enigma-memory 0.1.11 → 0.1.13

package/docs/proof-network-test-plan.md

@@ -0,0 +1,216 @@
+# Proof Network acceptance test plan
+
+This plan defines the release acceptance tests for Enigma Proof Network artifacts. The boundary is narrow: Enigma is a private AI memory controller, and Solana is an optional proof, permission, and settlement rail. Public artifacts may contain only hashes, Merkle roots, opaque refs, counts, timestamps, schemas, signatures, signer refs, nullifiers, capability scopes, package refs, dataset refs, runner refs, metric refs, and explicit non-submission flags.
+
+The tests must prove that local package and CLI behavior creates and validates public-safe artifacts without copying disallowed private material or benchmark record bodies into public outputs.
+
+## Release boundary
+
+The acceptance suite covers these Enigma-controlled behaviors:
+
+- local artifact construction;
+- deterministic JSON hashing;
+- private payload and restricted-value rejection;
+- CLI artifact creation and verification;
+- JSON Schema conformance for public artifact shapes;
+- benchmark attestation and proof-packet assembly;
+- example artifact safety;
+- documentation claim-boundary enforcement;
+- release gates for package publication readiness.
+
+The suite does not claim to prove external service behavior, model-state changes, production deployment, network submission, chain status, benchmark leadership, business outcome, economic design, or service availability.
+
+## Artifact families under test
+
+| Artifact | Schema id | Minimum public-safe evidence |
+| --- | --- | --- |
+| Anchor batch | `enigma.proof_network.anchor_batch.v1` | schema id, generated timestamp, anchor ref, chain and cluster refs, commitment roots, counts, payload hash, account derivation ref, instruction ref, batch id, batch hash, and required boundary flags |
+| Capability grant | `enigma.proof_network.capability_grant.v1` | schema id, issue and expiry timestamps, grant ref, issuer ref, subject ref, audience ref, scope strings, resource roots, nonce hash, signature ref, grant id, grant hash, public-safe boundary flags |
+| Capability revocation | `enigma.proof_network.capability_revocation.v1` | schema id, revocation timestamp, revocation ref, grant id or grant hash, issuer ref, reason ref, nullifier root, signature ref, revocation id, revocation hash, public-safe boundary flags |
+| Benchmark attestation | `enigma.proof_network.benchmark_attestation.v1` | schema id, benchmark ref, dataset ref, runner ref, package ref, report hash, metric root or metric refs, sample and run counts, signature ref, attestation id, attestation hash, public-safe boundary flags |
+| Proof packet | `enigma.proof_network.packet.v1` | schema id, packet ref, included artifact ids and hashes, packet hash, artifact count, schema counts, public-safe boundary flags |
+
+## Fixture policy
+
+Acceptance fixtures must be plaintext-minimized:
+
+- Use synthetic `sha256:` digests, Merkle roots, opaque refs, counters, schema ids, and signature refs.
+- Use a known forbidden sentinel only to assert rejection and non-leakage; the sentinel must never appear in success artifacts or error output intended for publication.
+- Use public fixture refs such as `dataset:public-fixture:v1`, `runner:enigma-local:v1`, and `package:npm/enigma-memory@<version>` instead of local paths or private names.
+- Do not store restricted private material, private identifiers, private policy bodies, local-only paths, or benchmark record bodies in fixtures.
+- Prefer hash refs for any simulated report, policy, dataset, or metric input.
+
+## Acceptance matrix
+
+### 1. Private payload rejection
+
+Objective: every public artifact constructor, validator, CLI command, packet builder, and verifier fails closed when private fields or restricted values are present.
+
+Required cases:
+
+1. Reject forbidden key names at any nesting depth, including names equivalent to private payload content, access-control bodies, external bodies, private identifiers, or freeform document content.
+2. Reject restricted values even when the key name is otherwise allowed, including auth-shaped strings, key-shaped blocks, authority-bearing URLs, and private-content markers.
+3. Reject private payloads before computing ids, hashes, packets, or CLI output files.
+4. Ensure failure output is sanitized: no private sentinel, restricted input, forbidden value, or full input object may be echoed to stdout, stderr, JSON error output, or generated files.
