enigma-memory 0.1.11 → 0.1.13

package/scripts/build-proof-network-packet.mjs

@@ -0,0 +1,213 @@
+#!/usr/bin/env node
+import { createHash } from 'node:crypto';
+import { mkdir, readFile, writeFile } from 'node:fs/promises';
+import { dirname, isAbsolute, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+import {
+  assertNoPrivateProofPayload,
+  createBenchmarkAttestation,
+  createProofNetworkAnchorBatch,
+  createProofNetworkPacket,
+  sha256Json,
+  validateBenchmarkAttestation,
+  validateProofNetworkAnchorBatch,
+  validateProofNetworkPacket,
+} from '../packages/proof-network/src/index.js';
+
+export const PROOF_NETWORK_PACKET_RELEASE_TARGET = '0.1.13';
+
+const HASH_RE = /^(?:sha256:)?[a-f0-9]{64}$/iu;
+const SECRET_VALUE_RE = /(?:Bearer\s+[A-Za-z0-9._~+/=-]{12,}|Basic\s+[A-Za-z0-9+/=-]{12,}|-----BEGIN [A-Z ]*PRIVATE KEY-----|https?:\/\/[^\s/@]+:[^\s/@]+@|sk-[A-Za-z0-9_-]{16,}|AKIA[0-9A-Z]{16}|\b(?:raw[\s_-]*memory|plaintext[\s_-]*prompts?|plain[\s_-]*text[\s_-]*prompts?|private[\s_-]*prompts?|provider[\s_-]*responses?|full[\s_-]*transcript|decrypted[\s_-]*memory|credentials?|secrets?|passwords?|private[\s_-]*keys?|api[\s_-]*key[\s_-]*(?:secret|material|value)|api[\s_-]*secrets?|access[\s_-]*tokens?|refresh[\s_-]*tokens?|token[\s_-]*values?|credential[\s_-]*material|tenant[\s_-]*names?)\b)/iu;
+const ABSOLUTE_LOCAL_PATH_RE = /^(?:[A-Za-z]:[\\/]|\\\\|\/(?:Users|home|tmp|var|etc|mnt|Volumes)\b)/u;
+
+class UsageError extends Error {
+  constructor(message) {
+    super(message);
+    this.name = 'UsageError';
+  }
+}
+
+function readRequiredValue(argv, index, flag) {
+  const value = argv[index + 1];
+  if (value === undefined || value.startsWith('--')) throw new UsageError(`${flag} requires a value`);
+  return value;
+}
+
+function assertPublicSafeString(value, label) {
+  if (typeof value !== 'string' || value.trim() === '') throw new UsageError(`${label} must be a non-empty public ref or hash`);
+  const normalized = value.trim();
+  if (SECRET_VALUE_RE.test(normalized)) throw new UsageError(`${label} contains private or secret material`);
+  return normalized;
+}
+
+function assertPublicHash(value, label) {
+  const normalized = assertPublicSafeString(value, label);
+  if (!HASH_RE.test(normalized)) throw new UsageError(`${label} must be a sha256 hash as 64 hex characters or sha256:<64 hex>`);
+  return normalized.toLowerCase().startsWith('sha256:') ? normalized.toLowerCase() : `sha256:${normalized.toLowerCase()}`;
+}
+
+function assertRelativeOutFile(value) {
+  const normalized = assertPublicSafeString(value, 'output file');
+  if (isAbsolute(normalized) || ABSOLUTE_LOCAL_PATH_RE.test(normalized)) throw new UsageError('output file must be a relative path');
+  return normalized;
+}
+
+export function parseArgs(argv = process.argv.slice(2)) {
+  const args = {
+    activeRoot: undefined,
+    receiptRoot: undefined,
+    benchmarkReport: undefined,
+    datasetHash: undefined,
+    runnerHash: undefined,
+    operatorRef: undefined,
+    out: undefined,
+    help: false,
+  };
+
+  for (let index = 0; index < argv.length; index += 1) {
+    const raw = argv[index];
+    const equalsIndex = raw.indexOf('=');
