qa360 1.1.4 → 1.1.6

package/dist/commands/doctor.js

@@ -251,7 +251,7 @@ export class QA360Doctor {
     }
     async checkProofKeys() {
         try {
-            const { ensureProofKeys } = await import('qa360-core');
+            const { ensureProofKeys } = await import('../core/index.js');
             const result = await ensureProofKeys(this.qa360Dir);
             // Validate result
             if (!result) {
@@ -328,7 +328,7 @@ export class QA360Doctor {
     }
     async checkProofRoundtrip() {
         try {
-            const coreModule = await import('qa360-core');
+            const coreModule = await import('../core/index.js');
             const { generateKeys, createProofBundle, verifyProofBundle } = coreModule;
             // Guard: Verify exports are functions
             if (typeof generateKeys !== 'function') {

package/dist/core/proof/verifier.js

@@ -263,9 +263,9 @@ export async function verifyPhase3Proof(filePath) {
         }
         // Decode public key from proof
         const publicKey = new Uint8Array(Buffer.from(signature.publicKey, 'base64'));
-        // Canonicalize payload
+        // Canonicalize payload (same way it was signed)
         const { canonicalize } = await import('./canonicalize.js');
-        const canonical = canonicalize(payload);
+        const canonical = canonicalize(payload) + '\n';
         // Verify signature
         const isValid = verify(canonical, signature.value, publicKey);
         if (!isValid) {

package/dist/core/runner/phase3-runner.js

@@ -374,8 +374,8 @@ export class Phase3Runner {
                 afterAll: result.hooks.afterAll.length
             }
         };
-        // Canonicalize the payload for signing
-        const canonicalPayload = canonicalize(proofPayload);
+        // Canonicalize the payload for signing (must match verification: canonical + newline)
+        const canonicalPayload = canonicalize(proofPayload) + '\n';
         // Sign with Ed25519
         let signatureValue;
         let algorithm;
@@ -429,7 +429,7 @@ export class Phase3Runner {
             });
             // Record gate executions
             for (const gate of result.gates) {
-                await this.vault.recordGate(runId, {
+                await this.vault.recordGate(vaultRunId, {
                     name: gate.gate,
                     status: gate.success ? 'passed' : 'failed',
                     duration_ms: gate.duration,
@@ -437,7 +437,7 @@ export class Phase3Runner {
                 });
                 // Record finding if gate has error
                 if (gate.error) {
-                    await this.vault.recordFinding(runId, {
+                    await this.vault.recordFinding(vaultRunId, {
                         gate: gate.gate,
                         severity: 'high',
                         rule: 'gate-failure',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "qa360",
-  "version": "1.1.4",
+  "version": "1.1.6",
   "description": "QA360 Proof CLI - Quality as Cryptographic Proof",
   "type": "module",
   "main": "dist/index.js",