+5. Ensure all success artifacts recursively include the required non-submission and private-payload boundary flags.
+
+Pass criteria:
+
+- The command or API call returns a validation failure for every forbidden input.
+- The serialized failure report contains only public-safe error codes, field paths, and generic messages.
+- No private sentinel or restricted value appears in any artifact or error report.
+
+### 2. Deterministic hashes
+
+Objective: artifact hashes are stable, canonical, and independent of caller object insertion order.
+
+Required cases:
+
+1. Build the same anchor batch twice from equivalent commitments supplied in different orders; assert equal `anchor_batch_id`, `anchor_batch_hash`, and `solana_ready_anchor.payload_hash`.
+2. Build the same capability grant twice from equivalent scope and resource-root inputs; assert equal `capability_grant_id` and `capability_grant_hash`.
+3. Build the same capability revocation twice; assert equal `capability_revocation_id` and `capability_revocation_hash`.
+4. Build the same benchmark attestation twice with equivalent metric roots; assert equal `benchmark_attestation_id` and `benchmark_attestation_hash`.
+5. Build proof packets with the same included artifacts in different caller orders; assert the packet canonicalization rule produces a deterministic `proof_packet_hash`.
+6. Mutate one public-safe field at a time, such as a root, ref, count, expiry, metric root, or signature ref; assert the relevant artifact hash changes.
+
+Pass criteria:
+
+- Equivalent inputs produce byte-for-byte equal public artifacts after canonicalization.
+- Meaningful public-safe field changes produce different artifact hashes.
+- Hash inputs exclude identity fields so self-referential hashes cannot occur.
+
+### 3. CLI artifact creation
+
+Objective: the `enigma chain` commands create reviewable local artifacts and verify them without network submission or external integration calls.
+
+Required cases:
+
+1. `enigma chain anchor` writes an anchor-batch JSON file with schema id, commitments, count fields, Solana-ready opaque payload metadata, batch id/hash, required boundary flags, and no private input leakage.
+2. `enigma chain grant` writes a capability-grant JSON file with issuer, subject, audience, scope, resource-root, expiry, nonce-hash, signature-ref, grant id/hash, and public-safe boundary flags.
+3. `enigma chain revoke` writes a capability-revocation JSON file with grant id/hash reference, reason ref, nullifier root, signature ref, revocation id/hash, and public-safe boundary flags.
+4. `enigma chain attest` writes a benchmark-attestation JSON file from either a supplied report hash or a locally hashed reviewed report file, without copying the report body or private path into the output.
+5. `enigma chain verify --file <artifact>` accepts each valid artifact family and returns an `ok:true` report with schema id, artifact ids/hashes, and validation status only.
+6. Each command rejects missing required args, malformed refs, invalid hash strings, negative counts, invalid timestamps, invalid scopes, and unsupported schemas with sanitized errors.
+
+Pass criteria:
+
+- All CLI-created files validate with the matching package validator and the verifier command.
+- CLI help and output language states local planning or verification only when the artifact has the non-submission boundary flag.
+- No CLI path claims network submission, external integration behavior, production deployment, chain status, third-party approval status, or benchmark rank.
+
+### 4. JSON Schema validation
+
+Objective: every artifact schema accepted by code has a JSON Schema file that accepts valid public-safe artifacts and rejects malformed or unsafe shapes.
+
+Required cases:
+
+1. Validate the current schema files under `specs/` for anchor batch, capability grant, benchmark attestation, and proof packet.
+2. Add or require a release blocker for any artifact family exported by the package without a matching schema file, including capability revocation.
+3. For each schema, assert required fields, exact schema id, public-safe flag values, positive or non-negative counts, digest formats, ref formats, timestamp formats, and bounded arrays.
+4. Assert schemas reject unknown private payload keys and unsafe nested structures where the schema can express those constraints.
+5. Assert schema validation and package validation agree for representative valid and invalid fixtures.
+
+Pass criteria:
+
+- A valid artifact from each family passes both JSON Schema validation and package validation.
+- Invalid artifacts fail with explainable validation errors.
+- Release is blocked if any public artifact can be produced without a corresponding reviewed schema or schema exception.
+
+### 5. Benchmark attestation
+
+Objective: benchmark claims are bound to reviewed public-safe attestation fields, never benchmark record contents.
