create-evda 0.1.8 → 0.1.10

package/lib/measurement-log.mjs

@@ -0,0 +1,249 @@
+// Is this enclave image's measurement in Sigstore's public log, signed by the workflow that built it?
+// (HQ-2083, Spec 08 section 8: "The client checks inclusion in that log, never a list EVÐA hosts.")
+//
+// The phone runs this before it trusts a hosted EVÐA: the attested VM reports a measurement, and the
+// phone accepts it only if a Sigstore bundle proves that exact digest was logged by EVÐA's CI. This
+// file is the reference the Swift port follows, and its tests run against a real bundle from the
+// public log, so the port can replay the same fixture.
+//
+// What it checks, all offline against the pinned trust root (lib/sigstore-trust.json):
+//   1. the DSSE envelope holds an in-toto statement whose subject carries the digest asked about;
+//   2. the envelope's signature verifies under the leaf certificate's key;
+//   3. the leaf chains to Fulcio's intermediate and root, is for code signing, and was valid when the
+//      log integrated the entry; its SAN and OIDC issuer are exactly the signer asked about;
+//   4. the log entry (Rekor `dsse` 0.0.1) names this payload, this signature and this certificate;
+//   5. an RFC 6962 inclusion proof takes that entry to a root hash, and that root and tree size are
+//      the ones in a checkpoint signed by Rekor's key.
+//
+// Not checked here, on purpose: the signed entry timestamp (the inclusion proof plus a signed
+// checkpoint is the stronger claim), certificate transparency SCTs, and Rekor v2 logs, which use other
+// entry kinds. A bundle from a log this file does not know is refused rather than half-checked.
+//
+// Every failure returns { ok: false, reason } in words; nothing a bundle contains can make it throw.
+
+import { createHash, createPublicKey, verify as verifySig, X509Certificate } from "node:crypto";
+import { readFileSync } from "node:fs";
+
+export const SIGSTORE_TRUST = JSON.parse(readFileSync(new URL("./sigstore-trust.json", import.meta.url), "utf8"));
+
+/** The in-toto predicate type EVÐA's CI logs an enclave image under. */
+export const ENCLAVE_STATEMENT_TYPE = "https://evda.io/enclave-measurement/v1";
+
+/** The only signer whose enclave measurements the phone accepts: EVÐA's image workflow on main. */
+export const ENCLAVE_SIGNER = Object.freeze({
+  issuer: "https://token.actions.githubusercontent.com",
+  san: "https://github.com/mikedouzinas/evda/.github/workflows/enclave-image.yml@refs/heads/main",
+});
+
+const OID_ISSUER_V1 = "1.3.6.1.4.1.57264.1.1";
+const OID_ISSUER_V2 = "1.3.6.1.4.1.57264.1.8";
+const OID_SAN = "2.5.29.17";
+const EKU_CODE_SIGNING = "1.3.6.1.5.5.7.3.3";
+
+const sha256 = (b) => createHash("sha256").update(b).digest();
+const fromB64 = (s) => (typeof s === "string" && s.length ? Buffer.from(s, "base64") : null);
+const fail = (reason) => ({ ok: false, reason });
+
+// ─── DER, only as much as a certificate's extensions need ────────────────────────────────────────
+
+function tlv(buf, at) {
+  if (at + 2 > buf.length) throw new Error("short");
+  const tag = buf[at];
+  let len = buf[at + 1];
+  let hdr = 2;
+  if (len & 0x80) {
+    const n = len & 0x7f;
+    if (n === 0 || n > 4 || at + 2 + n > buf.length) throw new Error("length");
+    len = 0;
+    for (let i = 0; i < n; i++) len = len * 256 + buf[at + 2 + i];
+    hdr += n;
+  }
+  const start = at + hdr;
+  if (start + len > buf.length) throw new Error("overrun");
+  return { tag, start, end: start + len, next: start + len };
+}
+
+function children(buf, node) {
+  const out = [];
+  for (let at = node.start; at < node.end;) { const c = tlv(buf, at); out.push(c); at = c.next; }
+  return out;
+}
+
+function oid(bytes) {
+  const parts = [Math.floor(bytes[0] / 40), bytes[0] % 40];
+  let v = 0;
+  for (let i = 1; i < bytes.length; i++) { v = v * 128 + (bytes[i] & 0x7f); if (!(bytes[i] & 0x80)) { parts.push(v); v = 0; } }
+  return parts.join(".");
+}
+
+// The TDX verifier (tdx-attestation.mjs) reads Intel's PCK certificate extensions with these.
+export { tlv as derTlv, children as derChildren, oid as derOid };
+
+/** The OIDC issuer and the SAN URIs and emails of a Fulcio leaf, read from its DER. */
+export function certificateIdentity(der) {
+  const buf = Buffer.from(der);
+  const tbs = children(buf, tlv(buf, 0))[0];
+  const extWrap = children(buf, tbs).find((c) => c.tag === 0xa3);
+  const out = { issuer: null, sans: [] };
+  if (!extWrap) return out;
+  let v1 = null;
+  for (const ext of children(buf, children(buf, extWrap)[0])) {
+    const parts = children(buf, ext);
+    const id = oid(buf.subarray(parts[0].start, parts[0].end));
+    const value = parts.at(-1);
+    const raw = buf.subarray(value.start, value.end);