+    const flag = equalsIndex > 0 ? raw.slice(0, equalsIndex) : raw;
+    const inlineValue = equalsIndex > 0 ? raw.slice(equalsIndex + 1) : undefined;
+    const value = () => {
+      if (inlineValue !== undefined) return inlineValue;
+      const next = readRequiredValue(argv, index, flag);
+      index += 1;
+      return next;
+    };
+
+    if (flag === '--help' || flag === '-h') args.help = true;
+    else if (flag === '--active-root') args.activeRoot = assertPublicHash(value(), 'active root');
+    else if (flag === '--receipt-root') args.receiptRoot = assertPublicHash(value(), 'receipt root');
+    else if (flag === '--benchmark-report') args.benchmarkReport = value();
+    else if (flag === '--dataset-hash') args.datasetHash = assertPublicHash(value(), 'dataset hash');
+    else if (flag === '--runner-hash') args.runnerHash = assertPublicHash(value(), 'runner hash');
+    else if (flag === '--operator-ref') args.operatorRef = assertPublicSafeString(value(), 'operator ref');
+    else if (flag === '--out') args.out = assertRelativeOutFile(value());
+    else throw new UsageError(`unknown option ${raw}; use --help`);
+  }
+  return args;
+}
+
+export function usage() {
+  return `Usage: node scripts/build-proof-network-packet.mjs --active-root <sha256> --receipt-root <sha256> --benchmark-report <file> --dataset-hash <sha256> --runner-hash <sha256> --operator-ref <ref> [--out <file>]
+
+Builds a public-safe proof-network packet from local refs and hashes. The benchmark report file is hashed only; its body and path are never copied into the packet. This script does not call a network, deploy contracts, create accounts, sign transactions, or write raw memory, prompts, transcripts, completions, embeddings, ACL bodies, tenant names, private keys, API keys, seed phrases, or provider responses.
+`;
+}
+
+function requireArgs(args) {
+  const required = [
+    ['--active-root', args.activeRoot],
+    ['--receipt-root', args.receiptRoot],
+    ['--benchmark-report', args.benchmarkReport],
+    ['--dataset-hash', args.datasetHash],
+    ['--runner-hash', args.runnerHash],
+    ['--operator-ref', args.operatorRef],
+  ];
+  const missing = required.filter(([, value]) => value === undefined).map(([name]) => name);
+  if (missing.length > 0) throw new UsageError(`missing required option(s): ${missing.join(', ')}`);
+}
+
+function sha256Buffer(buffer) {
+  return `sha256:${createHash('sha256').update(buffer).digest('hex')}`;
+}
+
+function withBoundaryFlags(packet) {
+  return {
+    transaction_submitted: false,
+    raw_memory_on_chain: false,
+    ...packet,
+    transaction_submitted: false,
+    raw_memory_on_chain: false,
+  };
+}
+
+function assertValidation(validation, label) {
+  if (validation?.ok !== true) throw new Error(`${label} validation failed: ${(validation?.errors ?? ['unknown error']).join('; ')}`);
+}
+
+export async function buildProofNetworkPacket(args, options = {}) {
+  requireArgs(args);
+  const generatedAt = options.generated_at ?? options.generatedAt ?? new Date().toISOString();
+  const reportBytes = await readFile(args.benchmarkReport);
+  const reportHash = sha256Buffer(reportBytes);