+
+Required cases:
+
+1. Create an attestation with benchmark ref, dataset ref, runner ref, package ref, report hash, metric root or metric refs, sample count, run count, signature ref, and public-safe boundary flags.
+2. Verify the attestation hash changes when report hash, dataset ref, runner ref, package ref, sample count, run count, metric root, or signature ref changes.
+3. Build a proof packet containing the benchmark attestation and assert the packet includes the attestation id/hash and schema count without copying report contents.
+4. Assert no-score-without-run language in docs and examples: numeric benchmark claims must cite the exact report hash/ref, dataset ref, runner ref, package ref, scorer or metric ref, and review approval.
+5. Assert root-only anchors are described as inclusion commitments, not proof that benchmark record contents are true, complete, private, or superior to another system.
+
+Pass criteria:
+
+- Benchmark artifacts contain only hashes, refs, counts, approved aggregate metric refs/roots, timestamps, and signatures.
+- Any example score is labeled as tied to a specific reviewed report and cannot be generalized into comparative leadership.
+- Private enterprise runs may publish run-status and private-evidence refs without forcing public score disclosure.
+
+### 6. Example artifacts
+
+Objective: examples demonstrate safe usage without becoming accidental restricted-data templates.
+
+Required cases:
+
+1. Validate every example anchor batch, grant, revocation, benchmark attestation, proof packet, and quickstart output included in docs or examples.
+2. Scan examples for forbidden private payload terms, private-looking identifiers, local absolute paths, external bodies, benchmark record bodies, and other restricted private material.
+3. Confirm every example uses placeholder digests, opaque refs, signature refs, counts, schema ids, and explicit required boundary flags where applicable.
+4. Confirm examples that mention Solana say the artifact is Solana-ready or operator-review-ready only, unless an approved network evidence packet is present.
+5. Confirm examples that mention benchmark metrics bind them to exact report refs and do not imply broad performance or business outcomes.
+
+Pass criteria:
+
+- Examples are executable or clearly marked as illustrative with valid public-safe shapes.
+- Examples can be copied into tests without introducing restricted data or prohibited claims.
+- Example comments and prose preserve the same boundaries as the JSON fields.
+
+### 7. Documentation claim-boundary checks
+
+Objective: public docs remain aligned with the Proof Network boundary and do not overclaim.
+
+Required cases:
+
+1. Scan Proof Network docs, README sections, API references, quickstarts, benchmark docs, launch plans, and sales-facing proof docs for prohibited claims.
+2. Block language that says or implies Enigma publishes private material, writes private payloads to a public rail, performs network submission when only local artifacts exist, proves chain status, proves external service behavior, provides third-party approval status, promises business outcomes, or proves benchmark superiority without a reviewed comparison packet.
+3. Require conditional language for anchoring, signatures, production operations, deployments, comparative benchmarks, audits, and organization-specific security claims.
+4. Require evidence-backed nouns: anchor batch, capability grant, capability revocation, benchmark attestation, proof packet, root, hash, opaque ref, signature, nullifier, scope, dataset ref, runner ref, package ref.
+5. Require every numeric or operational claim to cite the exact artifact, report hash, command, dataset/file refs, runner version/ref, package version/ref, and review approval.
+
+Pass criteria:
+
+- Docs use local proof generation, local verification, public-safe commitment, and optional Solana-ready phrasing.
+- Docs do not expose or request restricted private material in examples.
+- Any conditional claim names the condition and evidence required before publication.
+
+### 8. Release gates
+
+Objective: package release is blocked unless proof artifacts, schemas, CLI, examples, and docs satisfy public-safe acceptance.
+
+Gate checklist:
+
+1. Package validators reject private payload keys and restricted values for every artifact family.
+2. Deterministic hash tests pass for equivalent inputs and mutation tests prove hash sensitivity.
+3. CLI artifact creation and verification tests pass for anchor, grant, revoke, attest, and verify flows.
+4. JSON Schema validation covers every public artifact family or a documented blocker exists for missing schema coverage.
+5. Benchmark attestation tests prove report bodies and restricted benchmark records are not copied into public artifacts.
+6. Proof packet tests prove packet contents are normalized, public-safe, and schema-counted.
