verifyhash 0.1.0 → 0.1.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (63) hide show
  1. package/README.md +5 -3
  2. package/cli/agent-hook.js +431 -0
  3. package/docs/ADOPT.md +15 -5
  4. package/docs/AGENT-HOOK.md +111 -0
  5. package/docs/PUBLISH-VERIFY-VH.md +45 -0
  6. package/examples/README.md +185 -0
  7. package/examples/policy.lenient.json +5 -0
  8. package/examples/policy.strict.json +6 -0
  9. package/examples/run.js +366 -0
  10. package/examples/sample-dataset/README.txt +10 -0
  11. package/examples/sample-dataset/corpus/cc-by-poem.txt +8 -0
  12. package/examples/sample-dataset/corpus/mit-notes.txt +4 -0
  13. package/examples/sample-dataset/data/unlabeled.txt +5 -0
  14. package/examples/sample-dataset/vendored/gpl-snippet.txt +5 -0
  15. package/examples/sample-dataset.hints.json +7 -0
  16. package/examples/sample-parcel/data/manifest-of-contents.txt +7 -0
  17. package/examples/sample-parcel/data/records.csv +4 -0
  18. package/examples/sample-parcel/delivery-note.txt +9 -0
  19. package/package.json +25 -3
  20. package/verifier/README.md +555 -0
  21. package/verifier/action/README.md +87 -0
  22. package/verifier/action/action.yml +146 -0
  23. package/verifier/build-standalone-html.js +1287 -0
  24. package/verifier/build-standalone.js +989 -0
  25. package/verifier/ci/journal.generic.sh +96 -0
  26. package/verifier/ci/journal.github-actions.yml +99 -0
  27. package/verifier/ci/reproduce-vh.generic.sh +59 -0
  28. package/verifier/ci/reproduce-vh.github-actions.yml +49 -0
  29. package/verifier/ci/verify-service.generic.sh +96 -0
  30. package/verifier/ci/verify-service.github-actions.yml +88 -0
  31. package/verifier/ci/verify-vh.generic.sh +75 -0
  32. package/verifier/ci/verify-vh.github-actions.yml +56 -0
  33. package/verifier/dist/BUILD-PROVENANCE.json +210 -0
  34. package/verifier/dist/seal-vh-standalone.js +876 -0
  35. package/verifier/dist/seal-vh-standalone.js.sha256 +1 -0
  36. package/verifier/dist/verify-vh-standalone.html +3373 -0
  37. package/verifier/dist/verify-vh-standalone.html.sha256 +1 -0
  38. package/verifier/dist/verify-vh-standalone.js +4121 -0
  39. package/verifier/dist/verify-vh-standalone.js.sha256 +1 -0
  40. package/verifier/lib/canonical.js +141 -0
  41. package/verifier/lib/keccak.js +30 -0
  42. package/verifier/lib/keccak256-vendored.js +206 -0
  43. package/verifier/lib/merkle.js +145 -0
  44. package/verifier/lib/revocation-core.js +606 -0
  45. package/verifier/lib/revocation.js +200 -0
  46. package/verifier/lib/seal-cli.js +374 -0
  47. package/verifier/lib/seal-evidence.js +237 -0
  48. package/verifier/lib/secp256k1-recover.js +249 -0
  49. package/verifier/package.json +39 -0
  50. package/verifier/verify-vh.js +2374 -0
  51. package/docs/ADOPTION.json +0 -11
  52. package/docs/AUDIT.md +0 -55
  53. package/docs/DECIDE.md +0 -47
  54. package/docs/DECISIONS-PENDING.md +0 -27
  55. package/docs/DEPLOY-PUBLIC-SITE.md +0 -301
  56. package/docs/ENGINE-LEDGER.json +0 -12
  57. package/docs/LOOP-AUDIT-2026-07-03.json +0 -580
  58. package/docs/LOOP-HARDENING-PLAN.md +0 -44
  59. package/docs/METRICS.jsonl +0 -31
  60. package/docs/MORNING.md +0 -204
  61. package/docs/STRATEGY-ARCHIVE.md +0 -5055
  62. package/docs/SUPERVISOR-RUNBOOK.md +0 -52
  63. package/docs/USAGE-BUDGET.json +0 -121
package/verifier/dist/BUILD-PROVENANCE.json ADDED
@@ -0,0 +1,210 @@
1
+ {
2
+ "schema": "verifyhash/build-provenance@1",
3
