provared 0.3.0 → 0.4.0

package/CHANGELOG.md

@@ -1,5 +1,244 @@
 # Changelog
 
+## 0.4.0 (14 October 2026)
+
+- **The command-line checker counts the keys it was given.** With two
+  passkeys named, its summary said "yes: the passkey you trust"; it now
+  says "the passkeys you trust", and "the recorders you expect" where
+  more than one recorder is named; the same key named twice counts once.
+  Only the words change; tests hold them. The guide gives the fingerprint
+  of the checking page built as one file for this version, which changed
+  because the checker it holds, and the page itself, changed.
+- **The README's count of review rounds is brought up to date: 40.** The
+  25 recorded by version 0.3.0, and 15 since: three of the library's
+  changes of 11 to 13 October (the seal rule, then a narrow review of four
+  commits and a check of its fixes), three of the signing page, six of the
+  recorder beside Claude Code, two of the record page's book in a release,
+  and one of the asynchronous reads below. Each reviewer is a fresh
+  session given the code, the documents and a brief of what to look at;
+  the README now says so, and that a fault may be stated as a limit rather
+  than fixed.
+- **The two framework packages require version 0.4.0**, so that an
+  agent behind either goes on after its book is sealed (below).
+  `provared-langchain` becomes 0.1.1, which also carries the keywords,
+  the homepage and the mark added on 10 and 11 October.
+  `pydantic-ai-provared` 0.1.0 is its first version; its README already
+  gave the command to install it. Both are published separately, on the
+  Python Package Index.
+- **The LangChain and Pydantic AI packages read the stub writer safely
+  from asynchronous code**: `await middleware.snapshot()` and
+  `await capability.snapshot()` give the book and the cancellations the
+  writer holds, waiting in a thread of their own. The READMEs said to
+  read it with `asyncio.to_thread(writer.snapshot)`; but in the event
+  loop's shared threads such a read waits for the action in progress,
+  and enough of them at once leave no shared thread for a tool that
+  needs one, so the tool and the reads wait for ever. Found while
+  building a package for another framework; checked by an independent
+  reviewer, and a test in each package fails without it.
+- **A proposed action dated by text gets a plain refusal.** The check
+  before acting took a time given as text, or a number or a Date that
+  gives no time, to the catch-all "the checker met something it did not
+  expect" (`check-failed`). It now answers `bad-field`: "when: must be a
+  number of milliseconds, or a Date" (the stub writer's own words), or
+  "when: does not give a time" (new words, for a number such as Infinity,
+  a Date that is not a time, or a Date wrapped in a Proxy). In Python a
+  datetime counts as dated only where its time zone gives an offset, as
+  Python's own rule for an "aware" time says. Nothing that was allowed is
+  refused, and nothing that was refused is allowed. The stub writer
+  answers in the same words: its "before" and "act" took a Date wrapped
+  in a Proxy to a plain TypeError, and now answer "when: does not give a
+  time", as the check before acting does; its "record", which does not
+  ask first, took any time that gives none to a plain "Invalid time
+  value" error, and now refuses it with `bad-field` in those words. In
+  both languages; the shared test file for the check before acting gains
+  two cases, and in the stub writer's scenarios the one step that hands in
+  a time of Infinity changes its words, and the one step that records an
+  action at a time outside the range of times changes its answer. Tests
+  in both languages hold a Date in a Proxy and, in Python, a time zone
+  that gives no offset.
+- **A record's signature of the wrong length is invalid on every
+  device.** An Ed25519 signature is 64 bytes, an ML-DSA-87 signature 4,627
+  and an SLH-DSA-SHA2-256s signature 29,792 (RFC 8032, FIPS 204, FIPS 205).
+  One of another length can never check, and a device that has the method
+  already said "invalid"; a device without it said "not checked on this
+  device". Now every device says "invalid", for every signature of a
+  record, the passkey's Ed25519 signature on a slip among them. So, on a
+  device without SLH-DSA, a seal whose third signature is cut short or
+  empty is a problem, not something the check before acting goes on
+  without. The signature inside a time-stamp from a service is not
+  covered: on a device without its method a time-stamp is not checked,
+  whatever its length, and is not counted. A third signature of the right
+  length that would not check is still not seen on a device without
+  SLH-DSA. The format description states the rule in section 3.9 and
+  what it means for a seal in section 20; the list of threats says that a
+  third signature of the right length is not seen there. In both
+  languages; the shared test files for a whole book and for the check
+  before acting gain a case each, and tests in both languages hold each
+  method's length, shorter and longer, with the method and without it.
+- **The check before acting goes on without a seal's third signature, and
+  says so** (decision F-106; this changes choice 66 of the draft). Found on
+  11 October 2026: a device that cannot check SLH-DSA-SHA2-256s, which is
+  every Python stub writer (and so the LangChain and Pydantic AI packages)
+  and every browser, was refused every action as soon as its book held a