+7. Example artifacts validate and pass leakage scans.
+8. Docs claim-boundary scans pass for prohibited and conditional language.
+9. Release notes state the actual scope: local public-safe proof artifact generation and verification, with optional Solana-ready payload preparation only.
+10. Publication is blocked if any generated artifact lacks the explicit boundary flags required by its schema.
+
+## Minimum test inventory
+
+| Area | Suggested file or check | Required assertions |
+| --- | --- | --- |
+| Package API | `test/enigma-proof-network.test.mjs` | constructors, validators, private payload rejection, deterministic hashes, hash mutation sensitivity, packet validation |
+| CLI | `test/enigma-chain-cli.test.mjs` | local artifact creation, `chain verify`, sanitized errors, no network submission claims |
+| Schemas | schema validation test near existing schema tests | valid artifacts pass, malformed/private artifacts fail, exported schemas and schema files stay in sync |
+| Packet script | test for `scripts/build-proof-network-packet.mjs` | report files are hashed by digest/ref only, no body or private path copied, packet validates |
+| Examples | docs/example scan | example JSON validates, forbidden payload terms absent, Solana and benchmark language bounded |
+| Docs | claim-boundary scan | prohibited claims absent, conditional claims evidence-scoped, numeric claims cite exact refs |
+
+## Failure handling
+
+A failing acceptance test should produce only public-safe diagnostics:
+
+- schema id or command name;
+- field path;
+- validation code;
+- expected public-safe type or format;
+- artifact id/hash when available;
+- sanitized fixture label.
+
+Diagnostics must not echo the rejected private value, report body, external body, local private path, private identifier, or full input object.
+
+## Done definition
+
+Proof Network release acceptance is complete only when the matrix above passes and the release record contains the exact commands or checks that were run, the package version/ref, schema refs, artifact refs, and reviewer approval. If any gate is skipped, the release record must say it is skipped and mark the release as not accepted for public proof-network publication.

package/docs/proof-network-threat-model.md

@@ -0,0 +1,373 @@
+# Proof Network threat model
+
+This document is the release threat model for Enigma's Proof Network: privacy-preserving proof artifacts for AI memory with local-only CLI planning, Solana-ready root anchoring, capability grants, capability revocations, benchmark attestations, and proof packets.
+
+The Proof Network is a public evidence layer, not a public data layer. Public artifacts may carry hashes, roots, refs, counts, schema ids, timestamps, signatures, nullifiers, and verifier outcomes. Public artifacts must never carry raw memory, prompts, transcripts, completions, embeddings, ACL bodies, tenant names, private keys, API keys, seed phrases, provider responses, local user paths, or credential-bearing URLs.
+
+The chain CLI boundary is local planning only. `enigma chain anchor`, `grant`, `revoke`, `attest`, and `verify` may generate or verify JSON, but they must not submit Solana transactions, create accounts, contact RPC providers, or represent a local plan as final settlement.
+
+## Scope
+
+In scope:
+
+- `enigma.proof_network.anchor_batch.v1` artifacts.
+- `enigma.proof_network.capability_grant.v1` artifacts.
+- `enigma.proof_network.capability_revocation.v1` artifacts.
+- `enigma.proof_network.benchmark_attestation.v1` artifacts.
+- `enigma.proof_network.packet.v1` envelopes.
+- Local `enigma chain anchor|grant|revoke|attest|verify` planning and validation commands.
+- Public-safe documentation examples, fixtures, and release artifacts.
+
+Out of scope:
+
+- Solana transaction submission, wallet custody, account creation, RPC provider operation, or chain finality claims.
+- Provider deletion, model forgetting, compliance certification, token ROI, provider invoice savings, or truth of memory content.
+- Raw benchmark datasets, private reports, prompts, answers, completions, provider responses, embeddings, and customer policy bodies.
+
+## Privacy boundaries
+
+### Local memory boundary
+
+Allowed public material:
+
+- `sha256:` commitments, Merkle roots, root refs, sequence refs, artifact ids, counts, schema ids, and signatures.
+
+Forbidden public material:
+
+- Raw memory text, private context packs, prompts, transcripts, completions, embeddings, provider responses, local paths, and user identifiers.
