provared 0.2.0 → 0.4.0

package/docs/threat-model.md

@@ -58,10 +58,10 @@ keys. People decide what it means.
   under a seal, whose three signatures include two quantum-safe ones.
   The outside time-stamps themselves are of today's kind.
 - **A signature that cannot be checked is not a pass.** Where a device
-  has no built-in ML-DSA, the checker says so, and never reports the
-  record as intact. An entry none of whose signatures the device could
-  check is not treated as evidence: what it says is not shown, and it is
-  not compared with its slip.
+  has no built-in ML-DSA, or no SLH-DSA for a seal, the checker says
+  so, and never reports the record as intact. An entry none of whose
+  signatures the device could check is not treated as evidence: what it
+  says is not shown, and it is not compared with its slip.
 - **A record does not show that an action was wise, lawful or wanted.**
 - **A badly written slip is faithfully recorded as a badly written slip.**
 
@@ -450,7 +450,12 @@ within 5 minutes for a time-stamp from a service, and to within 2 hours
 and 5 minutes for a block time-stamp). A6 cannot make a
 seal: it needs the recorder's three keys. A8 must break Ed25519, ML-DSA-87
 and SLH-DSA together to forge a seal; the third rests only on fingerprint
-functions. Nobody can move a time-stamp to another seal: it is made over
+functions. One exception, stated: the check before acting on a device
+without SLH-DSA (the Python version, every browser) goes on after a seal
+whose first two signatures check there, so on that device a seal rests on
+Ed25519 and ML-DSA-87 alone, and a third signature of the right length
+that would not check is not seen. A device with SLH-DSA, such as the
+command-line checker, sees it. Nobody can move a time-stamp to another seal: it is made over
 the seal's fingerprint.
 
 A block time-stamp is a second witness of the time, which rests on no
@@ -490,8 +495,12 @@ person checking gives.
   does not read what a certificate says its key is for. It checks that
   the stated time lies within the certificate's dates, and leaves the
   rest to the person who chose to trust it.
-- **A browser.** No browser offers SLH-DSA or ML-DSA to a page yet. A
-  checker there reports a seal as not fully checked, never as a pass.
+- **A browser.** Tried on the author's computer on 13 October 2026:
+  Chrome 155, Edge 155 and Brave 155 offer ML-DSA to a page; none of the
+  three offers SLH-DSA. So a checker in a browser
+  reports a seal as not fully checked, never as a pass, and counts no
+  time-stamp beside it. In a browser without ML-DSA, every record signed
+  with ML-DSA is reported as not fully checked too.
 - **A few bytes of a time-stamp's wrapper** are not covered by the
   service's signature (the list of fingerprint methods, and the lines
   that name the certificate by its issuer). Changing them changes nothing

package/package.json

@@ -1,13 +1,32 @@
 {
   "name": "provared",
-  "version": "0.2.0",
-  "description": "Proof of what an AI agent was allowed to do, and what it then did. Evidence, not a verdict.",
+  "version": "0.4.0",
+  "description": "Proof of what an AI agent was allowed to do, and what it then did. A passkey-signed permission with limits a machine can check, a signed receipt for each action, and a free checker. Evidence, not a verdict.",
   "author": "Pavel Izmaylov",
   "license": "Apache-2.0 AND CC-BY-4.0",
+  "homepage": "https://prova.red",
+  "bugs": "https://github.com/provared/provared/issues",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/provared/provared.git"
   },
+  "keywords": [
+    "ai-agent",
+    "agent",
+    "audit-trail",
+    "permission",
+    "authorization",
+    "receipt",
+    "tamper-evident",
+    "passkey",
+    "webauthn",
+    "jws",
+    "ed25519",
+    "ml-dsa",
+    "post-quantum",
+    "evidence",
+    "langchain"
+  ],
   "files": [
     "src/",
     "bin/",
@@ -38,6 +57,10 @@
       "types": "./src/passkey-browser.d.ts",
       "default": "./src/passkey-browser.js"
     },
+    "./dev": {
+      "types": "./src/dev.d.ts",
+      "default": "./src/dev.js"
+    },
     "./package.json": "./package.json"
   },
   "bin": {