+  seal, because the check allowed nothing unless every signature in the
+  record so far had been checked on that device. Now, where the only
+  signatures not checked are the third ones of seals whose first two were
+  checked there, and nothing else was left unchecked, the check goes on and
+  its answer carries `notChecked: ['SLH-DSA-SHA2-256s']`. Any other
+  signature left unchecked still refuses everything, and the full checker's
+  answers are unchanged. In both languages: the shared test file for the
+  check before acting gains seven cases with a seal, besides the one with
+  a third signature cut short counted above (found missing by two
+  independent reviews, which showed that weaker rules passed every test:
+  the last case, a permission and a seal alone on a device without
+  ML-DSA-87, holds the rule that the seal's ML-DSA-87 signature must have
+  been checked), and the shared test file for the stub writer's scenarios
+  is remade. Tests in both languages hold the same rule.
+- **The signing page names the agent's keys by the fingerprint of their
+  key set** before the passkey is asked, worked out by the library's own
+  `keySetFingerprint` (as a recorder's key set is named), and asks the
+  person to compare it with the one the agent's software printed when it
+  made its keys: a link, or a permission pasted from elsewhere, could
+  carry someone else's keys under a familiar name. Keys that are not a
+  key set are refused there, in the library's own words. A test holds the
+  page's words against the library's fingerprint.
+- **The signing page fills itself from a link, and shows everything a
+  link could slip in before the passkey is asked.** A link to
+  prova.red/sign/ may hold a starting permission after "#"; that part
+  stays in the browser and is never sent to a server. A link that cannot
+  be read leaves the page's own starting point and says why; a second
+  link opened in the same tab fills the page again. Because a link can
+  name anything, the page now shows, besides the agent's key-set
+  fingerprint (above): each service's keys by the fingerprint of their key
+  set, as a checker names them (keys that are not a key set are refused,
+  in the library's own words); and the agent's software statement, marked
+  as the person's statement and not proof of what runs. Shown inside
+  another page, it offers nothing to sign or cancel, since another site
+  could frame it filled from a link of its choosing. It now has a content
+  security policy that lets it load only its own scripts and style sheet
+  and send nothing anywhere; the message of the commit that added the
+  link said its policy was unchanged, but the page had none. Tests hold
+  each point. Checked by an independent reviewer over three rounds.
+- **The recorder beside Claude Code is a package of its own,
+  `provared-claude-code` 0.1.0** (published separately, on npm), in
+  `integrations/claude-code/`, in place of the recorder of 10 October.
+  `init` makes the keys, writes the hooks and prints a link to the signing
+  page filled in with a starting permission; `use` puts the signed
+  permission in place; `renew` takes a new permission while the recorder
+  runs, with no moment in which a call finds it gone. A permission from a
+  passkey the recorder has not trusted before is taken only with
+  `--new-passkey`, and the passkeys it trusts are kept in
+  `trusted-passkeys.json`. The hooks `init` writes match every tool,
+  record calls that failed, and refuse a call where the hook itself fails
+  (`"onFailure": "block"`). A command is named by reading its line three
+  ways (as a shell splits it, from every known program's name, and with
+  the first version's patterns), and the strictest name counts; a line
+  handed to a shell, to `eval`, `iex` or `Invoke-Expression`, and the
+  command `find -exec` runs are read the same way. A call allowed under
+  one permission and taken while a renewal switched to the next is
+  recorded under the one it was allowed under, and the stub of a call that
+  was taken is always written. `keys` and `init` print the fingerprint of
+  the agent's key set, which the signing page asks the person to compare;
+  `seal` shows the recorder's error. Checked by an independent reviewer in
+  six rounds; each fault found is a test (57 in all).
+- **The record page's book and the checker's answer are kept in a release
+  of the repository, not in the repository itself**: they grow by
+  megabytes a day, and GitHub refuses a file over 100 MB.
+  `tools/make-record-page.mjs` writes their SHA-256 fingerprints beside
+  the page (`site/records/files.sha256`); the site's publishing run
+  fetches both from the release "record" and publishes nothing unless each
+  matches, and every file the page links is there. Readers see no change.
+  The tool now reads the growing book once, into the page's own folder,
+  leaving out a last line still being written, so that the page, the
+  checker's answer and the fingerprints describe one book (the page of
+  14 October said 3,771 receipts above a summary of 3,770 stubs). It
+  counts the passkeys that signed the book's permissions from the book,
+  and refuses a passkey named to it that signed none. Checked by an
+  independent reviewer in two rounds.
+- **What browsers check, tried again on 13 October 2026.** Chrome 155,
+  Edge 155 and Brave 155 each offer Ed25519 and ML-DSA (all three
+  strengths) to a page and check real signatures made with them; none of