+
+Required control:
+
+- Every create and validate path calls `assertNoPrivateProofPayload(value)` before returning or accepting a public proof artifact.
+
+### Capability boundary
+
+Allowed public material:
+
+- Grant ids, issuer refs, subject refs, audience refs, exact scope ids, issued-at, expires-at, nonce hashes, grant hashes, and revocation nullifiers.
+
+Forbidden public material:
+
+- ACL bodies, tenant names, user emails, private policy text, bearer tokens, private keys, seed phrases, and connector config bodies.
+
+Required control:
+
+- Grants are least-privilege, expiring, nonce-bound, operation-bound, and revocable without disclosing private subjects.
+
+### Benchmark boundary
+
+Allowed public material:
+
+- Report hash, dataset ref, dataset hash, runner ref, package ref, aggregate metric names, metric boundary, and reproducibility refs.
+
+Forbidden public material:
+
+- Dataset rows, questions, answers, conversations, prompts, completions, provider credentials, and raw report text unless separately reviewed as public-safe.
+
+Required control:
+
+- Benchmark attestations bind to hashes and refs only and do not convert private benchmark data into public proof payloads.
+
+### Chain boundary
+
+Allowed public material:
+
+- Opaque anchor batch hash/root, artifact type, network hint, local transaction plan id, `transaction_submitted:false`, and `raw_memory_on_chain:false`.
+
+Forbidden public material:
+
+- Wallet seed phrases, private keys, credentialed RPC URLs, tenant-linked wallet labels, raw account owner names, memory payloads, and provider responses.
+
+Required control:
+
+- Chain commands emit offline planning artifacts only and make non-submission explicit.
+
+### Connector boundary
+
+Allowed public material:
+
+- Connector profile refs, capability refs, proof packet hashes, artifact schema ids, and recomputed verifier status.
+
+Forbidden public material:
+
+- Connector config secrets, local usernames in paths, copied config files, injected memory text, and connector-supplied private metadata.
+
+Required control:
+
+- Connectors are untrusted. Packet validation recomputes artifact hash and verifier status rather than trusting connector assertions.
+
+### Settlement boundary
+
+Allowed public material:
+
+- Quote hashes, receipt hashes, service refs, public operator refs, amount/currency fields, root refs, signer refs, and dispute refs.
+
+Forbidden public material:
+
+- Customer names, private workload descriptions, prompts, transcripts, invoice secrets, provider responses, and profit/savings claims.
+
+Required control:
+
+- Settlement artifacts prove bounded service metadata only. They do not prove provider savings, token profit, provider deletion, model forgetting, or compliance.
+
+## Assets and security goals
+
+| Asset | Security goal | Required property |
+| --- | --- | --- |
+| Anchor batch | Integrity, public verifiability, privacy minimization | Binds roots/refs into an opaque chain-ready plan without raw memory. |
+| Capability grant | Least privilege, replay resistance, auditable authorization | Scope, issuer, subject, audience, nonce, and expiry are explicit. |
+| Capability revocation | Public invalidation without subject disclosure | Revokes by grant hash/nullifier rather than private identity. |
+| Benchmark attestation | Reproducibility, poisoning resistance, claim discipline | Binds report, dataset, runner, and package refs without raw benchmark data. |
+| Proof packet | Safe interchange envelope | Carries one supported artifact, artifact hash, schema, and verifier metadata. |
+| CLI chain artifact | Operator-safe planning evidence | Local JSON only; no transaction submission, account creation, network call, or secret. |
+| Proof schemas | Fail-closed validation | Unknown/private fields and unsafe values are rejected. |
+
+## Threats, mitigations, and tests
+
+### 1. Privacy leakage
+
+Attack path:
+
+- A caller includes private fields such as raw memory, prompt text, transcript text, embedding vectors, provider response bodies, ACL bodies, tenant names, credentials, or seed material in an anchor, grant, revocation, attestation, or packet.
+
+Impact:
+
+- Public proof artifacts expose private user data, customer metadata, provider content, or credentials.
+
+Mitigations:
+
+- Centralize private key and private value rejection in `assertNoPrivateProofPayload(value)`.
+- Run the private-payload assertion in every `create*` and `validate*` function.