package/page/index.html

@@ -8,7 +8,7 @@
 </head>
 <body>
 <main>
-  <h1>Check a record</h1>
+  <h1><svg class="mark" viewBox="0 0 64 64" width="32" height="32" aria-hidden="true"><circle cx="32" cy="32" r="32" fill="#8f000f"/><path d="M20 15 H37 L45 23 V49 H20 Z" fill="#ffffff"/><path d="M37 15 V23 H45" fill="none" stroke="#8f000f" stroke-width="2.5" stroke-linejoin="round"/><path d="M25 29 H40 M25 35 H36" stroke="#8f000f" stroke-width="2.5" stroke-linecap="round"/><path d="M24.5 43 C27 39, 29 46, 31.5 42.5 C34 39, 36 46, 40.5 41.5" fill="none" stroke="#8f000f" stroke-width="3" stroke-linecap="round"/></svg>Check a record</h1>
   <p class="motto">Provared, draft version 0. Evidence, not a verdict.</p>
   <p>Choose a record file. It is checked here, in this browser. Nothing is sent anywhere.</p>
   <p>

package/page/style.css

@@ -148,3 +148,6 @@ details.more summary { cursor: pointer; font-weight: 600; }
 details.more label { display: block; margin-top: 0.7rem; }
 details.more input[type="file"] { display: block; max-width: 100%; margin-top: 0.3rem; color: var(--text); }
 details.more textarea { width: 100%; box-sizing: border-box; font-family: ui-monospace, monospace; font-size: 0.85rem; color: var(--text); background: var(--page); border: 1px solid var(--line); border-radius: 0.3rem; }
+
+/* The mark: a permission slip with a signature, beside a heading or the site's name. */
+.mark { vertical-align: -0.2em; margin-right: 0.4em; }

package/spec/provared-format.md

@@ -226,10 +226,22 @@ Because the slip names both keys, taking the quantum-safe signature off a
 stub does not leave a valid stub.
 
 A checker on a device with no built-in ML-DSA MUST report that the
-quantum-safe signature could not be checked, and MUST NOT report the
-record as intact. An entry none of whose signatures the device could
-check MUST NOT be treated as evidence: what it says is not shown as fact,
-and it is not compared with its slip.
+quantum-safe signature could not be checked (unless it is of the wrong
+length, below), and MUST NOT report the record as intact. An entry none
+of whose signatures the device could check MUST NOT be treated as
+evidence: what it says is not shown as fact, and it is not compared with
+its slip.
+
+**A signature of the wrong length.** A signature whose length is not its
+method's (64 bytes for Ed25519, 4,627 for ML-DSA-87, 29,792 for
+SLH-DSA-SHA2-256s) can never check. A checker MUST report it as invalid,
+whether or not the device has the method: it is a problem with the
+record, not a signature left unchecked. This holds for every signature of
+a record, the passkey's Ed25519 signature on a slip among them, and so
+for the check of a whole book or of a Show as for the check before acting
+(section 20). It does not reach the signature inside a time-stamp from a
+service (section 21.2): a device without that time-stamp's method does
+not check it, whatever its length, and does not count it.
 
 A recorder is known by a key set of exactly three keys: Ed25519,
 ML-DSA-87, then SLH-DSA-SHA2-256s (FIPS 205, the plain method with an
@@ -238,8 +250,8 @@ order, and counts as signed only if all three check. The third rests only
 on fingerprint functions, so it would stand even if the mathematics
 behind ML-DSA were broken. When this draft was written, no browser
 offered it to a page, and Node.js offered it outside the standard
-interface: a checker in a browser reports it as not checked, which is
-never a pass.
+interface: a checker in a browser reports it as not checked (or, if it is
+of the wrong length, as invalid), which is never a pass.
 