+  them offers SLH-DSA. The README, the guide, the list of threats, the
+  home page, the worked example and the tool that writes the record page
+  now say so; they said, from a try on 12 October, that Chrome 154 did
+  not check ML-DSA. No code changes.
+- **The recorder beside Claude Code appends to the book, and no longer
+  loses a receipt while another program reads the file.** It wrote the
+  whole book to a temporary file and renamed it over the old one; on
+  Windows that is refused while anyone holds the file open (an uploader,
+  a virus scanner), and the hook then reported "the action was taken and
+  is not in the record". Found on 11 October 2026, when a program that
+  uploads the book was reading it every two seconds: 7 of one helper's 23
+  tool calls were taken and not recorded. A book only grows, so the
+  recorder now appends the new lines; where the file does not match the
+  book it is replaced, with retries for up to two seconds. A test holds
+  the file open while the recorder saves.
+
+- 2026-10-11: **one mark everywhere**: a permission slip with a
+  signature, white on red (#8f000f), as `site/favicon.svg`, in the
+  social preview `site/preview.png` beside the word, as inline SVG in the
+  header of every page at prova.red, of the checking page and of the
+  signing page (no page makes a request for it), and at the top of the
+  README and of the three Python packages' READMEs, which the registries
+  show with the next published version. The four colours of the parts stay as they are inside the
+  pages. The style sheet gains one rule for the mark and a new version
+  number. No code changes.
+- 2026-10-10: **a real record on prova.red**, `tools/make-record-page.mjs`:
+  writes `site/records/` from the book that the recorder beside Claude
+  Code keeps. It copies the book and its slip beside the page, runs the
+  command-line checker with the passkey and the recorder the reader is
+  told to trust, keeps the whole answer as a text file, and writes the
+  page from what the checker answered: the slip in the checker's own
+  words, the counts by day, by kind of action and by tool, the seals,
+  any entry outside the permission, the summary exactly as printed, and
+  what the check does not show. The page says that a refused call
+  leaves no entry and that every receipt is one-sided. It is run again
+  each day while the permission lasts; the home page links to it. A
+  test runs the tool on the sample record into a folder of its own.
+- 2026-10-10: **the pages at prova.red, the README and the framework
+  packages, after the adoption review**: the line under each page's
+  title names its reader and then the slogan; "How it is built" on the
+  home page is two sentences; the developer page says "the person"
+  throughout, names the nearest other projects beside what the
+  author found nowhere else, and gives the author's own reason for
+  building it; the plain-words page names Article 12 and
+  Article 26 of the AI Act, no longer repeats its opening, and asks a
+  reader who breaks it to open an issue; every page ends with two
+  lines about the author; the README shows the LangChain example; the
+  two framework packages gain keywords and a homepage. No code changes.
+- 2026-10-10: **a signing page**, `page/sign.html`, served at
+  prova.red/sign/: a person writes a permission as JSON (the agent's
+  name and two public keys, the actions, limits, conditions, stated
+  rules, with whom, from when until when, and why), sees it in words,
+  signs it with a passkey made for the website, and saves the signed
+  file; the page shows the passkey's thumbprint and the permission's
+  fingerprint. It can also sign a cancellation of a permission signed
+  with the same passkey. It uses the library's browser part and
+  `render.js`, loads nothing from anywhere else and sends nothing. The
+  workflow serves it beside the checking page.
+- 2026-10-10: **the recorder beside Claude Code**, `integrations/claude-code/`:
+  a hook that Claude Code runs before and after each tool call, and a
+  small service on 127.0.0.1 that holds the stub writer open on one book
+  under a slip the person signed. Before a call, the check before acting
+  refuses a call outside the slip and Claude Code is told why; after it,
+  a stub is written naming the tool and the SHA-256 fingerprint of its
+  arguments; the service seals the book on request with the recorder's
+  three keys. Tool calls are named from the shared list by the hook,
+  not by the agent (a command that removes something is
+  `provared.data.delete`; one that publishes is `provared.code.release`);
+  tools that only talk to the person are not recorded. The agent's two
+  keys and the recorder's three are kept as JSON Web Keys in files the
+  person keeps. If the service is not running, a call is refused: no
+  record, no action. The folder names a product, as the framework
+  packages do; the library names none, and the npm package does not
+  hold it. Five tests run the hook as Claude Code runs it.
+- **The tests clean up after themselves.** Nine test files made a
+  temporary folder for each run and left it behind; on 13 October 2026
+  the computer's temporary folder held about 2,800 of them. A small
+  helper, `test/helpers/temp.mjs`, now makes each folder and removes it
+  when that test file's tests end. Run with an empty temporary folder,
+  the library's tests leave nothing in it.
+
 ## 0.3.0 (10 October 2026)
 