+- Keep public schemas allowlisted and reject unknown fields that could become covert payload channels.
+- Use hashes, roots, refs, counts, nullifiers, and signatures instead of memory or policy bodies.
+- Keep documentation examples hash-only and ref-only.
+
+Tests:
+
+- `PN-TM-001`: pass forbidden top-level keys into each artifact creator and expect rejection.
+- `PN-TM-002`: pass forbidden nested keys into each validator and expect rejection.
+- `PN-TM-003`: pass secret-looking values, private-key-looking blocks, credentialed URLs, and long free-text payloads and expect rejection.
+- `PN-TM-004`: verify CLI-generated chain artifacts include `raw_memory_on_chain:false` and do not include private field names.
+
+### 2. Metadata correlation
+
+Attack path:
+
+- Repeated roots, timestamps, counts, tenant-linked refs, account labels, local file names, dataset paths, or connector names allow observers to correlate artifacts across releases, customers, or operators.
+
+Impact:
+
+- An observer infers tenant identity, memory activity, benchmark activity, connector usage, or business events even without raw memory.
+
+Mitigations:
+
+- Prefer opaque refs and salted/structured commitments over names for tenants, users, accounts, datasets, and connectors.
+- Do not publish absolute local paths or workstation usernames.
+- Publish counts only when needed for verification.
+- Avoid exact operational timing unless freshness requires it; use issued/expiry windows rather than detailed activity timelines where possible.
+- Rotate grant refs and separate public packet ids from private operator ids.
+
+Tests:
+
+- `PN-TM-010`: benchmark attestations include file/ref name plus input hash only, not absolute paths.
+- `PN-TM-011`: grants and anchors reject tenant names, emails, account names, and local path-like values.
+- `PN-TM-012`: packet ids and grant ids remain opaque and do not embed connector names or user names.
+- `PN-TM-013`: fixtures verify counts and timestamps are the minimum needed by the schema.
+
+### 3. Malicious connector injection
+
+Attack path:
+
+- A compromised connector submits a proof packet with extra private fields, overbroad capability scope, unsupported artifact type, stale root, forged verifier metadata, or a mismatched artifact hash.
+
+Impact:
+
+- Private data enters public evidence, unauthorized capability is accepted, or operators trust a false `valid:true` result.
+
+Mitigations:
+
+- Treat connector packets as untrusted input.
+- Validate packet schema, supported artifact schema, capability scope, freshness, and artifact hash.
+- Recompute verifier status; never trust connector-supplied `valid:true` alone.
+- Reject unknown artifact types and private payload fields.
+- Require packet operation to match the bound grant scope.
+
+Tests:
+
+- `PN-TM-020`: mutate a valid packet with an unsupported artifact schema and expect failure.
+- `PN-TM-021`: add private payload fields to a packet and expect failure.
+- `PN-TM-022`: overbroaden grant scope or bind a grant to the wrong packet operation and expect failure.
+- `PN-TM-023`: alter artifact content without updating artifact hash and expect failure.
+- `PN-TM-024`: set forged verifier metadata to `valid:true`; validation recomputes and rejects the packet.
+
+### 4. Stale derived artifacts
+
+Attack path:
+
+- An anchor, grant, revocation, benchmark attestation, or packet is generated from a superseded root, old package ref, old report hash, expired grant, or already revoked capability.
+
+Impact:
+
+- Public proof appears fresh while binding obsolete state or revoked authority.
+
+Mitigations:
+
+- Include source root/report/package refs, created-at, issued-at, expires-at, sequence refs, and revocation nullifiers where applicable.
+- Validate expiration and revocation status before returning `valid:true`.
+- State that roots prove only the referenced snapshot, not current global state.
+- Bind packets to artifact hashes and freshness windows.
+
+Tests:
+
+- `PN-TM-030`: expired grants are rejected or marked expired.
+- `PN-TM-031`: revoked grants with matching nullifier are rejected or marked revoked.
+- `PN-TM-032`: stale packet timestamps fail freshness validation.
+- `PN-TM-033`: changed source root, report hash, or package ref causes validation failure.
+- `PN-TM-034`: verification output distinguishes stale/revoked from valid rather than silently accepting old state.