 The issuer's passkey signature on a slip is of today's kind only. No
 device offers a quantum-safe passkey.
@@ -918,7 +930,18 @@ holds too much. A checker reports nothing new for it, because the
 finding stands with the later stub. The answer MUST be that nothing is allowed
 (`record-not-sound`) if the book so far has a problem, if any signature
 in it could not be checked on that device, or if the check was not told
-which issuer keys it trusts. An action dated before the last stub of
+which issuer keys it trusts. One exception is allowed: where every
+signature that could not be checked is the third signature of a seal
+(section 21.1) whose first two signatures were checked on that device,
+and nothing else was left unchecked, the check MAY go on, and its answer
+MUST then name the method it did not check. A seal widens no permission;
+a device without that method would otherwise be refused everything once
+the book holds a seal. On such a device a seal rests on its first two
+signatures only: a third signature of the right length that would not
+check is not seen there. A third signature of the wrong length is not
+left unchecked: as section 3.9 sets out, it is invalid on every device,
+so the seal is a problem there and nothing is allowed. An action dated
+before the last stub of
 its own chain (the agent's, or the helper's under its pass; section 7)
 is refused (`time-went-backwards`).
 

package/src/dev.d.ts

@@ -0,0 +1,54 @@
+// Type declarations for "provared/dev": a development stand-in for a
+// passkey. It is not a passkey, and no person confirms anything through
+// it. Every slip it signs carries " (development)" in its issuer's name.
+
+import type { Assertion, KeySet, Limit, Recorder, CheckOptions, Es256Key, Fingerprint, SignedRecord, SlipFields } from './types.js';
+
+/** The words every development slip carries in its issuer's name: "(development)". */
+export const DEVELOPMENT_MARK: string;
+
+export interface DevelopmentPasskey {
+  key: Es256Key;
+  rpId: 'localhost';
+  origin: 'http://localhost';
+  /** The three values a passkey returns, for a challenge from prepareSlip, prepareApproval or prepareCancellation. */
+  sign(challenge: Uint8Array): Promise<Assertion>;
+}
+
+/** A development stand-in for a passkey (ES256), signing for http://localhost. */
+export function developmentPasskey(): Promise<DevelopmentPasskey>;
+
+export interface DevelopmentSlip {
+  slip: SignedRecord;
+  slipFingerprint: Fingerprint;
+  /** A book holding the slip alone: what openRecorder takes. */
+  book: string;
+  /** The thumbprint of the stand-in passkey, to hand to a checker as the passkey you trust. */
+  issuerKeys: string[];
+  agent: { keys: KeySet; privateKeys: CryptoKey[] };
+  passkey: DevelopmentPasskey;
+}
+
+/**
+ * The members of a development slip: as for prepareSlip, except that the
+ * issuer's key and page address, and the agent's keys, are filled in.
+ */
+export type DevelopmentSlipFields = Omit<SlipFields, 'issuer' | 'agent' | 'validFrom' | 'validUntil' | 'purpose' | 'with' | 'limits'> & {
+  issuer?: { name?: string };
+  agent?: { name?: string; software?: SlipFields['agent']['software'] };
+  /** Defaults to an empty list. */
+  limits?: Limit[];
+  validFrom?: string;
+  validUntil?: string;
+  purpose?: string;
+  with?: SlipFields['with'];
+};
+
+/** A slip signed with a development stand-in for a passkey, with new keys for the agent. */
+export function developmentSlip(fields: DevelopmentSlipFields): Promise<DevelopmentSlip>;
+
+/** The stub writer opened under a development slip, in one call. */
+export function developmentRecorder(
+  fields: DevelopmentSlipFields,
+  more?: { options?: CheckOptions; now?: () => number; countersignWithin?: number },
+): Promise<Omit<DevelopmentSlip, 'book'> & { recorder: Recorder }>;