+ "description": "Maps each published verifyhash standalone bundle's sha256 to the ordered, individually-hashed in-tree source files it inlines. Reproduce + attest the whole chain offline with: node verifier/build-standalone.js --check",
4
+ "targets": {
5
+ "verify": {
6
+ "bundle": "verify-vh-standalone.js",
7
+ "sidecar": "verify-vh-standalone.js.sha256",
8
+ "bundleBytes": 199362,
9
+ "bundleSha256": "371b904b0275ed85606510472570c49a99fc70a5f4e258e7d8fd0e52a26c30bd",
10
+ "sidecarLine": "371b904b0275ed85606510472570c49a99fc70a5f4e258e7d8fd0e52a26c30bd verify-vh-standalone.js",
11
+ "modules": [
12
+ {
13
+ "id": "keccak256-vendored",
14
+ "synthetic": false,
15
+ "sourceFile": "verifier/lib/keccak256-vendored.js",
16
+ "sourceSha256": "4f5f2dda618a5889ab5b3f8498dc64ddeacdd22b57349d97824f60960ee334a1",
17
+ "inlinedSha256": "4f5f2dda618a5889ab5b3f8498dc64ddeacdd22b57349d97824f60960ee334a1",
18
+ "entry": false
19
+ },
20
+ {
21
+ "id": "keccak",
22
+ "synthetic": true,
23
+ "sourceFile": null,
24
+ "sourceSha256": null,
25
+ "inlinedSha256": "7ead489c805c4e62e8338dbcfde77a85ca52076e2a3639e2ba57ce3b2415828e",
26
+ "note": "swapped body (keccak provider shim) — defined in build-standalone.js, not a source file"
27
+ },
28
+ {
29
+ "id": "merkle",
30
+ "synthetic": false,
31
+ "sourceFile": "verifier/lib/merkle.js",
32
+ "sourceSha256": "1bea7bab4b479962225279f4590c5524fad5295c7c70cf01d4978dbf9f37f34b",
33
+ "inlinedSha256": "e65be5614998f9a00ca9b58a6c79b05abe7f70ed2e0dad61ece07a41ee5da876",
34
+ "entry": false
35
+ },
36
+ {
37
+ "id": "canonical",
38
+ "synthetic": false,
39
+ "sourceFile": "verifier/lib/canonical.js",
40
+ "sourceSha256": "edc190dcabd2b34b33c54240fc951141de13d2c7d2759184cacb160dfdf3e764",
41
+ "inlinedSha256": "edc190dcabd2b34b33c54240fc951141de13d2c7d2759184cacb160dfdf3e764",
42
+ "entry": false
43
+ },
44
+ {
45
+ "id": "secp256k1-recover",
46
+ "synthetic": false,
47
+ "sourceFile": "verifier/lib/secp256k1-recover.js",
48
+ "sourceSha256": "34bb39eed0afc5f55241419ba827404bf767fa5dde1363dba5ad9c419cf91dab",
49
+ "inlinedSha256": "c8bab43d54b01dd7e55aeae6bc6d27986b868cbc7ebc1b1279dc70f032dbc122",
50
+ "entry": false
51
+ },
52
+ {
53
+ "id": "revocation-core",
54
+ "synthetic": false,
55
+ "sourceFile": "verifier/lib/revocation-core.js",
56
+ "sourceSha256": "99377291d5455b7a01a3eca313cd1289f6df8ce76a37bcb0aacc68ebe70601b1",
57
+ "inlinedSha256": "6a426132b56560771fc187caaeee308cd4aaaf87b211aff87dff04cbc622bd2e",
58
+ "entry": false
59
+ },
60
+ {
61
+ "id": "revocation",
62
+ "synthetic": false,
63
+ "sourceFile": "verifier/lib/revocation.js",
64
+ "sourceSha256": "538b09ca210e47b51319b89fc681229ee16873425f2635855dc0d6f0dc57374f",
65
+ "inlinedSha256": "ba7ae1d7600289d7584e998f02fffb82eaa03dfb55e2e2373bda374144ce9d44",
66
+ "entry": false
67
+ },
68
+ {
69
+ "id": "verify-vh",
70
+ "synthetic": false,
71
+ "sourceFile": "verifier/verify-vh.js",
72
+ "sourceSha256": "0e948e5973cd0faf3acda4fb14640feed13fde6190e345b2aea083addeb4b662",
73
+ "inlinedSha256": "ad89a1d71240c725255633f27f7f3298c8c9718b33eea7c640cae8d62eea8054",
74
+ "entry": true
75
+ }
76
+ ]
77
+ },
78
+ "seal": {
79
+ "bundle": "seal-vh-standalone.js",
80
+ "sidecar": "seal-vh-standalone.js.sha256",
81
+ "bundleBytes": 39477,
82
+ "bundleSha256": "6e61e8638464475870e12760f326d30c7eefb5858ad1bccd2fdcd721b1b8a0c6",
83
+ "sidecarLine": "6e61e8638464475870e12760f326d30c7eefb5858ad1bccd2fdcd721b1b8a0c6 seal-vh-standalone.js",
84
+ "modules": [
85
+ {
86
+ "id": "keccak256-vendored",
87
+ "synthetic": false,
88
+ "sourceFile": "verifier/lib/keccak256-vendored.js",
89