+
+### 5. Benchmark poisoning
+
+Attack path:
+
+- An attestation points to a report generated from modified datasets, answer leakage, provider completions, tuned fixture rows, unpinned runner logic, unverifiable package versions, or unsupported benchmark claims.
+
+Impact:
+
+- Public material overclaims memory quality, benchmark leadership, provider comparison, or LLM answer accuracy.
+
+Mitigations:
+
+- Bind attestation to report hash, dataset ref, dataset hash, runner ref, package ref, metric boundary, and claim boundary.
+- Keep raw dataset rows, questions, answers, conversations, prompts, and completions out of attestations.
+- State whether metrics are retrieval/evidence proxy metrics rather than LLM answer accuracy.
+- Reject unsupported claim types such as provider leadership, provider savings, token ROI, provider deletion, and model forgetting.
+
+Tests:
+
+- `PN-TM-040`: attestation without dataset hash, runner ref, package ref, or report hash fails.
+- `PN-TM-041`: attestation containing raw rows, questions, answers, prompts, or completions fails.
+- `PN-TM-042`: mutated report hash fails verification.
+- `PN-TM-043`: unsupported claim booleans or benchmark-leadership language fail documentation/example checks.
+- `PN-TM-044`: generated benchmark attestations preserve metric boundary text.
+
+### 6. Grant replay
+
+Attack path:
+
+- A capability grant is reused after expiry, copied across scopes, replayed with another packet, replayed by another subject, or used after revocation.
+
+Impact:
+
+- An unauthorized connector or operator performs anchoring, attestation, revocation, or verification actions outside the approved scope.
+
+Mitigations:
+
+- Grants include unique nonce/grant id, issuer ref, subject ref, optional audience ref, exact operation scopes, issued-at, expires-at, and grant hash.
+- Packets bind to the grant hash and requested operation.
+- Revocations publish nullifier artifacts that do not disclose private subjects.
+- Validators reject expired, wrong-scope, wrong-subject, wrong-audience, duplicate, or revoked grants.
+
+Tests:
+
+- `PN-TM-050`: replay an expired grant and expect rejection.
+- `PN-TM-051`: reuse a grant id with changed scope and expect hash/id mismatch.
+- `PN-TM-052`: attach a grant to the wrong packet operation and expect rejection.
+- `PN-TM-053`: include a matching revocation nullifier and expect revoked status.
+- `PN-TM-054`: duplicate nonce replay is rejected where a nonce cache or fixture set is provided.
+
+### 7. Solana account disclosure
+
+Attack path:
+
+- Chain planning output includes wallet labels, tenant-linked account names, seed phrases, private keys, credentialed RPC URLs, or account metadata that can deanonymize operators.
+
+Impact:
+
+- Public chain data or support artifacts link operators to tenants, reveal private wallet material, or compromise signing authority.
+
+Mitigations:
+
+- Anchor batches remain opaque and local-only.
+- Never include seed phrases, private keys, or credentialed URLs in artifacts, docs, fixtures, or tests.
+- Prefer operator-controlled public refs and network hints instead of account names.
+- Always emit `transaction_submitted:false` and `raw_memory_on_chain:false`.
+- Do not claim finality, confirmation, or settlement until a separate operator-controlled chain process provides reviewed evidence.
+
+Tests:
+
+- `PN-TM-060`: `enigma chain anchor` output includes `transaction_submitted:false` and `raw_memory_on_chain:false`.
+- `PN-TM-061`: anchor batch validation rejects seed/private-key/account-name fields.
+- `PN-TM-062`: chain artifacts reject credentialed RPC URLs and secret-looking values.
+- `PN-TM-063`: chain examples contain no wallet seed material or tenant-linked account labels.
+
+### 8. Settlement fraud
+
+Attack path:
+
+- A service, connector, or operator submits fake receipts, duplicate settlement refs, wrong roots, inflated amounts, missing signer refs, or public claims that imply token ROI/provider savings from proof artifacts.
+
+Impact:
+
+- Operators pay for unperformed work, disputes cannot be resolved, or public claims become misleading.
+
+Mitigations:
+
+- Bind settlement-facing artifacts to quote hash, receipt hash, service ref, root ref, amount bounds, unique settlement ref, and signer ref.