+    if (id === OID_ISSUER_V2) { const s = tlv(raw, 0); out.issuer = raw.subarray(s.start, s.end).toString("utf8"); }
+    else if (id === OID_ISSUER_V1) v1 = raw.toString("utf8");
+    else if (id === OID_SAN) {
+      for (const g of children(raw, tlv(raw, 0))) if (g.tag === 0x86 || g.tag === 0x81) out.sans.push(raw.subarray(g.start, g.end).toString("utf8"));
+    }
+  }
+  out.issuer ??= v1;
+  return out;
+}
+
+// ─── RFC 6962 inclusion, and the checkpoint that signs its root ──────────────────────────────────
+
+const node = (l, r) => sha256(Buffer.concat([Buffer.from([1]), l, r]));
+
+/** True when `proof` takes `leaf` (a leaf hash) at `index` to `root` in a tree of `size`. */
+export function verifyInclusion({ index, size, leaf, proof, root }) {
+  if (!Number.isSafeInteger(index) || !Number.isSafeInteger(size) || index < 0 || index >= size) return false;
+  if (!Buffer.isBuffer(leaf) || !Buffer.isBuffer(root) || !Array.isArray(proof)) return false;
+  // BigInt, because a log index passes 2^31 and JavaScript's bitwise operators stop at 32 bits.
+  const i = BigInt(index);
+  const x = i ^ BigInt(size - 1);
+  const inner = x === 0n ? 0 : x.toString(2).length;
+  const border = (i >> BigInt(inner)).toString(2).replace(/0/g, "").length;
+  if (proof.length !== inner + border) return false;
+  let h = leaf;
+  for (let k = 0; k < inner; k++) h = ((i >> BigInt(k)) & 1n) === 0n ? node(h, proof[k]) : node(proof[k], h);
+  for (let k = inner; k < proof.length; k++) h = node(proof[k], h);
+  return h.equals(root);
+}
+
+/** Verifies a Rekor checkpoint (a signed note) against one pinned log; returns its origin, size and root. */
+export function verifyCheckpoint(envelope, log) {
+  if (typeof envelope !== "string") return fail("the checkpoint is missing");
+  const split = envelope.indexOf("\n\n");
+  if (split < 0) return fail("the checkpoint is not a signed note");
+  const body = envelope.slice(0, split + 1);
+  const [origin, sizeLine, rootLine] = body.split("\n");
+  const keyId = fromB64(log.logId);
+  const key = createPublicKey({ key: fromB64(log.publicKey), format: "der", type: "spki" });
+  const host = new URL(log.baseUrl).host;
+  for (const line of envelope.slice(split + 2).split("\n")) {
+    const m = /^\u2014 (\S+) (\S+)$/.exec(line);
+    if (!m || m[1] !== host) continue;
+    const sig = Buffer.from(m[2], "base64");
+    if (sig.length < 5 || !sig.subarray(0, 4).equals(keyId.subarray(0, 4))) continue;
+    if (!verifySig("sha256", Buffer.from(body), key, sig.subarray(4))) continue;
+    const size = Number(sizeLine);
+    if (!origin?.startsWith(`${host} - `) || !Number.isSafeInteger(size) || !/^[A-Za-z0-9+/]+=*$/.test(rootLine ?? "")) return fail("the checkpoint is signed but malformed");
+    return { ok: true, origin, size, root: Buffer.from(rootLine, "base64") };
+  }
+  return fail(`the checkpoint carries no valid signature from ${host}`);
+}
+
+// ─── the bundle ──────────────────────────────────────────────────────────────────────────────────
+
+function pae(type, payload) {
+  const t = Buffer.from(type, "utf8");
+  return Buffer.concat([Buffer.from(`DSSEv1 ${t.length} `), t, Buffer.from(` ${payload.length} `), payload]);
+}
+
+const pem = (der) => `-----BEGIN CERTIFICATE-----\n${der.toString("base64").match(/.{1,64}/g).join("\n")}\n-----END CERTIFICATE-----\n`;
+
+function checkChain(leaf, trust, at) {
+  const chain = trust.fulcio.chain.map((c) => new X509Certificate(fromB64(c)));
+  const certs = [leaf, ...chain];
+  for (let i = 0; i < certs.length; i++) {
+    const issuer = certs[Math.min(i + 1, certs.length - 1)];
+    if (!certs[i].checkIssued(issuer) || !certs[i].verify(issuer.publicKey)) return `the certificate chain breaks at ${certs[i].subject || "the leaf"}`;
+    if (at < new Date(certs[i].validFrom) || at > new Date(certs[i].validTo)) return "a certificate in the chain was not valid when the entry was logged";
+  }
+  if (leaf.ca) return "the signing certificate is a CA, not a Fulcio leaf";
+  if (!(leaf.keyUsage ?? []).includes(EKU_CODE_SIGNING)) return "the signing certificate is not for code signing";
+  return null;
+}
+
+/**
+ * Confirms `digest` ({ algorithm, hex }) is the subject of an in-toto statement that `signer`
+ * ({ issuer, san }) signed through Fulcio and that Rekor logged, from a Sigstore bundle (v0.3, DSSE).
+ * Pass `predicateType` to also require the statement's type (ENCLAVE_STATEMENT_TYPE for an image).
+ */
+export function verifyLoggedMeasurement({ bundle, digest, signer, predicateType, trust = SIGSTORE_TRUST } = {}) {
+  try {
+    return check({ bundle, digest, signer, predicateType, trust });
+  } catch (err) {
+    return fail(`the bundle could not be read: ${err.message}`);
+  }
+}
+
+function check({ bundle, digest, signer, predicateType, trust }) {