+  const packageRef = `npm:enigma-memory@${PROOF_NETWORK_PACKET_RELEASE_TARGET}`;
+
+  const publicInputs = {
+    active_root: args.activeRoot,
+    receipt_root: args.receiptRoot,
+    report_hash: reportHash,
+    dataset_ref: args.datasetHash,
+    runner_ref: args.runnerHash,
+    operator_ref: args.operatorRef,
+    package_ref: packageRef,
+    transaction_submitted: false,
+    raw_memory_on_chain: false,
+  };
+  assertNoPrivateProofPayload(publicInputs);
+
+  const operatorSignatureRef = `signature:${sha256Json(args.operatorRef).slice('sha256:'.length)}`;
+  const benchmarkAttestation = createBenchmarkAttestation({
+    report_hash: reportHash,
+    dataset_ref: args.datasetHash,
+    runner_ref: args.runnerHash,
+    package_ref: packageRef,
+    benchmark_ref: `benchmark-report:${reportHash}`,
+    signature_ref: operatorSignatureRef,
+    attested_at: generatedAt,
+  });
+  assertValidation(validateBenchmarkAttestation(benchmarkAttestation), 'benchmark attestation');
+
+  const anchorBatch = createProofNetworkAnchorBatch({
+    chain: 'solana',
+    generated_at: generatedAt,
+    anchor_ref: `anchor:${sha256Json([args.activeRoot, args.receiptRoot, reportHash]).slice('sha256:'.length, 'sha256:'.length + 32)}`,
+    commitments: [
+      { kind: 'active_root', root: args.activeRoot, ref: 'active-root' },
+      { kind: 'receipt_root', root: args.receiptRoot, ref: 'receipt-root' },
+      { kind: 'benchmark_report', root: reportHash, ref: 'benchmark-report' },
+      { kind: 'benchmark_attestation', root: benchmarkAttestation.benchmark_attestation_hash, ref: 'benchmark-attestation' },
+      { kind: 'operator_ref', root: sha256Json(args.operatorRef), ref: args.operatorRef },
+    ],
+  });
+  assertValidation(validateProofNetworkAnchorBatch(anchorBatch), 'anchor batch');
+
+  const packet = withBoundaryFlags(createProofNetworkPacket({
+    anchor_batches: [anchorBatch],
+    attestations: [benchmarkAttestation],
+    packet_ref: `proof-network-packet:${sha256Json([anchorBatch.anchor_batch_hash, benchmarkAttestation.benchmark_attestation_hash]).slice('sha256:'.length, 'sha256:'.length + 32)}`,
+    created_at: generatedAt,
+  }));
+  assertNoPrivateProofPayload(packet);
+  assertValidation(validateProofNetworkPacket(packet), 'proof-network packet');
+  return packet;
+}
+
+export async function main(argv = process.argv.slice(2)) {
+  const args = parseArgs(argv);
+  if (args.help) {
+    process.stdout.write(usage());
+    return 0;
+  }
+  const packet = await buildProofNetworkPacket(args);
+  const json = `${JSON.stringify(packet, null, 2)}\n`;
+  if (args.out) {
+    try {
+      await mkdir(dirname(args.out), { recursive: true });
+      await writeFile(args.out, json, 'utf8');
+    } catch {
+      throw new Error('failed to write proof-network packet output');
+    }
+  }
+  process.stdout.write(json);
+  return 0;
+}
+
+if (process.argv[1] && fileURLToPath(import.meta.url) === resolve(process.argv[1])) {
+  main().catch((error) => {
+    process.stderr.write(`${error.name ?? 'Error'}: ${error.message ?? 'failed to build proof-network packet'}\n`);
+    process.exitCode = 1;
+  });
+}