+- Reject duplicate refs, amount-above-quote, wrong-root, missing-signer, and unsupported-claim artifacts.
+- Keep settlement claim boundaries explicit: no provider invoice savings, token profit, compliance, provider deletion, or model forgetting claim follows from proof-network validation.
+- Preserve dispute refs and fraud indicators without revealing private workloads.
+
+Tests:
+
+- `PN-TM-070`: amount above quote fails validation.
+- `PN-TM-071`: duplicate settlement ref fails validation or produces a fraud indicator.
+- `PN-TM-072`: wrong root ref or missing signer ref fails validation.
+- `PN-TM-073`: ROI/provider-savings/token-profit claim fields fail validation.
+- `PN-TM-074`: settlement fixtures do not include private workload text, prompts, transcripts, tenant names, or provider responses.
+
+## Public artifact validation rules
+
+1. Fail closed on private-looking keys at every nested level.
+2. Fail closed on private-looking string values and long unstructured text blobs.
+3. Prefer refs, roots, hashes, counts, nullifiers, signatures, and schema ids over names or bodies.
+4. Bind each proof claim to its exact snapshot and schema.
+5. Make local-only chain behavior explicit with `transaction_submitted:false` and `raw_memory_on_chain:false`.
+6. Separate structural proof validity from business, legal, model behavior, and provider-operation claims.
+7. Reject unsupported schema ids rather than preserving them as opaque extensions.
+8. Treat connector-provided verification status as advisory until recomputed locally.
+
+## Minimum regression suite
+
+The release should keep focused tests for the new proof-network surface. These are targeted tests, not project-wide gates:
+
+- Pure module tests for all `create*` and `validate*` functions.
+- Forbidden payload tests for keys and values at top-level and nested positions.
+- Hash/ref mutation tests for every artifact type.
+- CLI artifact tests for `anchor`, `grant`, `revoke`, `attest`, and `verify` with public-safe inputs.
+- CLI negative tests for private-looking flags, private-looking JSON files, unsupported schemas, and stale artifacts.
+- Replay/freshness tests for expired grants, duplicate nonces, revoked nullifiers, stale packets, and wrong operation scopes.
+- Benchmark poisoning tests for missing refs, mutated report hashes, raw dataset rows, and unsupported benchmark claims.
+- Solana disclosure tests for private keys, seed phrases, credentialed RPC URLs, account labels, and false transaction-submitted claims.
+- Settlement fraud tests for duplicate refs, amount-above-quote, wrong roots, missing signers, and unsupported ROI/provider-savings claims.
+- Documentation/example scans for forbidden private field names, secret-looking values, and overclaim language.
+
+## Residual risks
+
+- Public roots, counts, and timestamps can still leak operational patterns through frequency analysis.
+- Hashes do not make low-entropy private values safe to publish. Tenant names, emails, short prompts, and small ACL bodies need a reviewed commitment design before public use.
+- Local chain planning does not prove Solana finality, account privacy, or settlement completion.
+- Benchmark attestations prove a report hash/ref relationship, not dataset licensing, fair external-provider comparison, or LLM answer correctness.
+- Capability grants reduce authorization ambiguity but do not protect a compromised local machine, stolen signing key, or malicious connector that already has authorized local access.
+- Settlement receipts can bound service evidence, but dispute resolution still needs operator process, key custody, and fraud review outside the artifact schema.
+
+## Release checklist
+
+Before publishing proof-network artifacts or docs:
+
+1. All public examples use hashes, roots, refs, counts, signatures, and nullifiers only.
+2. Every artifact creator and validator rejects private keys, private-looking fields, and private-looking values.
+3. Chain planning output includes `transaction_submitted:false` and `raw_memory_on_chain:false`.
+4. Grants are scoped, expiring, nonce-bound, operation-bound, and revocable.
+5. Benchmark attestations include report, dataset, runner, and package refs but no raw benchmark rows.
+6. Settlement-related artifacts bind quote/receipt/root/signer refs and reject ROI/provider-savings/token-profit claims.
+7. Documentation avoids claims of provider deletion, model forgetting, compliance certification, chain finality, token ROI, provider invoice savings, or benchmark leadership unless separately evidenced and approved.