+  if (!signer?.issuer || !signer?.san) return fail("no signer was named, so nothing says who must have logged it");
+  if (!digest?.algorithm || !/^[0-9a-f]+$/.test(digest?.hex ?? "")) return fail("no digest was named");
+  if (!bundle || typeof bundle !== "object") return fail("there is no bundle");
+
+  // 1. The statement.
+  const env = bundle.dsseEnvelope;
+  const payload = fromB64(env?.payload);
+  const sigs = env?.signatures;
+  if (!payload || !Array.isArray(sigs) || sigs.length !== 1) return fail("the bundle has no single-signature DSSE envelope");
+  if (env.payloadType !== "application/vnd.in-toto+json") return fail("the envelope does not hold an in-toto statement");
+  const statement = JSON.parse(payload.toString("utf8"));
+  if (!/^https:\/\/in-toto\.io\/Statement\/v(1|0\.1)$/.test(statement?._type ?? "")) return fail("the envelope does not hold an in-toto statement");
+  if (predicateType && statement.predicateType !== predicateType) return fail(`the statement type is ${statement.predicateType}, not ${predicateType}`);
+  const subjects = Array.isArray(statement.subject) ? statement.subject : [];
+  if (!subjects.some((s) => typeof s?.digest?.[digest.algorithm] === "string" && s.digest[digest.algorithm].toLowerCase() === digest.hex)) {
+    return fail(`the statement does not name ${digest.algorithm} digest ${digest.hex.slice(0, 16)}...`);
+  }
+
+  // 2 and 3. The signature, the certificate and who it was issued to.
+  const leafDer = fromB64(bundle.verificationMaterial?.certificate?.rawBytes);
+  if (!leafDer) return fail("the bundle carries no signing certificate");
+  const leaf = new X509Certificate(leafDer);
+  const sig = fromB64(sigs[0].sig);
+  if (!sig || !verifySig("sha256", pae(env.payloadType, payload), leaf.publicKey, sig)) return fail("the envelope's signature does not verify under its certificate");
+
+  const entries = bundle.verificationMaterial?.tlogEntries;
+  if (!Array.isArray(entries) || entries.length === 0) return fail("the bundle carries no log entry");
+  const entry = entries[0];
+  const integratedTime = Number(entry.integratedTime);
+  if (!Number.isSafeInteger(integratedTime)) return fail("the log entry has no integration time");
+  const chainProblem = checkChain(leaf, trust, new Date(integratedTime * 1000));
+  if (chainProblem) return fail(chainProblem);
+  const id = certificateIdentity(leafDer);
+  if (id.issuer !== signer.issuer) return fail(`the certificate's issuer is ${id.issuer}, not ${signer.issuer}`);
+  if (!id.sans.includes(signer.san)) return fail(`the certificate's signer is ${id.sans.join(", ") || "nobody"}, not ${signer.san}`);
+
+  // 4. The log entry names exactly this envelope.
+  const log = trust.tlogs.find((l) => l.logId === entry.logId?.keyId);
+  if (!log) return fail("the entry is from a log this phone does not trust");
+  if (integratedTime * 1000 < Date.parse(log.validFrom)) return fail("the entry predates the log's key");
+  const bodyBytes = fromB64(entry.canonicalizedBody);
+  if (!bodyBytes) return fail("the log entry has no body");
+  const body = JSON.parse(bodyBytes.toString("utf8"));
+  if (body.kind !== "dsse" || body.apiVersion !== "0.0.1" || entry.kindVersion?.kind !== "dsse" || entry.kindVersion?.version !== "0.0.1") {
+    return fail(`the log entry is ${body.kind} ${body.apiVersion}, and only dsse 0.0.1 is understood`);
+  }
+  if (body.spec?.payloadHash?.algorithm !== "sha256" || body.spec.payloadHash.value !== sha256(payload).toString("hex")) return fail("the log entry is for a different statement");
+  const logged = body.spec.signatures;
+  if (!Array.isArray(logged) || logged.length !== 1 || logged[0].signature !== sigs[0].sig) return fail("the log entry is for a different signature");
+  if (fromB64(logged[0].verifier)?.toString("utf8") !== pem(leafDer)) return fail("the log entry is for a different certificate");
+
+  // 5. The entry is in the tree whose root Rekor signed.
+  const proof = entry.inclusionProof;
+  if (!proof) return fail("the log entry has no inclusion proof");
+  const index = Number(proof.logIndex);
+  const size = Number(proof.treeSize);
+  const root = fromB64(proof.rootHash) ?? Buffer.alloc(0);
+  const hashes = Array.isArray(proof.hashes) ? proof.hashes.map((h) => Buffer.from(h, "base64")) : [];
+  const leafHash = sha256(Buffer.concat([Buffer.from([0]), bodyBytes]));
+  if (root.length !== 32 || !verifyInclusion({ index, size, leaf: leafHash, proof: hashes, root })) return fail("the inclusion proof does not reach the root");
+  const cp = verifyCheckpoint(proof.checkpoint?.envelope, log);
+  if (!cp.ok) return fail(cp.reason);
+  if (cp.size !== size || !cp.root.equals(root)) return fail("the checkpoint signs a different tree than the inclusion proof");
+
+  return { ok: true, logIndex: index, treeSize: size, integratedTime, statement };
+}