package/src/dev.js

@@ -0,0 +1,123 @@
+// A development stand-in for a passkey, and a stub writer opened under a
+// slip it signed: for trying the library in an evening, and for tests.
+//
+// It is NOT a passkey. Its private key is an ordinary key made in this
+// process's memory, and no person confirmed anything. It returns the same
+// three values a passkey returns (the authenticator data, the client data,
+// the signature), in the forms the W3C Web Authentication standard sets
+// out, so that every record it signs passes the checker exactly as a real
+// one would. To keep such a record from being mistaken for a person's, the
+// name of the issuer in every slip it signs ends with " (development)",
+// and the checker prints that name beside the slip.
+//
+// A real slip is signed by the person, in a browser, with a real passkey:
+// see passkey-browser.js and the checking page. Nothing in this file is
+// part of the library's checker, and nothing here reaches the network.
+
+import { concatBytes, fingerprint, formatTime, fromBase64url, sha256, toBase64url, utf8 } from './encoding.js';
+import { thumbprint } from './keys.js';
+import { openRecorder } from './recorder.js';
+import { generateKeySet } from './signatures.js';
+import { assembleSlip, prepareSlip } from './slip.js';
+import { writeBook } from './book.js';
+
+const subtle = globalThis.crypto.subtle;
+
+/** The words every development slip carries in its issuer's name. */
+export const DEVELOPMENT_MARK = '(development)';
+
+// Two numbers of 32 bytes each, side by side, to the ASN.1 DER form a
+// passkey returns for an ECDSA signature.
+function ecdsaRawToDer(raw) {
+  const part = (bytes) => {
+    let start = 0;
+    while (start < bytes.length - 1 && bytes[start] === 0) start++;
+    let digits = bytes.subarray(start);
+    if (digits[0] & 0x80) digits = concatBytes(new Uint8Array([0]), digits);
+    return concatBytes(new Uint8Array([0x02, digits.length]), digits);
+  };
+  const body = concatBytes(part(raw.subarray(0, 32)), part(raw.subarray(32)));
+  return concatBytes(new Uint8Array([0x30, body.length]), body);
+}
+
+/**
+ * A development stand-in for a passkey (ES256, the method most passkeys
+ * use). It signs on this computer, for the page address http://localhost,
+ * which the format allows for development only.
+ *
+ * @returns {Promise<{key: object, rpId: string, origin: string, sign: (challenge: Uint8Array) => Promise<{authenticatorData: Uint8Array, clientDataJSON: Uint8Array, signature: Uint8Array}>}>}
+ */
+export async function developmentPasskey() {
+  const rpId = 'localhost';
+  const origin = 'http://localhost';
+  const pair = await subtle.generateKey({ name: 'ECDSA', namedCurve: 'P-256' }, false, ['sign', 'verify']);
+  const j = await subtle.exportKey('jwk', pair.publicKey);
+  const key = { alg: 'ES256', crv: 'P-256', kty: 'EC', x: j.x, y: j.y };
+  return {
+    key,
+    rpId,
+    origin,
+    async sign(challenge) {
+      const clientDataJSON = utf8(JSON.stringify({ type: 'webauthn.get', challenge: toBase64url(challenge), origin, crossOrigin: false }));
+      // Flags 0x05: "user present" and "user verified". Nobody was: this is a stand-in.
+      const authenticatorData = concatBytes(await sha256(utf8(rpId)), new Uint8Array([0x05, 0, 0, 0, 1]));
+      const signed = concatBytes(authenticatorData, await sha256(clientDataJSON));