package/scripts/run-standard-memory-benchmarks.mjs

@@ -995,7 +995,7 @@ function buildSuiteReport(datasetRows, topK, options) {
     generated_at: options.generated_at ?? new Date().toISOString(),
     package: {
       name: 'enigma-memory',
-      version: '0.1.11',
+      version: '0.1.13',
     },
     public_safe: true,
     top_k: topK,

package/scripts/simulate-production-env.mjs

@@ -0,0 +1,210 @@
+#!/usr/bin/env node
+// Enigma Memory — generate local-simulation secrets and TLS material.
+// CLAIM BOUNDARY: local-simulation only. The files created by this script are
+// bind-mounted by deploy/docker-compose.local-production-simulation.yml. They
+// are not production secrets, HSM custody, or real operator evidence.
+
+import { spawnSync } from 'node:child_process'
+import { generateKeyPairSync, randomUUID } from 'node:crypto'
+import fs from 'node:fs'
+import path from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..')
+const DEFAULT_SECRETS_DIR = path.join(ROOT, 'deploy', 'secrets-simulation')
+
+const REQUIRED_SECRET_FILES = [
+  'relay-signing-key',
+  'gateway-signing-key',
+  'external-storage-dsn',
+  'kms-key-ref',
+  'backup-target-uri',
+  'siem-export-endpoint',
+  'operator-acceptance-evidence-uri',
+  'gateway-admin-auth-bearer',
+  'gateway-data-plane-auth-bearer',
+  'tls.crt',
+  'tls.key',
+]
+
+function parseArgs(argv) {
+  const flags = { check: false, secretsDir: DEFAULT_SECRETS_DIR }
+  for (let i = 0; i < argv.length; i += 1) {
+    const arg = argv[i]
+    if (arg === '--check') {
+      flags.check = true
+    } else if (arg === '--secrets-dir') {
+      i += 1
+      if (i >= argv.length) throw new Error('--secrets-dir requires a path')
+      flags.secretsDir = path.resolve(argv[i])
+    } else if (arg === '--help' || arg === '-h') {
+      process.stdout.write(
+        'Usage: node scripts/simulate-production-env.mjs [--check] [--secrets-dir <dir>]\n' +
+          '\n' +
+          'Generates local-simulation secret files and a self-signed TLS certificate\n' +
+          `under ${DEFAULT_SECRETS_DIR} (customizable with --secrets-dir).\n` +
+          'Run with --check to verify required files exist and are non-empty.\n'
+      )
+      process.exit(0)
+    }
+  }
+  return flags
+}
+
+function generateKmsKeyRef() {
+  const pair = generateKeyPairSync('ed25519', {
+    privateKeyEncoding: { type: 'pkcs8', format: 'pem' },
+    publicKeyEncoding: { type: 'spki', format: 'pem' },
+  })
+  return (
+    JSON.stringify(
+      {
+        schema: 'enigma.local_simulation_kms_key_ref.v1',
+        key_id: `local-simulation-kms-key-${randomUUID()}`,
+        alg: 'Ed25519',
+        public_key: pair.publicKey,
+        private_key: pair.privateKey,
+        claim_boundary: 'local-simulation only. This is not HSM-grade key custody.',
+      },
+      null,
+      2
+    ) + '\n'
+  )
+}
+
+const SECRET_GENERATORS = {
+  'relay-signing-key': () => 'local-simulation-relay-signing-key-ref\n',
+  'gateway-signing-key': () => 'local-simulation-gateway-signing-key-ref\n',
+  'external-storage-dsn': () => 'postgres://enigma:enigma@postgres:5432/enigma?sslmode=disable\n',
+  'kms-key-ref': generateKmsKeyRef,
+  'backup-target-uri': () => 'file:///tmp/enigma-backups\n',
+  'siem-export-endpoint': () => 'http://siem-mock:3000/events\n',
+  'operator-acceptance-evidence-uri': () => 'file:///run/secrets/operator-acceptance-evidence-uri\n',
+  'gateway-admin-auth-bearer': () => 'local-simulation-admin-token\n',
+  'gateway-data-plane-auth-bearer': () => 'local-simulation-data-plane-token\n',
+}
+
+function ensureDir(dir) {
+  fs.mkdirSync(dir, { recursive: true })
+}
+
+function isMissingOrEmpty(filePath) {
+  try {
+    const stat = fs.statSync(filePath)
+    return !stat.isFile() || stat.size === 0
+  } catch {
+    return true
+  }
+}
+
+function generateTlsCerts(secretsDir) {