package/lib/messages.mjs

@@ -1,5 +1,8 @@
-// Dispatch through the record (HQ-1246): the owner's agent writes a message, the phone app shows it
-// as a card, and the owner's reply comes back as a file the agent reads on its next run.
+// Dispatch through the record (HQ-1246): the owner's agent writes a message, the EVÐA phone app
+// shows it as a card once it is paired and has synced, and the owner's reply comes back as a file
+// the agent reads on its next run. This module only writes the file -- it has no way to see whether
+// a phone ever reads it, so callers (lib/mcp.mjs, bin/evda.mjs) must not claim the card happened
+// (HQ-2161: the tool told the model it had shown a card when the owner's phone app was not running).
 //
 // The format, which the phone app (iris-mobile, the EVÐA target) reads exactly:
 //

package/lib/migrate-people.mjs

@@ -3,7 +3,7 @@
 // The six rules, each implemented once below:
 //   1. The file is copied to <record root>/.backup/people-migration-<YYYY-MM-DD>/ first.
 //   2. Frontmatter is added and nothing below it changes: kind, id (filename slug), schemaVersion,
-//      name (the H1), observations. A file that already has frontmatter is skipped and reported.
+//      name (the H1), observations.
 //   3. One observation per dated H2/H3 heading: text is the heading text, since is its date at the
 //      precision written (day or month). A range uses its start. A year-only heading stays prose.
 //   4. supersededBy only when a heading says it replaces an earlier one AND exactly one earlier
@@ -14,7 +14,12 @@
 //      The owner is provenance owner; the person is provenance person with by naming them.
 //   6. Undated sections stay prose.
 // Before a file is reported done, the bytes after the frontmatter are hashed against the original.
-// A doc with no dated heading is left untouched and reported: a profile needs one observation.
+// A profile needs one observation, so a doc with no dated heading gets one dated the day it is typed,
+// saying no section carries a date yet (HQ-2024: doctor fails an untyped file in a person folder, so
+// every file there has to be typeable). A doc with no H1 takes its name from its file name.
+// A file that already has frontmatter keeps every key it has; only the missing person-profile keys
+// are added below them. One that already says a kind, or is sealed or just noted, is skipped.
+// gather apply runs the same plan on a page it places in a person folder (lib/gather-apply.mjs).
 
