgeCandidateQuarantineAuthority(
+  options = {},
+) {
+  return createCandidateDispositionAuthority(options, "quarantine");
+}
+
+function createCandidateDispositionAuthority(
+  {
+    tenantId,
+    deviceId,
+    candidateRegistry,
+    releaseRegistry,
+    transactionLedger,
+    verifierCandidateRegistry,
+    verifierReleaseRegistry,
+    verifierTransactionLedger,
+    wikiLedgerAdapter = null,
+    verifierWikiLedgerAdapter = null,
+    providerDescriptor,
+    verifierDescriptor,
+  },
+  disposition,
+) {
+  if (
+    candidateRegistry === verifierCandidateRegistry ||
+    releaseRegistry === verifierReleaseRegistry ||
+    transactionLedger === verifierTransactionLedger ||
+    (wikiLedgerAdapter !== null &&
+      wikiLedgerAdapter === verifierWikiLedgerAdapter) ||
+    Boolean(wikiLedgerAdapter) !== Boolean(verifierWikiLedgerAdapter)
+  ) {
+    throw new TypeError(
+      "candidate rejection requires independent fixed readers",
+    );
+  }
+  const provider = bindReader(
+    candidateRegistry,
+    releaseRegistry,
+    transactionLedger,
+    tenantId,
+    wikiLedgerAdapter,
+  );
+  const verifier = bindReader(
+    verifierCandidateRegistry,
+    verifierReleaseRegistry,
+    verifierTransactionLedger,
+    tenantId,
+    verifierWikiLedgerAdapter,
+  );
+  const providerHead = provider.operations.currentContext().checkpoint;
+  const verifierHead = verifier.operations.currentContext().checkpoint;
+  if (
+    ["epoch", "ledgerId", "identityDigest"].some(
+      (key) => providerHead[key] !== verifierHead[key],
+    )
+  ) {
+    throw new TypeError(
+      "candidate rejection readers belong to different ledgers",
+    );
+  }
+  if (
+    provider.wiki &&
+    canonical(provider.wiki.descriptor) !== canonical(verifier.wiki.descriptor)
+  )
+    throw new TypeError("candidate Wiki reader scopes differ");
+  const providerIdentity = captureData(providerDescriptor);
+  const verifierIdentity = captureData(verifierDescriptor);
+  function proofPair(request) {
+    const context = provider.operations.currentContext();
+    const other = verifier.operations.currentContext();
+    if (canonical(context) !== canonical(other))
+      fail("independent readers do not authenticate the same current ledger");
+    const left = prove(provider, request, context, disposition);
+    const right = prove(verifier, request, context, disposition);
+    if (canonical(left) !== canonical(right))
+      fail("independent candidate rejection proof differs");
+    return left;
+  }
+  return createGovernedKnowledgeDependencyAuthority({
+    tenantId,
+    deviceId,
+    providerDescriptor: providerIdentity,
+    verifierDescriptor: verifierIdentity,
+    provider: Object.freeze({
+      async apply(request) {
+        // Preparation already activated the mandatory admission fence. This
+        // authority certifies its real effect; it never changes a draft label
+        // or reports success while an active/in-flight version can survive.
+        const proof = proofPair(request);
+        const evidence = proof.admission.fence.evidence;
+        const core = {
+          schema: GOVERNED_KNOWLEDGE_DEPENDENCY_RESULT_SCHEMA,
+          tenantId,
+          deviceId,
+          operationId: request.operationId,
+          requestDigest: request.requestDigest,
+          knowledgeId: request.knowledgeId,
+          revocationReceiptDigest: request.revocationReceiptDigest,
+          dependencyKind: request.dependency.kind,
+          dependencyDigest: request.dependency.digest,
+          dependencyDisposition: request.dependency.disposition,
+          authorityId: providerIdentity.authorityId,
+          authorityRevision: providerIdentity.revision,
+          handlerArtifactDigest: providerIdentity.handlerArtifactDigest,
+          applied: true,
+          durable: true,
+          idempotent: true,
+          appliedAt: evidence.timestamp,
+        };
+        const { algorithm, keyId, value } = evidence.signature;
+        return captureData({
+          ...core,
+          resultDigest: digestGovernedKnowledgeDependencyResult(core),
+          attestation: { algorithm, keyId, value },
+        });
+      },
+    }),
+    verifier: Object.freeze({
+      async verify({ request, result }) {
+        const proof = proofPair(request);
+        const evidence = proof.admission.fence.evidence;
+        const { algorithm, keyId, value } = evidence.signature;
+        if (
+          result.appliedAt !== evidence.timestamp ||
+          canonical(result.attestation) !==
+            canonical({ algorithm, keyId, value })
+        )
+          fail("result differs from authenticated admission fence");
+        return captureData({
+          authenticated: true,
+          durable: true,
+          tenantId,
+          deviceId,
+          operationId: request.operationId,
+          requestDigest: request.requestDigest,
+          resultDigest: result.resultDigest,
+          providerAuthorityId: providerIdentity.authorityId,
+          providerRevision: providerIdentity.revision,
+          verifierAuthorityId: verifierIdentity.authorityId,
+          verifierRevision: verifierIdentity.revision,
+          verificationReceiptDigest: digest(
+            disposition === "quarantine"
+              ? QUARANTINE_VERIFICATION_SCHEMA
+              : VERIFICATION_SCHEMA,
+            {
+              tenantId,
+              deviceId,
+              requestDigest: request.requestDigest,
+              resultDigest: result.resultDigest,
+              proof,
+              verifierIdentity,
+            },
+          ),
+        });
+      },
+    }),
+  });
+}