 - 2026-10-10: **a development stand-in for a passkey**, `provared/dev`

package/README.md

@@ -1,4 +1,4 @@
-# Provared
+# <img src="https://prova.red/favicon.svg" alt="" width="36"> Provared
 
 Proof of what an AI agent was allowed to do, and what it then did.
 
@@ -72,7 +72,19 @@ The same in Python is
 `from provared.dev import development_recorder`. For a LangChain agent,
 `pip install provared-langchain` puts every tool call behind the same
 check with no change to the tools
-([python/integrations/provared-langchain](python/integrations/provared-langchain)).
+([python/integrations/provared-langchain](python/integrations/provared-langchain)):
+
+```py
+from langchain.agents import create_agent
+from provared_langchain import ProvaredMiddleware
+
+agent = create_agent(model, tools=[order_supplies, send_message],
+                     middleware=[..., ProvaredMiddleware(writer, {
+                         'order_supplies': {'action': 'supplies.order', 'with': 'supplier',
+                                            'amount': lambda a: {'unit': 'GBP', 'value': a['total_gbp']}},
+                         'send_message': 'provared.message.send',
+                     })])   # last among the middleware that wrap tool calls
+```
 
 ## The four parts
 
@@ -129,7 +141,12 @@ each part protects against, is in
   in plain words for a reader who does not write code.
 - **[The checking page](https://prova.red/check/)**, which checks a
   record in a browser and loads nothing from anywhere; also built as
-  one file, attached to each release.
+  one file, attached to each release. It uses only the signing methods
+  the browser has built in. Tried on the author's computer on
+  13 October 2026: Chrome 155, Edge 155 and Brave 155 each check the
+  quantum-safe signatures on receipts (ML-DSA). None of the three has the
+  third method a seal is signed with (SLH-DSA), so in a browser a book
+  with a seal is never a pass. The command-line checker checks all three.
 - **The core of the format as an individual Internet-Draft** at the
   IETF:
   [draft-izmaylov-agent-permission-receipts](https://datatracker.ietf.org/doc/draft-izmaylov-agent-permission-receipts/).
@@ -139,12 +156,13 @@ each part protects against, is in
 
 ## Status
 
-**Version 0.3.0, a draft.** Published as it is, by one author in their
+**Version 0.4.0, a draft.** Published as it is, by one author in their
 own time, built with AI tools since 3 October 2026; fixes as time
-allows. The code has been through 25 rounds of review by AI reviewers,
-each a fresh session given only the code and the documents; every fault
-was fixed and kept as a test. No person other than the author has
-reviewed it yet. That is an invitation. The format may still change.
+allows. The code has been through 40 rounds of review by AI reviewers,
+each reviewer a fresh session given the code, the documents and a brief
+of what to look at; every fault was fixed, or stated as a limit, and
+kept as a test. No person other than the author has reviewed it yet.
+That is an invitation. The format may still change.
 Every published version stays on npm and the Python Package Index, so a
 record made with one version can always be checked by that version.
 

package/bin/provared-check.mjs

@@ -457,7 +457,9 @@ function named(s) {
 }
 
 function trustWords(s) {
-  if (named(s)) return s.counts.seals ? 'yes: the passkey you trust, and the recorder you expect' : 'yes: the passkey you trust';
+  const passkeys = new Set(args.issuerKeys).size === 1 ? 'the passkey you trust' : 'the passkeys you trust';
+  const recorders = new Set(args.sealKeys).size === 1 ? 'the recorder you expect' : 'the recorders you expect';
+  if (named(s)) return s.counts.seals ? `yes: ${passkeys}, and ${recorders}` : `yes: ${passkeys}`;
   if (args.issuerKeys.length === 0) return 'NO: you named no passkey you trust (--issuer), so anyone could have made this record. This is not a pass.';
   return 'NO: the record has a seal, and you named no recorder you expect (--sealer), so anyone could have sealed it. This is not a pass.';
 }

package/docs/guide.md

@@ -6,7 +6,7 @@ Everything about the format, the library, the checker, the stub writer beside an
 
 ## Status
 
-**Version 0.3.0, a draft.** Published as it is, by one author in their
+**Version 0.4.0, a draft.** Published as it is, by one author in their
 own time; fixes as time allows. The format may still change, so do not
 rely on a draft record staying checkable.
 
@@ -149,11 +149,11 @@ in a browser straight from the disk; it needs no server. The file allows
 itself no request of any kind: its content security policy lets nothing
 be loaded from anywhere. The tool prints the file's SHA-256 fingerprint,
 so that a copy can be compared with it. (Tried on 8 October 2026 in the
-three browser builds this repository is tested with.) The file for
-version 0.3.0 is attached to the release on GitHub; it is the same
-file, byte for byte, as for version 0.2.0, because nothing the page
-holds changed. Its SHA-256 fingerprint is
-`7e142fa119458ce00c5fdd6e1cafc75cb3bb4672624157a0a0ef4624f92812ae`.
+three browser builds this repository is tested with, and on 13 October
+2026 in Chrome 155, Edge 155 and Brave 155.) The file for
+version 0.4.0 is attached to the release on GitHub. Its SHA-256
+fingerprint is
+`49da6617ff493ddda2b2b65bfb6bedebdf8cf07ea6faa32b039f065eda207307`.
 