 import { createHash } from "node:crypto";
 import { copyFileSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
@@ -23,6 +28,7 @@ import { findRoot, holderOf, readManifest } from "./manifest.mjs";
 import { readEntry } from "./kinds.mjs";
 import { parseYaml, toYaml } from "./yaml.mjs";
 import { carries, frontmatterOf, heldBy, sealedSections, NOTED, SEALED } from "./circles.mjs";
+import { baseName } from "./person-folders.mjs";
 
 // The lines of a body with every line of a sealed section blanked, so nothing in one becomes an
 // observation, a name or a quote in frontmatter every reader shows (HQ-1414). Line numbers are kept.
@@ -105,18 +111,40 @@ export function speakerQuote(line) {
   return null;
 }
 
-// Plan the frontmatter for one doc. Pure: reads nothing from disk.
-export function planProfile({ fileName, text, owner }) {
+const today = () => { const d = new Date(); return `${d.getFullYear()}-${two(d.getMonth() + 1)}-${two(d.getDate())}`; };
+
+// A file's own frontmatter: its YAML lines and where its body starts, or null when it has none.
+function ownFrontmatter(text) {
+  const lines = text.split("\n");
+  if (lines[0] !== "---") return null;
+  const end = lines.indexOf("---", 1);
+  if (end === -1) return null;
+  return { head: lines.slice(1, end), body: lines.slice(end + 1).join("\n") };
+}
+
+// Plan the frontmatter for one doc. Pure: reads nothing from disk. `date` dates the one observation
+// a doc with no dated heading gets. Returns { entry, frontmatter, bodyAt, notes, problems } where
+// the file becomes frontmatter + the original from byte bodyAt on, or { skip }.
+export function planProfile({ fileName, text, owner, date = today() }) {
   const notes = [];
   // A sealed or just-noted file always has frontmatter, so it is skipped here and never rewritten.
   // EVDA_CARRY_FALSIFY=migrate-people:noted lets a noted one through, as a migration that read past
   // its frontmatter would, to show this skip is what keeps it noted.
   const falsifiedNoted = !carries("migrate-people", NOTED) && frontmatterOf(text)?.[NOTED] === true && !heldBy(frontmatterOf(text), "migrate-people");
-  if (/^---\r?\n/.test(text) && !falsifiedNoted) return { skip: "already has frontmatter" };
-  const lines = openLines(text);
+  let own = null;
+  if (/^---\r?\n/.test(text) && !falsifiedNoted) {
+    own = ownFrontmatter(text);
+    const front = frontmatterOf(text);
+    if (!own || !front) return { skip: "already has frontmatter that does not read as YAML" };
+    if (front.kind !== undefined) return { skip: `already has frontmatter saying kind ${front.kind}` };
+    if (heldBy(front, "migrate-people") || front[SEALED] === true || front[NOTED] === true) return { skip: "already has frontmatter that seals it or holds it noted; never rewritten" };
+  }
+  const body = own ? own.body : text;
+  const bodyAt = own ? Buffer.byteLength(text, "utf8") - Buffer.byteLength(body, "utf8") : 0;
+  const lines = openLines(body);
   const h1 = lines.find((l) => /^# \S/.test(l));
-  if (!h1) return { skip: "has no H1 to take the name from" };
-  const name = h1.slice(2).trim();
+  const name = h1 ? h1.slice(2).trim() : baseName(fileName.replace(/\.md$/i, "")).trim();
+  if (!name) return { skip: "has no H1 and no file name to take the name from" };
   const first = name.split(/\s+/)[0];
   const ownerFirst = String(owner).split(/\s+/)[0];
 
@@ -167,7 +195,11 @@ export function planProfile({ fileName, text, owner }) {
     }
   }
 