+      const signature = ecdsaRawToDer(new Uint8Array(await subtle.sign({ name: 'ECDSA', hash: 'SHA-256' }, pair.privateKey, signed)));
+      return { authenticatorData, clientDataJSON, signature };
+    },
+  };
+}
+
+// The issuer's name always ends with the development mark, whatever name is given.
+function markedName(name) {
+  const given = typeof name === 'string' && name.trim() ? name.trim() : 'Development passkey';
+  return given.endsWith(DEVELOPMENT_MARK) ? given : `${given} ${DEVELOPMENT_MARK}`;
+}
+
+/**
+ * A slip signed with a development stand-in for a passkey, and new keys for
+ * the agent. Give the slip's actions, limits, conditions and the rest as for
+ * prepareSlip; "issuer" and "agent.keys" are filled in, and the issuer's
+ * name is made to end with " (development)". By default the slip runs from
+ * a minute ago for one day, and its purpose says that it is for development.
+ *
+ * @param {object} fields the members of the slip; "actions" is required
+ * @returns {Promise<{slip: object, slipFingerprint: string, book: string, issuerKeys: string[], agent: {keys: object[], privateKeys: CryptoKey[]}, passkey: object}>}
+ */
+export async function developmentSlip(fields = {}) {
+  if (!fields || typeof fields !== 'object' || Array.isArray(fields)) throw new TypeError('developmentSlip: give the members of the slip as an object, with at least "actions".');
+  const passkey = await developmentPasskey();
+  const agent = await generateKeySet();
+  const now = Date.now();
+  const issuer = fields.issuer && typeof fields.issuer === 'object' ? fields.issuer : {};
+  const agentGiven = fields.agent && typeof fields.agent === 'object' ? fields.agent : {};
+  const prepared = await prepareSlip({
+    validFrom: formatTime(now - 60 * 1000),
+    validUntil: formatTime(now + 24 * 3600 * 1000),
+    purpose: 'For development: a record made with a stand-in for a passkey, which no person signed.',
+    limits: [],
+    with: [],
+    ...fields,
+    issuer: { name: markedName(issuer.name), key: passkey.key, rpId: passkey.rpId, origin: passkey.origin },
+    agent: { name: typeof agentGiven.name === 'string' ? agentGiven.name : 'Development agent', ...agentGiven, keys: agent.keys },
+  });
+  const slip = assembleSlip(prepared, await passkey.sign(prepared.challenge));
+  const slipFingerprint = await fingerprint(fromBase64url(slip.payload));
+  return { slip, slipFingerprint, book: writeBook([{ slip }]), issuerKeys: [await thumbprint(passkey.key)], agent, passkey };
+}
+
+/**
+ * The stub writer, opened under a development slip, in one call: the
+ * shortest way to a first record. The same as developmentSlip followed by
+ * openRecorder; "more" is passed to openRecorder (options, now,
+ * countersignWithin).
+ *
+ * @param {object} fields the members of the slip; "actions" is required
+ * @param {object} [more]
+ * @returns {Promise<{recorder: object, slip: object, slipFingerprint: string, issuerKeys: string[], agent: {keys: object[], privateKeys: CryptoKey[]}, passkey: object}>}
+ */
+export async function developmentRecorder(fields = {}, more = {}) {
+  const made = await developmentSlip(fields);
+  const recorder = await openRecorder({ book: made.book, slip: made.slipFingerprint, privateKeys: made.agent.privateKeys, issuerKeys: made.issuerKeys, ...more });
+  return { recorder, slip: made.slip, slipFingerprint: made.slipFingerprint, issuerKeys: made.issuerKeys, agent: made.agent, passkey: made.passkey };
+}