 **Run the demonstration in a browser.**
 
@@ -388,7 +388,8 @@ const answer = await checkBefore(
   { issuerKeys: ['the thumbprint of the passkey you trust'] },
 );
 
-answer.allowed;   // true only if the record so far is sound, fully checked, and the action is inside the slip
+answer.allowed;   // true only if the record so far is sound, fully checked (but for a seal's third signature, below), and the action is inside the slip
+answer.notChecked; // present only where the device went on without checking a seal's third signature (SLH-DSA)
 answer.breaches;  // why not, in the checker's own codes
 answer.problems;  // why the question could not be answered with a yes
 answer.needs;     // what the slip asks to go with it: 'approval', 'countersignature'
@@ -562,9 +563,17 @@ names no agent software, and works with any function.
   offers a quantum-safe passkey yet.
 - **Whoever keeps the book** signs each seal with three keys: the same
   two, and SLH-DSA-SHA2-256s, which rests only on fingerprint functions.
-- **Browsers are only now adding ML-DSA, and have no SLH-DSA.** Where a
-  browser lacks a method, the checking page says that those signatures
-  were not checked, and does not show a pass. Node.js checks all of them.
+- **The browsers tried have ML-DSA; none has SLH-DSA.** Tried on the
+  author's computer on 13 October 2026: Chrome 155, Edge 155 and
+  Brave 155 each offer Ed25519 and ML-DSA (all three strengths) to a
+  page, and check real signatures made with them. None of the three
+  offers SLH-DSA. So in these browsers the checking page checks every
+  signature of a slip, a stub, a countersignature and the other records,
+  but not a seal's third signature: a book with a seal reads "not
+  complete" there, and the time-stamp beside the seal is not counted.
+  Where a browser lacks a method, the checking page says that those
+  signatures were not checked, and does not show a pass. Node.js checks
+  all of them.
 
 ## Using the library
 

package/docs/threat-model.md

@@ -58,10 +58,10 @@ keys. People decide what it means.
   under a seal, whose three signatures include two quantum-safe ones.
   The outside time-stamps themselves are of today's kind.
 - **A signature that cannot be checked is not a pass.** Where a device
-  has no built-in ML-DSA, the checker says so, and never reports the
-  record as intact. An entry none of whose signatures the device could
-  check is not treated as evidence: what it says is not shown, and it is
-  not compared with its slip.
+  has no built-in ML-DSA, or no SLH-DSA for a seal, the checker says
+  so, and never reports the record as intact. An entry none of whose
+  signatures the device could check is not treated as evidence: what it
+  says is not shown, and it is not compared with its slip.
 - **A record does not show that an action was wise, lawful or wanted.**
 - **A badly written slip is faithfully recorded as a badly written slip.**
 
@@ -450,7 +450,12 @@ within 5 minutes for a time-stamp from a service, and to within 2 hours
 and 5 minutes for a block time-stamp). A6 cannot make a
 seal: it needs the recorder's three keys. A8 must break Ed25519, ML-DSA-87
 and SLH-DSA together to forge a seal; the third rests only on fingerprint
-functions. Nobody can move a time-stamp to another seal: it is made over
+functions. One exception, stated: the check before acting on a device
+without SLH-DSA (the Python version, every browser) goes on after a seal
+whose first two signatures check there, so on that device a seal rests on
+Ed25519 and ML-DSA-87 alone, and a third signature of the right length
+that would not check is not seen. A device with SLH-DSA, such as the
+command-line checker, sees it. Nobody can move a time-stamp to another seal: it is made over
 the seal's fingerprint.
 
 A block time-stamp is a second witness of the time, which rests on no
@@ -490,8 +495,12 @@ person checking gives.
   does not read what a certificate says its key is for. It checks that
   the stated time lies within the certificate's dates, and leaves the
   rest to the person who chose to trust it.
-- **A browser.** No browser offers SLH-DSA or ML-DSA to a page yet. A
-  checker there reports a seal as not fully checked, never as a pass.
+- **A browser.** Tried on the author's computer on 13 October 2026:
+  Chrome 155, Edge 155 and Brave 155 offer ML-DSA to a page; none of the
+  three offers SLH-DSA. So a checker in a browser
+  reports a seal as not fully checked, never as a pass, and counts no
+  time-stamp beside it. In a browser without ML-DSA, every record signed
+  with ML-DSA is reported as not fully checked too.
 - **A few bytes of a time-stamp's wrapper** are not covered by the
   service's signature (the list of fingerprint methods, and the lines
   that name the certificate by its issuer). Changing them changes nothing