-  if (observations.length === 0) return { skip: "has no dated H2 or H3 heading, so there is no observation; left as prose" };
+  // A profile holds at least one observation. With no dated section, the one it gets says so.
+  if (observations.length === 0) {
+    observations.push({ obs: { id: "typed", since: date, text: "Typed as a person profile; none of its sections carries a date yet." }, order: 0 });
+    notes.push(`no dated H2 or H3 heading, so its one observation is dated ${date}, the day it was typed`);
+  }
 
   observations.sort((a, b) => (key(a.obs.since) < key(b.obs.since) ? -1 : key(a.obs.since) > key(b.obs.since) ? 1 : a.order - b.order));
   const entry = {
@@ -177,20 +209,22 @@ export function planProfile({ fileName, text, owner }) {
     name,
     observations: observations.map((o) => o.obs),
   };
-  const frontmatter = `---\n${toYaml(entry)}---\n`;
+  // Keys the file already has stay as they are, above the ones added.
+  const front = own ? frontmatterOf(text) : {};
+  const missing = Object.fromEntries(Object.entries(entry).filter(([k]) => !(k in front)));
+  const kept = own && own.head.length ? `${own.head.join("\n")}\n` : "";
+  const frontmatter = `---\n${kept}${toYaml(missing)}---\n`;
   const problems = readEntry("person-profile", parseYaml(frontmatter.slice(4, -4)), { owner }).problems;
-  return { entry, frontmatter, notes, problems };
+  return { entry, frontmatter, bodyAt, notes, problems };
 }
 
-// The body below a written frontmatter is the original, byte for byte.
-export function bodyMatches(original, written, frontmatter) {
+// The body below a written frontmatter is the original's body (from byte bodyAt), byte for byte.
+export function bodyMatches(original, written, frontmatter, bodyAt = 0) {
   const head = Buffer.from(frontmatter, "utf8");
   if (!written.subarray(0, head.length).equals(head)) return false;
-  return sha256(written.subarray(head.length)) === sha256(original);
+  return sha256(written.subarray(head.length)) === sha256(original.subarray(bodyAt));
 }
 
-const today = () => { const d = new Date(); return `${d.getFullYear()}-${two(d.getMonth() + 1)}-${two(d.getDate())}`; };
-
 // Migrate files. Returns one result per file: { file, status: done|would|skipped|failed, ... }.
 export function migratePeople(files, { dry = false, date = today(), root = null } = {}) {
   const results = [];
@@ -203,7 +237,7 @@ export function migratePeople(files, { dry = false, date = today(), root = null
     const owner = (() => { const h = holderOf(readManifest(recordRoot)); return h.id ?? h.name; })();
     if (!owner) { Object.assign(r, { status: "failed", why: "evda.json names no owner" }); continue; }
     const original = readFileSync(file);
-    const plan = planProfile({ fileName: basename(file), text: original.toString("utf8"), owner });
+    const plan = planProfile({ fileName: basename(file), text: original.toString("utf8"), owner, date });
     if (plan.skip) { Object.assign(r, { status: "skipped", why: plan.skip }); continue; }
     Object.assign(r, { frontmatter: plan.frontmatter, notes: plan.notes, observations: plan.entry.observations.length });
     if (plan.problems.length) { Object.assign(r, { status: "failed", why: `the frontmatter would not read as a person-profile: ${plan.problems.join("; ")}` }); continue; }
@@ -217,14 +251,14 @@ export function migratePeople(files, { dry = false, date = today(), root = null
     }
     copyFileSync(file, r.backup);
     if (sha256(readFileSync(r.backup)) !== sha256(original)) { Object.assign(r, { status: "failed", why: "the backup does not match the original; nothing written" }); continue; }
-    writeFileSync(file, Buffer.concat([Buffer.from(plan.frontmatter, "utf8"), original]));
+    writeFileSync(file, Buffer.concat([Buffer.from(plan.frontmatter, "utf8"), original.subarray(plan.bodyAt)]));
     const written = readFileSync(file);
-    if (!bodyMatches(original, written, plan.frontmatter)) {
+    if (!bodyMatches(original, written, plan.frontmatter, plan.bodyAt)) {
       writeFileSync(file, original);
       Object.assign(r, { status: "failed", why: "the body below the frontmatter did not hash to the original; restored the original" });
       continue;
     }
-    r.bodySha256 = sha256(original);
+    r.bodySha256 = sha256(original.subarray(plan.bodyAt));
     r.status = "done";
   }
   return results;