kxco-pq-audit 1.2.1 → 1.2.3

package/CHANGELOG.md

@@ -0,0 +1,26 @@
+# Changelog
+
+## 1.2.3
+
+### Corrected
+
+The README claimed `@noble/post-quantum` was audited by Cure53 in 2024.
+It is maintainer-audited (v0.6.1, April 2026), not Cure53-audited.
+
+The other Noble packages were audited separately and at different dates, and
+none of those engagements reached the post-quantum package:
+
+| Package | Audited by |
+|---|---|
+| `@noble/post-quantum` | maintainer-audited |
+| `@noble/hashes` | Cure53, Jan 2022, v1.0.0 |
+| `@noble/curves` | Trail of Bits Feb 2023; Kudelski Sep 2023; Cure53 Sep 2024 |
+| `@noble/ciphers` | Cure53, Sep 2024, v1.0.0 |
+
+Dates from `kxco-post-quantum/audit/dependency-review.json`, which is generated
+by `audit/run-audit.mjs` rather than written by hand.
+
+Documentation only. No code changed and no behaviour changed.
+
+`.socket.yml` said `@noble/hashes` was audited by Cure53 in 2024. The audit
+was real but the date was wrong: January 2022, at v1.0.0.

package/README.md

@@ -7,6 +7,33 @@
 
 Tamper-evident post-quantum audit log. Every operation produces an ML-DSA-65-signed entry chained to the previous via SHA-256. `verify()` replays the entire log — any gap, reorder, or edit breaks the chain or a signature.
 
+## Release integrity
+
+Every release of this package is checkable without asking us for anything.
+
+- **Provenance.** Each release carries a SLSA provenance attestation tying the
+  published tarball to the commit and workflow that built it. Verify with
+  `npm audit signatures`, or read it directly from
+  `registry.npmjs.org/-/npm/v1/attestations/kxco-pq-audit@<version>`.
+- **Bill of materials.** A CycloneDX SBOM is published as a GitHub Release asset
+  at `releases/download/v<version>/sbom.cyclonedx.json`, a permanent
+  unauthenticated URL. Not an expiring build artifact.
+- **Pinned where it matters.** Third-party dependencies are pinned to exact
+  versions, never ranges, so the code that performs the cryptography cannot
+  change without a release. Sibling `kxco-*` packages sit on caret ranges
+  deliberately: it means a correctness fix in the base package reaches you
+  without a release of every package above it. That is not theoretical. When
+  `@noble/post-quantum` 0.7.1 was found to fail NIST SLH-DSA verification
+  vectors, the revert in the base package propagated here on the next install.
+  Every GitHub Action is pinned by 40-character commit SHA.
+- **Conformance underneath.** The cryptography comes from
+  [`kxco-post-quantum`](https://www.npmjs.com/package/kxco-post-quantum), which
+  is run against **2,103 NIST ACVP vectors (0 failed)** and a **225-check
+  cross-implementation interoperability matrix** against liboqs, Bouncy Castle
+  and two pure-Python implementations, in both directions and with negative
+  controls. Its published tarball also rebuilds bit-for-bit from its own tag,
+  verified in CI on every run.
+
 ## When to use this
 
 Use this when you need a cryptographic proof that a sequence of operations happened, in order, and was not altered after the fact.
@@ -145,7 +172,19 @@ The checkpoint provides an on-chain timestamp proving that at least N entries ex
 
 ## Security
 
-Entry signing uses [Noble post-quantum](https://github.com/paulmillr/noble-post-quantum) ML-DSA-65 (NIST FIPS 204) and [Noble hashes](https://github.com/paulmillr/noble-hashes) SHA-256 — independently audited by Cure53 (2024). The hash chain means a compromised or deleted entry cannot be hidden: any gap breaks verification of every subsequent entry.
+**ML-DSA-65** (NIST FIPS 204) via [`kxco-post-quantum`](https://www.npmjs.com/package/kxco-post-quantum), running on the OpenSSL 3.5 primitives where the runtime provides them. No custom cryptography.
+
+Evidenced, and reproducible on your own machine:
+
+- **2,103 NIST ACVP vectors** across FIPS 203, 204 and 205, pinned by digest
+- **225 interoperability checks** against OpenSSL 3.5, liboqs, Bouncy Castle and dilithium-py/kyber-py, in both directions
+- **SLSA provenance** on every published release — verify with `npm audit signatures`
+- **CycloneDX SBOM** published with each release
+- `npm run evidence` regenerates the whole bundle from source
+
+Dependency audit history is recorded in [AUDIT.md](https://github.com/KnightsbridgeAIQ/kxco-post-quantum/blob/main/AUDIT.md).
+
+The hash chain means a compromised or deleted entry cannot be hidden: any gap breaks verification of every subsequent entry.
 
 To report a vulnerability, open a [private security advisory](https://github.com/KnightsbridgeAIQ/kxco-pq-audit/security/advisories/new) or email **security@kxco.ai**.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kxco-pq-audit",
-  "version": "1.2.1",
+  "version": "1.2.3",
   "description": "Tamper-evident post-quantum audit log for regulated institutions. ML-DSA-65-signed, SHA-256 hash-chained entries. Any tampering breaks the chain. Optional Armature L1 checkpoint anchoring via the KXCO relay.",
   "keywords": [
     "post-quantum",
@@ -50,14 +50,16 @@
     }
   },
   "files": [
-    "src",
-    "LICENSE"
+    "CHANGELOG.md",
+    "LICENSE",
+    "README.md",
+    "src"
   ],
   "engines": {
     "node": ">=20.19"
   },
   "dependencies": {
-    "@noble/hashes": "2.3.0",
+    "@noble/hashes": "2.4.0",
     "kxco-post-quantum": "^1.3.0"
   },
   "scripts": {