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "provared",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "description": "Proof of what an AI agent was allowed to do, and what it then did. A passkey-signed permission with limits a machine can check, a signed receipt for each action, and a free checker. Evidence, not a verdict.",
   "author": "Pavel Izmaylov",
   "license": "Apache-2.0 AND CC-BY-4.0",

package/page/index.html

@@ -8,7 +8,7 @@
 </head>
 <body>
 <main>
-  <h1>Check a record</h1>
+  <h1><svg class="mark" viewBox="0 0 64 64" width="32" height="32" aria-hidden="true"><circle cx="32" cy="32" r="32" fill="#8f000f"/><path d="M20 15 H37 L45 23 V49 H20 Z" fill="#ffffff"/><path d="M37 15 V23 H45" fill="none" stroke="#8f000f" stroke-width="2.5" stroke-linejoin="round"/><path d="M25 29 H40 M25 35 H36" stroke="#8f000f" stroke-width="2.5" stroke-linecap="round"/><path d="M24.5 43 C27 39, 29 46, 31.5 42.5 C34 39, 36 46, 40.5 41.5" fill="none" stroke="#8f000f" stroke-width="3" stroke-linecap="round"/></svg>Check a record</h1>
   <p class="motto">Provared, draft version 0. Evidence, not a verdict.</p>
   <p>Choose a record file. It is checked here, in this browser. Nothing is sent anywhere.</p>
   <p>

package/page/style.css

@@ -148,3 +148,6 @@ details.more summary { cursor: pointer; font-weight: 600; }
 details.more label { display: block; margin-top: 0.7rem; }
 details.more input[type="file"] { display: block; max-width: 100%; margin-top: 0.3rem; color: var(--text); }
 details.more textarea { width: 100%; box-sizing: border-box; font-family: ui-monospace, monospace; font-size: 0.85rem; color: var(--text); background: var(--page); border: 1px solid var(--line); border-radius: 0.3rem; }
+
+/* The mark: a permission slip with a signature, beside a heading or the site's name. */
+.mark { vertical-align: -0.2em; margin-right: 0.4em; }

package/spec/provared-format.md

@@ -226,10 +226,22 @@ Because the slip names both keys, taking the quantum-safe signature off a
 stub does not leave a valid stub.
 
 A checker on a device with no built-in ML-DSA MUST report that the
-quantum-safe signature could not be checked, and MUST NOT report the
-record as intact. An entry none of whose signatures the device could
-check MUST NOT be treated as evidence: what it says is not shown as fact,
-and it is not compared with its slip.
+quantum-safe signature could not be checked (unless it is of the wrong
+length, below), and MUST NOT report the record as intact. An entry none
+of whose signatures the device could check MUST NOT be treated as
+evidence: what it says is not shown as fact, and it is not compared with
+its slip.
+
+**A signature of the wrong length.** A signature whose length is not its
+method's (64 bytes for Ed25519, 4,627 for ML-DSA-87, 29,792 for
+SLH-DSA-SHA2-256s) can never check. A checker MUST report it as invalid,
+whether or not the device has the method: it is a problem with the
+record, not a signature left unchecked. This holds for every signature of
+a record, the passkey's Ed25519 signature on a slip among them, and so
+for the check of a whole book or of a Show as for the check before acting
+(section 20). It does not reach the signature inside a time-stamp from a
+service (section 21.2): a device without that time-stamp's method does
+not check it, whatever its length, and does not count it.
 
 A recorder is known by a key set of exactly three keys: Ed25519,
 ML-DSA-87, then SLH-DSA-SHA2-256s (FIPS 205, the plain method with an
@@ -238,8 +250,8 @@ order, and counts as signed only if all three check. The third rests only
 on fingerprint functions, so it would stand even if the mathematics
 behind ML-DSA were broken. When this draft was written, no browser
 offered it to a page, and Node.js offered it outside the standard
-interface: a checker in a browser reports it as not checked, which is
-never a pass.
+interface: a checker in a browser reports it as not checked (or, if it is
+of the wrong length, as invalid), which is never a pass.
 
 The issuer's passkey signature on a slip is of today's kind only. No
 device offers a quantum-safe passkey.
@@ -918,7 +930,18 @@ holds too much. A checker reports nothing new for it, because the
 finding stands with the later stub. The answer MUST be that nothing is allowed
 (`record-not-sound`) if the book so far has a problem, if any signature
 in it could not be checked on that device, or if the check was not told
-which issuer keys it trusts. An action dated before the last stub of
+which issuer keys it trusts. One exception is allowed: where every
+signature that could not be checked is the third signature of a seal
+(section 21.1) whose first two signatures were checked on that device,
+and nothing else was left unchecked, the check MAY go on, and its answer
+MUST then name the method it did not check. A seal widens no permission;
+a device without that method would otherwise be refused everything once
+the book holds a seal. On such a device a seal rests on its first two
+signatures only: a third signature of the right length that would not
+check is not seen there. A third signature of the wrong length is not
+left unchecked: as section 3.9 sets out, it is invalid on every device,
+so the seal is a problem there and nothing is allowed. An action dated
+before the last stub of
 its own chain (the agent's, or the helper's under its pass; section 7)
 is refused (`time-went-backwards`).
 