package/src/guard.js

@@ -50,9 +50,11 @@ function lineBound(c, approval) {
  * @param {object} options the same options as checkBook
  * @param {string[]} options.issuerKeys the thumbprints of the passkeys this check trusts. It must be given:
  *   a slip signed by any other key allows nothing
- * @returns {Promise<{allowed: boolean, problems: {code: string, message: string}[], breaches: {code: string, message: string}[], needs: string[]}>}
+ * @returns {Promise<{allowed: boolean, problems: {code: string, message: string}[], breaches: {code: string, message: string}[], needs: string[], notChecked?: string[]}>}
  *   "allowed" is true only if the record so far is sound, this device
- *   checked every signature in it, and the action would be inside the slip.
+ *   checked every signature in it (or every one but the third signature of
+ *   a seal whose first two it checked, which "notChecked" then names), and
+ *   the action would be inside the slip.
  *   "needs" lists what the slip asks to go with the action. A needed
  *   approval must be handed over, or the action is not allowed. A needed
  *   countersignature cannot be known beforehand: the action is allowed, and
@@ -76,6 +78,54 @@ export function checkBeforeRead(read, proposal, options = {}) {
   return decide(read, proposal, options);
 }
 
+// The methods not checked on this device, if the only thing not checked is
+// the third signature of one or more seals whose Ed25519 and ML-DSA-87
+// signatures were checked here; otherwise null. It counts as the checker
+// counts for "fully checked" (book.js): a signature whose method is not
+// built in, or an entry with nothing to check, is not checked; a time-stamp
+// from a service the reader did not name is not "unchecked", it is uncounted.
+function onlySealThirdUnchecked(result) {
+  if (result.summary.fullyChecked) return null;
+  let skipped = false;
+  let excused = 0;
+  const missing = new Set();
+  const note = (list) => { if (list.length === 0) skipped = true; for (const x of list) if (x.state === 'unavailable') missing.add(x.method); };
+  const stamps = (list) => { for (const x of list) if (x.state === 'unavailable') missing.add('stamp'); };
+  for (const e of result.entries) {
+    if (e.kind === 'seal') {
+      const sigs = e.signatures ?? [];
+      const by = (method) => sigs.find((x) => x.method === method);
+      const third = sigs.length === 3 && by('Ed25519')?.state === 'valid' && by('ML-DSA-87')?.state === 'valid' && by(SEAL_THIRD)?.state === 'unavailable';
+      if (third) excused++; else note(sigs);
+      stamps(e.stamps ?? []);
+    } else if (e.kind === 'slip') {
+      if (!e.signature || e.signature.state === 'unavailable') missing.add(e.signature ? e.signature.alg : 'passkey');
+      else if (e.signature.state === 'unchecked') skipped = true;
+    } else if (e.kind === 'stub') {
+      note(e.signatures ?? []);
+      const counter = e.countersignature ?? { state: 'absent', signatures: [] };
+      if (counter.state !== 'absent') note(counter.signatures ?? []);
+      const approval = e.approval ?? { state: 'absent' };
+      if (approval.state === 'unavailable') missing.add(approval.alg);
+    } else if (e.kind === 'cancellation') {
+      if (!e.signature) skipped = true;
+      else if (e.signature.state === 'unavailable') missing.add(e.signature.alg);
+      stamps(e.stamps ?? []);
+    } else if (['refusal', 'terms', 'vouching', 'withdrawal', 'pass', 'acknowledgement'].includes(e.kind)) {
+      note(e.signatures ?? []);
+    } else {
+      skipped = true;
+    }
+  }
+  for (const h of result.held ?? []) {
+    stamps(h.stamps ?? []);
+    for (const a of h.acknowledgements ?? []) note(a.signatures ?? []);
+  }
+  return !skipped && missing.size === 0 && excused > 0 ? [SEAL_THIRD] : null;
+}
+
+const SEAL_THIRD = 'SLH-DSA-SHA2-256s';
+
 async function decide(read, proposal, options) {
   const answer = { allowed: false, problems: [], breaches: [], needs: [] };
   try {
@@ -85,15 +135,33 @@ async function decide(read, proposal, options) {
     }
     const { result, state, beside } = await read();
     if (result.summary.problemFound) throw notSound('A problem was found in the record so far. It must be looked at before the agent acts again.');
-    // A record this device could only partly check is not a pass, here either.
-    if (!result.summary.fullyChecked) throw notSound('This device could not check every signature in the record so far.');
+    // A record this device could only partly check is not a pass, here
+    // either, with one stated exception: a seal's third signature
+    // (SLH-DSA), where its first two were checked here. A seal widens no
+    // permission, and a device without that method (the Python version,
+    // every browser) would otherwise be refused everything once the book
+    // holds a seal. The answer names what was not checked.
+    const notChecked = onlySealThirdUnchecked(result);
+    if (!result.summary.fullyChecked && !notChecked) throw notSound('This device could not check every signature in the record so far.');
+    if (notChecked) answer.notChecked = notChecked;
     if (!result.entries.every((e) => (e.kind === 'stub' || e.kind === 'pass' ? e.compared === true : true))) {
       throw notSound('This device could not compare every stub and every pass in the record so far with its slip.');
     }
     if (result.size >= MAX_ENTRIES) throw new Refusal('too-large', 'The book is full: it holds 100,000 entries.');
 