+  const key = path.join(secretsDir, 'tls.key')
+  const cert = path.join(secretsDir, 'tls.crt')
+  const config = path.join(secretsDir, '.openssl-tmp.cnf')
+  const configText =
+    '[req]\n' +
+    'distinguished_name = req_distinguished_name\n' +
+    'x509_extensions = v3_req\n' +
+    'prompt = no\n' +
+    '\n' +
+    '[req_distinguished_name]\n' +
+    'CN = sim.enigmamemory.com\n' +
+    '\n' +
+    '[v3_req]\n' +
+    'subjectAltName = @alt_names\n' +
+    '\n' +
+    '[alt_names]\n' +
+    'DNS.1 = localhost\n' +
+    'DNS.2 = sim.enigmamemory.com\n' +
+    'DNS.3 = relay.sim.enigmamemory.com\n' +
+    'DNS.4 = gateway.sim.enigmamemory.com\n' +
+    'DNS.5 = *.sim.enigmamemory.com\n' +
+    'IP.1 = 127.0.0.1\n'
+  fs.writeFileSync(config, configText)
+  try {
+    const result = spawnSync(
+      'openssl',
+      [
+        'req', '-x509', '-nodes', '-newkey', 'rsa:2048',
+        '-keyout', key,
+        '-out', cert,
+        '-days', '365',
+        '-config', config,
+      ],
+      { stdio: 'pipe' }
+    )
+    if (result.status !== 0) {
+      throw new Error(
+        `Failed to generate self-signed TLS certificate: ${result.stderr?.toString() || 'openssl exited non-zero'}`
+      )
+    }
+  } finally {
+    try {
+      fs.unlinkSync(config)
+    } catch {
+      // ignore cleanup failure
+    }
+  }
+}
+
+function generateSecrets(secretsDir) {
+  ensureDir(secretsDir)
+  for (const name of REQUIRED_SECRET_FILES) {
+    if (name === 'tls.crt' || name === 'tls.key') continue
+    const filePath = path.join(secretsDir, name)
+    if (isMissingOrEmpty(filePath)) {
+      fs.writeFileSync(filePath, SECRET_GENERATORS[name](), { mode: 0o600 })
+    }
+  }
+  const keyPath = path.join(secretsDir, 'tls.key')
+  const certPath = path.join(secretsDir, 'tls.crt')
+  if (isMissingOrEmpty(keyPath) || isMissingOrEmpty(certPath)) {
+    generateTlsCerts(secretsDir)
+  }
+}
+
+function check(secretsDir) {
+  const missing = []
+  for (const name of REQUIRED_SECRET_FILES) {
+    if (isMissingOrEmpty(path.join(secretsDir, name))) missing.push(name)
+  }
+  if (missing.length > 0) {
+    process.stderr.write(`Missing or empty simulation secrets: ${missing.join(', ')}\n`)
+    process.exit(1)
+  }
+  process.stdout.write(
+    `All ${REQUIRED_SECRET_FILES.length} required simulation secret files exist and are non-empty in ${secretsDir}\n`
+  )
+}
+
+function printStartInstructions() {
+  process.stdout.write('\n')
+  process.stdout.write('To start the local production simulation, run:\n')
+  process.stdout.write('  docker compose -f deploy/docker-compose.local-production-simulation.yml up --build -d\n')
+  process.stdout.write('\n')
+  process.stdout.write('To make the public-looking domain resolve locally, add this line to /etc/hosts\n')
+  process.stdout.write('(or C:\\Windows\\System32\\drivers\\etc\\hosts on Windows):\n')
+  process.stdout.write('  127.0.0.1 sim.enigmamemory.com relay.sim.enigmamemory.com gateway.sim.enigmamemory.com\n')
+  process.stdout.write('\n')
+  process.stdout.write('To wait for the backend to be ready:\n')
+  process.stdout.write('  node scripts/wait-for-backend-ready.mjs\n')
+  process.stdout.write('\n')
+  process.stdout.write('To inspect public HTTPS readiness (self-signed cert, use -k with curl):\n')
+  process.stdout.write('  curl -k https://localhost:8443/readyz\n')
+  process.stdout.write('  curl -k https://localhost:9443/readyz\n')
+  process.stdout.write('  curl -k https://sim.enigmamemory.com:8443/readyz\n')
+  process.stdout.write('  curl -k https://sim.enigmamemory.com:9443/readyz\n')
+}
+
+function main() {
+  const flags = parseArgs(process.argv.slice(2))
+  if (flags.check) {
+    check(flags.secretsDir)
+    return
+  }
+  generateSecrets(flags.secretsDir)
+  check(flags.secretsDir)
+  printStartInstructions()
+}
+
+main()