package/src/guard.js

@@ -50,9 +50,11 @@ function lineBound(c, approval) {
  * @param {object} options the same options as checkBook
  * @param {string[]} options.issuerKeys the thumbprints of the passkeys this check trusts. It must be given:
  *   a slip signed by any other key allows nothing
- * @returns {Promise<{allowed: boolean, problems: {code: string, message: string}[], breaches: {code: string, message: string}[], needs: string[]}>}
+ * @returns {Promise<{allowed: boolean, problems: {code: string, message: string}[], breaches: {code: string, message: string}[], needs: string[], notChecked?: string[]}>}
  *   "allowed" is true only if the record so far is sound, this device
- *   checked every signature in it, and the action would be inside the slip.
+ *   checked every signature in it (or every one but the third signature of
+ *   a seal whose first two it checked, which "notChecked" then names), and
+ *   the action would be inside the slip.
  *   "needs" lists what the slip asks to go with the action. A needed
  *   approval must be handed over, or the action is not allowed. A needed
  *   countersignature cannot be known beforehand: the action is allowed, and
@@ -76,6 +78,54 @@ export function checkBeforeRead(read, proposal, options = {}) {
   return decide(read, proposal, options);
 }
 
+// The methods not checked on this device, if the only thing not checked is
+// the third signature of one or more seals whose Ed25519 and ML-DSA-87
+// signatures were checked here; otherwise null. It counts as the checker
+// counts for "fully checked" (book.js): a signature whose method is not
+// built in, or an entry with nothing to check, is not checked; a time-stamp
+// from a service the reader did not name is not "unchecked", it is uncounted.
+function onlySealThirdUnchecked(result) {
+  if (result.summary.fullyChecked) return null;
+  let skipped = false;
+  let excused = 0;
+  const missing = new Set();
+  const note = (list) => { if (list.length === 0) skipped = true; for (const x of list) if (x.state === 'unavailable') missing.add(x.method); };
+  const stamps = (list) => { for (const x of list) if (x.state === 'unavailable') missing.add('stamp'); };
+  for (const e of result.entries) {
+    if (e.kind === 'seal') {
+      const sigs = e.signatures ?? [];
+      const by = (method) => sigs.find((x) => x.method === method);
+      const third = sigs.length === 3 && by('Ed25519')?.state === 'valid' && by('ML-DSA-87')?.state === 'valid' && by(SEAL_THIRD)?.state === 'unavailable';
+      if (third) excused++; else note(sigs);
+      stamps(e.stamps ?? []);
+    } else if (e.kind === 'slip') {
+      if (!e.signature || e.signature.state === 'unavailable') missing.add(e.signature ? e.signature.alg : 'passkey');
+      else if (e.signature.state === 'unchecked') skipped = true;
+    } else if (e.kind === 'stub') {
+      note(e.signatures ?? []);
+      const counter = e.countersignature ?? { state: 'absent', signatures: [] };
+      if (counter.state !== 'absent') note(counter.signatures ?? []);
+      const approval = e.approval ?? { state: 'absent' };
+      if (approval.state === 'unavailable') missing.add(approval.alg);
+    } else if (e.kind === 'cancellation') {
+      if (!e.signature) skipped = true;
+      else if (e.signature.state === 'unavailable') missing.add(e.signature.alg);
+      stamps(e.stamps ?? []);
+    } else if (['refusal', 'terms', 'vouching', 'withdrawal', 'pass', 'acknowledgement'].includes(e.kind)) {
+      note(e.signatures ?? []);
+    } else {
+      skipped = true;
+    }
+  }
+  for (const h of result.held ?? []) {
+    stamps(h.stamps ?? []);
+    for (const a of h.acknowledgements ?? []) note(a.signatures ?? []);
+  }
+  return !skipped && missing.size === 0 && excused > 0 ? [SEAL_THIRD] : null;
+}
+
+const SEAL_THIRD = 'SLH-DSA-SHA2-256s';
+
 async function decide(read, proposal, options) {
   const answer = { allowed: false, problems: [], breaches: [], needs: [] };
   try {
@@ -85,15 +135,33 @@ async function decide(read, proposal, options) {
     }
     const { result, state, beside } = await read();
     if (result.summary.problemFound) throw notSound('A problem was found in the record so far. It must be looked at before the agent acts again.');
-    // A record this device could only partly check is not a pass, here either.
-    if (!result.summary.fullyChecked) throw notSound('This device could not check every signature in the record so far.');
+    // A record this device could only partly check is not a pass, here
+    // either, with one stated exception: a seal's third signature
+    // (SLH-DSA), where its first two were checked here. A seal widens no
+    // permission, and a device without that method (the Python version,
+    // every browser) would otherwise be refused everything once the book
+    // holds a seal. The answer names what was not checked.
+    const notChecked = onlySealThirdUnchecked(result);
+    if (!result.summary.fullyChecked && !notChecked) throw notSound('This device could not check every signature in the record so far.');
+    if (notChecked) answer.notChecked = notChecked;
     if (!result.entries.every((e) => (e.kind === 'stub' || e.kind === 'pass' ? e.compared === true : true))) {
       throw notSound('This device could not compare every stub and every pass in the record so far with its slip.');
     }
     if (result.size >= MAX_ENTRIES) throw new Refusal('too-large', 'The book is full: it holds 100,000 entries.');
 