     f.members(proposal, ['action', 'slip'], ['amount', 'approval', 'details', 'pass', 'terms', 'when', 'with'], 'proposal');
-    const c = { action: proposal.action, when: formatTime(proposal.when ?? Date.now()) };
+    // The time, as the stub writer takes it: a number of milliseconds or a
+    // Date. Text is read by rules that differ between devices.
+    const given = proposal.when ?? Date.now();
+    if (typeof given !== 'number' && !(given instanceof Date)) throw new Refusal('bad-field', 'when: must be a number of milliseconds, or a Date.');
+    let ms;
+    try {
+      ms = new Date(given).getTime();
+    } catch {
+      ms = NaN; // a Date wrapped in a Proxy, which Date cannot read
+    }
+    if (!Number.isFinite(ms)) throw new Refusal('bad-field', 'when: does not give a time.');
+    const c = { action: proposal.action, when: formatTime(ms) };
     for (const name of ['amount', 'details', 'with']) if (proposal[name] !== undefined) c[name] = proposal[name];
     validateRequest(c);
     const when = f.time(c.when, 'when');

package/src/recorder.js

@@ -70,10 +70,18 @@ const notWritten = (why) => new Refusal('record-not-sound', why);
 
 // A time handed in: a number of milliseconds, or a Date. Text, true or a
 // list would be read by rules that differ from one device to another (text
-// with no time zone is taken as local time), so they are refused.
+// with no time zone is taken as local time), so they are refused. A Date
+// that cannot be read (one wrapped in a Proxy) gives no time, as a Date
+// that is not a time gives none, and the check before acting refuses it.
 function timeOf(when) {
   if (typeof when === 'number') return new Date(when).getTime();
-  if (when instanceof Date) return when.getTime();
+  if (when instanceof Date) {
+    try {
+      return when.getTime();
+    } catch {
+      return NaN;
+    }
+  }
   throw new Refusal('bad-field', 'when: must be a number of milliseconds, or a Date.');
 }
 
@@ -775,6 +783,8 @@ export async function openRecorder({ book, slip, privateKeys, issuerKeys, pass,
       return calling(request, more, async (call) => {
         await writeWaiting(now());
         const when = call.when ?? now();
+        // In the words of the check before acting, which "act" and "before" give.
+        if (!Number.isFinite(when)) throw new Refusal('bad-field', 'when: does not give a time.');
         if (aheadOfClock(when)) throw notWritten('The stub was not written: it is dated ahead of the clock.');
         const made = await composeStub(call, when);
         const tried = await fitsBook(made, 'The stub was not written: with it, the book would not pass its check.');

package/src/signatures.js

@@ -16,6 +16,10 @@
 import { importPublicKey, weakEd25519 } from './keys.js';
 
 const SLH = 'SLH-DSA-SHA2-256s';
+
+// The length of a signature, in bytes, by method (RFC 8032, FIPS 204,
+// FIPS 205).
+const SIGNATURE_BYTES = { Ed25519: 64, 'ML-DSA-87': 4627, [SLH]: 29792 };
 const nodeCrypto = globalThis.process && typeof globalThis.process.getBuiltinModule === 'function' ? globalThis.process.getBuiltinModule('node:crypto') : null;
 
 function slhKey(pub) {
@@ -80,6 +84,9 @@ export function methodAvailable(alg) {
  * @returns {Promise<SignatureState>}
  */
 export async function verifySignature(jwk, signature, data, without = []) {
+  // A signature of another length than its method's can never check, so it
+  // is refused on every device, whether or not this one has the method.
+  if (Object.hasOwn(SIGNATURE_BYTES, jwk.alg) && signature.length !== SIGNATURE_BYTES[jwk.alg]) return 'invalid';
   if (jwk.alg === SLH) {
     if (without.includes(SLH) || !(await methodAvailable(SLH))) return 'unavailable';
     try {

package/src/types.d.ts

@@ -431,6 +431,8 @@ export interface BeforeAnswer {
   problems: Finding[];
   breaches: Finding[];
   needs: ('approval' | 'countersignature')[];
+  /** Present only where the device went on without checking a seal's third signature (SLH-DSA-SHA2-256s): the methods not checked. */
+  notChecked?: string[];
 }
 /** "issuerKeys" must be given: a slip signed by any other key allows nothing. */
 export function checkBefore(book: string, proposal: Proposal, options: CheckOptions & { issuerKeys: string[] }): Promise<BeforeAnswer>;