package/scripts/verify-registry-install.mjs

@@ -24,6 +24,7 @@ export const DEFAULT_REGISTRY_VERSION = PACKAGE_JSON.version;
 export const REGISTRY_INSTALL_CHECKS = Object.freeze([
   Object.freeze({ step: 'check_enigma_help', bin: 'enigma', args: Object.freeze(['--help']) }),
   Object.freeze({ step: 'check_enigma_doctor', bin: 'enigma', args: Object.freeze(['doctor']) }),
+  Object.freeze({ step: 'check_enigma_test_drive_dry_run', bin: 'enigma', args: Object.freeze(['test-drive', '--dry-run']) }),
   Object.freeze({ step: 'check_enigma_relay_demo', bin: 'enigma-relay', args: Object.freeze(['demo']) }),
   Object.freeze({ step: 'check_enigma_gateway_demo', bin: 'enigma-gateway', args: Object.freeze(['demo']) }),
 ]);

package/scripts/wait-for-backend-ready.mjs

@@ -0,0 +1,101 @@
+#!/usr/bin/env node
+// Enigma Memory — poll local simulated backend /readyz endpoints.
+// CLAIM BOUNDARY: local-simulation only. Accepts self-signed TLS certificates.
+
+import https from 'node:https'
+import { parseArgs } from 'node:util'
+
+const ENDPOINTS = [
+  { name: 'relay', url: 'https://localhost:8443/readyz' },
+  { name: 'gateway', url: 'https://localhost:9443/readyz' },
+]
+
+function parseCliArgs(argv) {
+  const { values } = parseArgs({
+    args: argv,
+    options: {
+      timeout: { type: 'string', short: 't', default: '120' },
+      interval: { type: 'string', short: 'i', default: '2' },
+      help: { type: 'boolean', short: 'h', default: false },
+    },
+  })
+  if (values.help) {
+    process.stdout.write(
+      'Usage: node scripts/wait-for-backend-ready.mjs [--timeout <seconds>] [--interval <seconds>]\n' +
+        '\n' +
+        'Polls the local simulated backend /readyz endpoints until they return 200.\n' +
+        'Self-signed TLS certificates are accepted because this is local simulation only.\n'
+    )
+    process.exit(0)
+  }
+  const timeoutMs = Number(values.timeout) * 1000
+  const intervalMs = Number(values.interval) * 1000
+  if (!Number.isFinite(timeoutMs) || timeoutMs <= 0) {
+    throw new Error('--timeout must be a positive number')
+  }
+  if (!Number.isFinite(intervalMs) || intervalMs <= 0) {
+    throw new Error('--interval must be a positive number')
+  }
+  return { timeoutMs, intervalMs }
+}
+
+function fetchStatus(url) {
+  return new Promise((resolve) => {
+    const req = https.get(url, { rejectUnauthorized: false }, (res) => {
+      let body = ''
+      res.setEncoding('utf8')
+      res.on('data', (chunk) => {
+        body += chunk
+      })
+      res.on('end', () => {
+        resolve({ statusCode: res.statusCode, body })
+      })
+    })
+    req.on('error', (error) => {
+      resolve({ statusCode: 0, error: error.message })
+    })
+    req.setTimeout(5000, () => {
+      req.destroy()
+      resolve({ statusCode: 0, error: 'request timeout' })
+    })
+  })
+}
+
+function sleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms))
+}
+
+async function main() {
+  const { timeoutMs, intervalMs } = parseCliArgs(process.argv.slice(2))
+  const deadline = Date.now() + timeoutMs
+  const pending = new Map(ENDPOINTS.map((ep) => [ep.name, ep]))
+
+  while (pending.size > 0 && Date.now() < deadline) {
+    for (const [name, ep] of pending) {
+      const result = await fetchStatus(ep.url)
+      if (result.statusCode === 200) {
+        process.stdout.write(`${name} ready at ${ep.url}\n`)
+        pending.delete(name)
+      } else {
+        process.stdout.write(
+          `${name} not ready (${result.statusCode || 'no response'}${result.error ? ` - ${result.error}` : ''})\n`
+        )
+      }
+    }
+    if (pending.size > 0) {
+      const waitMs = Math.min(intervalMs, deadline - Date.now())
+      if (waitMs > 0) await sleep(waitMs)
+    }
+  }
+
+  if (pending.size > 0) {
+    process.stderr.write(`Timed out waiting for: ${[...pending.keys()].join(', ')}\n`)
+    process.exit(1)
+  }
+  process.stdout.write('All backend services are ready.\n')
+}
+
+main().catch((error) => {
+  process.stderr.write(`${error instanceof Error ? error.message : String(error)}\n`)
+  process.exit(1)
+})

package/specs/goal-completion-audit-v1.schema.json

@@ -22,6 +22,7 @@
     "schema": { "const": "enigma.goal_completion_audit.v1" },
     "generated_at": { "type": "string", "format": "date-time" },
     "objective": { "type": "string", "minLength": 1 },
+    "environment": { "type": "string", "minLength": 1 },
     "complete": { "type": "boolean" },
     "release_posture": { "type": "string", "minLength": 1 },
     "go_live_ready": { "type": "boolean" },