     f.members(proposal, ['action', 'slip'], ['amount', 'approval', 'details', 'pass', 'terms', 'when', 'with'], 'proposal');
-    const c = { action: proposal.action, when: formatTime(proposal.when ?? Date.now()) };
+    // The time, as the stub writer takes it: a number of milliseconds or a
+    // Date. Text is read by rules that differ between devices.
+    const given = proposal.when ?? Date.now();
+    if (typeof given !== 'number' && !(given instanceof Date)) throw new Refusal('bad-field', 'when: must be a number of milliseconds, or a Date.');
+    let ms;
+    try {
+      ms = new Date(given).getTime();
+    } catch {
+      ms = NaN; // a Date wrapped in a Proxy, which Date cannot read
+    }
+    if (!Number.isFinite(ms)) throw new Refusal('bad-field', 'when: does not give a time.');
+    const c = { action: proposal.action, when: formatTime(ms) };
     for (const name of ['amount', 'details', 'with']) if (proposal[name] !== undefined) c[name] = proposal[name];
     validateRequest(c);
     const when = f.time(c.when, 'when');

package/src/recorder.js

@@ -70,10 +70,18 @@ const notWritten = (why) => new Refusal('record-not-sound', why);
 
 // A time handed in: a number of milliseconds, or a Date. Text, true or a
 // list would be read by rules that differ from one device to another (text
-// with no time zone is taken as local time), so they are refused.
+// with no time zone is taken as local time), so they are refused. A Date
+// that cannot be read (one wrapped in a Proxy) gives no time, as a Date
+// that is not a time gives none, and the check before acting refuses it.
 function timeOf(when) {
   if (typeof when === 'number') return new Date(when).getTime();
-  if (when instanceof Date) return when.getTime();
+  if (when instanceof Date) {
+    try {
+      return when.getTime();
+    } catch {
+      return NaN;
+    }
+  }
   throw new Refusal('bad-field', 'when: must be a number of milliseconds, or a Date.');
 }
 
@@ -775,6 +783,8 @@ export async function openRecorder({ book, slip, privateKeys, issuerKeys, pass,
       return calling(request, more, async (call) => {
         await writeWaiting(now());
         const when = call.when ?? now();
+        // In the words of the check before acting, which "act" and "before" give.
+        if (!Number.isFinite(when)) throw new Refusal('bad-field', 'when: does not give a time.');
         if (aheadOfClock(when)) throw notWritten('The stub was not written: it is dated ahead of the clock.');
         const made = await composeStub(call, when);
         const tried = await fitsBook(made, 'The stub was not written: with it, the book would not pass its check.');

package/src/signatures.js

@@ -16,6 +16,10 @@
 import { importPublicKey, weakEd25519 } from './keys.js';
 
 const SLH = 'SLH-DSA-SHA2-256s';
+
+// The length of a signature, in bytes, by method (RFC 8032, FIPS 204,
+// FIPS 205).
+const SIGNATURE_BYTES = { Ed25519: 64, 'ML-DSA-87': 4627, [SLH]: 29792 };
 const nodeCrypto = globalThis.process && typeof globalThis.process.getBuiltinModule === 'function' ? globalThis.process.getBuiltinModule('node:crypto') : null;
 
 function slhKey(pub) {
@@ -80,6 +84,9 @@ export function methodAvailable(alg) {
  * @returns {Promise<SignatureState>}
  */
 export async function verifySignature(jwk, signature, data, without = []) {
+  // A signature of another length than its method's can never check, so it
+  // is refused on every device, whether or not this one has the method.
+  if (Object.hasOwn(SIGNATURE_BYTES, jwk.alg) && signature.length !== SIGNATURE_BYTES[jwk.alg]) return 'invalid';
   if (jwk.alg === SLH) {
     if (without.includes(SLH) || !(await methodAvailable(SLH))) return 'unavailable';
     try {

package/src/types.d.ts

@@ -431,6 +431,8 @@ export interface BeforeAnswer {
   problems: Finding[];
   breaches: Finding[];
   needs: ('approval' | 'countersignature')[];
+  /** Present only where the device went on without checking a seal's third signature (SLH-DSA-SHA2-256s): the methods not checked. */
+  notChecked?: string[];
 }
 /** "issuerKeys" must be given: a slip signed by any other key allows nothing. */
 export function checkBefore(book: string, proposal: Proposal, options: CheckOptions & { issuerKeys: string[] }): Promise<BeforeAnswer>;