package/specs/proof-network-anchor-batch-v1.schema.json

@@ -0,0 +1,125 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://schemas.enigma.ai/proof-network-anchor-batch-v1.schema.json",
+  "title": "Enigma Proof Network Anchor Batch v1",
+  "type": "object",
+  "required": [
+    "schema",
+    "anchor_batch_id",
+    "anchor_batch_hash",
+    "generated_at",
+    "anchor_ref",
+    "chain",
+    "cluster_ref",
+    "commitment_count",
+    "root_count",
+    "commitment_root",
+    "commitments",
+    "solana_ready_anchor",
+    "transaction_submitted",
+    "raw_memory_on_chain",
+    "raw_data_included"
+  ],
+  "additionalProperties": false,
+  "properties": {
+    "schema": { "const": "enigma.proof_network.anchor_batch.v1" },
+    "anchor_batch_id": { "type": "string", "minLength": 8 },
+    "anchor_batch_hash": { "$ref": "#/$defs/sha256Digest" },
+    "generated_at": { "type": "string", "format": "date-time" },
+    "package_version": { "type": "string", "minLength": 1 },
+    "anchor_ref": { "$ref": "#/$defs/publicRef" },
+    "chain": { "const": "solana" },
+    "cluster_ref": { "$ref": "#/$defs/publicRef" },
+    "commitment_count": { "type": "integer", "minimum": 1 },
+    "root_count": { "type": "integer", "minimum": 1 },
+    "commitment_root": { "$ref": "#/$defs/sha256Digest" },
+    "commitments": {
+      "type": "array",
+      "minItems": 1,
+      "items": { "$ref": "#/$defs/commitment" }
+    },
+    "solana_ready_anchor": { "$ref": "#/$defs/solanaReadyAnchor" },
+    "leakage_scan": { "$ref": "#/$defs/leakageScan" },
+    "transaction_submitted": { "const": false },
+    "raw_memory_on_chain": { "const": false },
+    "raw_data_included": { "const": false },
+    "private_payload_included": { "const": false },
+    "signer": { "$ref": "#/$defs/signer" },
+    "signature": { "$ref": "#/$defs/signature" }
+  },
+  "$defs": {
+    "sha256Digest": { "type": "string", "pattern": "^sha256:[a-f0-9]{64}$" },
+    "publicRef": { "type": "string", "minLength": 1 },
+    "commitment": {
+      "type": "object",
+      "required": ["kind", "root"],
+      "additionalProperties": false,
+      "properties": {
+        "kind": {
+          "type": "string",
+          "enum": [
+            "active_set_root",
+            "receipt_log_root",
+            "capability_grant_root",
+            "capability_revocation_root",
+            "benchmark_attestation_root",
+            "proof_packet_root",
+            "custom_root"
+          ]
+        },
+        "root": { "$ref": "#/$defs/sha256Digest" },
+        "ref": { "$ref": "#/$defs/publicRef" },
+        "count": { "type": "integer", "minimum": 0 }
+      }
+    },
+    "solanaReadyAnchor": {
+      "type": "object",
+      "required": ["payload_hash", "account_seed", "instruction_ref", "opaque_payload_only"],
+      "additionalProperties": false,
+      "properties": {
+        "payload_hash": { "$ref": "#/$defs/sha256Digest" },
+        "account_seed": { "$ref": "#/$defs/publicRef" },
+        "instruction_ref": { "$ref": "#/$defs/publicRef" },
+        "opaque_payload_only": { "const": true },
+        "transaction_submitted": { "const": false }
+      }
+    },
+    "leakageScan": {
+      "type": "object",
+      "required": ["scanned", "passed", "policy", "raw_data_detected", "private_payload_detected", "forbidden_field_names"],
+      "additionalProperties": false,
+      "properties": {
+        "scanned": { "const": true },
+        "passed": { "const": true },
+        "policy": { "const": "public_hashes_roots_refs_counts_only" },
+        "raw_data_detected": { "const": false },
+        "private_payload_detected": { "const": false },
+        "forbidden_field_names": {
+          "type": "array",
+          "maxItems": 0,
+          "items": { "type": "string" }
+        },
+        "scanner_ref": { "$ref": "#/$defs/publicRef" },
+        "scanned_at": { "type": "string", "format": "date-time" }
+      }
+    },
+    "signer": {
+      "type": "object",
+      "required": ["alg", "key_id"],
+      "additionalProperties": false,
+      "properties": {
+        "alg": { "const": "Ed25519" },
+        "key_id": { "$ref": "#/$defs/publicRef" }
+      }
+    },
+    "signature": {
+      "type": "object",
+      "required": ["alg", "value"],
+      "additionalProperties": false,
+      "properties": {
+        "alg": { "const": "Ed25519" },
+        "value": { "type": "string", "minLength": 64 }
+      }
+    }
+  }
+}