+ "sourceSha256": "4f5f2dda618a5889ab5b3f8498dc64ddeacdd22b57349d97824f60960ee334a1",
90
+ "inlinedSha256": "4f5f2dda618a5889ab5b3f8498dc64ddeacdd22b57349d97824f60960ee334a1",
91
+ "entry": false
92
+ },
93
+ {
94
+ "id": "keccak",
95
+ "synthetic": true,
96
+ "sourceFile": null,
97
+ "sourceSha256": null,
98
+ "inlinedSha256": "7ead489c805c4e62e8338dbcfde77a85ca52076e2a3639e2ba57ce3b2415828e",
99
+ "note": "swapped body (keccak provider shim) — defined in build-standalone.js, not a source file"
100
+ },
101
+ {
102
+ "id": "merkle",
103
+ "synthetic": false,
104
+ "sourceFile": "verifier/lib/merkle.js",
105
+ "sourceSha256": "1bea7bab4b479962225279f4590c5524fad5295c7c70cf01d4978dbf9f37f34b",
106
+ "inlinedSha256": "e65be5614998f9a00ca9b58a6c79b05abe7f70ed2e0dad61ece07a41ee5da876",
107
+ "entry": false
108
+ },
109
+ {
110
+ "id": "seal-cli",
111
+ "synthetic": false,
112
+ "sourceFile": "verifier/lib/seal-cli.js",
113
+ "sourceSha256": "7a68adacb21ace3c3a77a3bc9bc27ec8a4732c77df3e8d6a6c5864d44a7a13bc",
114
+ "inlinedSha256": "8ba0e03a6a9bcaa5ee400d045fc13c4eb7e99b2d7f4effb307135e7b02d8804d",
115
+ "entry": true
116
+ }
117
+ ]
118
+ },
119
+ "verify-html": {
120
+ "bundle": "verify-vh-standalone.html",
121
+ "sidecar": "verify-vh-standalone.html.sha256",
122
+ "bundleBytes": 158889,
123
+ "bundleSha256": "2e0ea39b9e79ae469adf980c0978c8172ad89fe69f35d33df9e041ade5fc5e23",
124
+ "sidecarLine": "2e0ea39b9e79ae469adf980c0978c8172ad89fe69f35d33df9e041ade5fc5e23 verify-vh-standalone.html",
125
+ "modules": [
126
+ {
127
+ "id": "vh-buffer",
128
+ "synthetic": true,
129
+ "sourceFile": null,
130
+ "sourceSha256": null,
131
+ "inlinedSha256": "9ad808104bafe9808e00f854f093b355373b6cc77816b15fdaef1a90886b2b14",
132
+ "note": "pure-JS browser Buffer subset shim — defined in build-standalone-html.js, not a source file"
133
+ },
134
+ {
135
+ "id": "keccak256-vendored",
136
+ "synthetic": false,
137
+ "sourceFile": "verifier/lib/keccak256-vendored.js",
138
+ "sourceSha256": "4f5f2dda618a5889ab5b3f8498dc64ddeacdd22b57349d97824f60960ee334a1",
139
+ "inlinedSha256": "4f5f2dda618a5889ab5b3f8498dc64ddeacdd22b57349d97824f60960ee334a1",
140
+ "entry": false
141
+ },
142
+ {
143
+ "id": "keccak",
144
+ "synthetic": true,
145
+ "sourceFile": null,
146
+ "sourceSha256": null,
147
+ "inlinedSha256": "ed26685779b189ecc7e62daf2a17ce366de3c64f2198cd4b64f8dbc40b68c86d",
148
+ "note": "swapped body (keccak provider shim over the vendored pure-JS keccak256, returning vh-buffer Buffers) — defined in build-standalone-html.js, not a source file"
149
+ },
150
+ {
151
+ "id": "merkle",
152
+ "synthetic": false,
153
+ "sourceFile": "verifier/lib/merkle.js",
154
+ "sourceSha256": "1bea7bab4b479962225279f4590c5524fad5295c7c70cf01d4978dbf9f37f34b",
155
+ "inlinedSha256": "e65be5614998f9a00ca9b58a6c79b05abe7f70ed2e0dad61ece07a41ee5da876",
156
+ "entry": false
157
+ },
158
+ {
159
+ "id": "canonical",
160
+ "synthetic": false,
161
+ "sourceFile": "verifier/lib/canonical.js",
162
+ "sourceSha256": "edc190dcabd2b34b33c54240fc951141de13d2c7d2759184cacb160dfdf3e764",
163
+ "inlinedSha256": "edc190dcabd2b34b33c54240fc951141de13d2c7d2759184cacb160dfdf3e764",
164
+ "entry": false
165
+ },
166
+ {
167
+ "id": "secp256k1-recover",
168
+ "synthetic": false,
169
+ "sourceFile": "verifier/lib/secp256k1-recover.js",
170
+ "sourceSha256": "34bb39eed0afc5f55241419ba827404bf767fa5dde1363dba5ad9c419cf91dab",
171
+ "inlinedSha256": "c8bab43d54b01dd7e55aeae6bc6d27986b868cbc7ebc1b1279dc70f032dbc122",
172
+ "entry": false
173
+ },
174
+ {
175
+ "id": "revocation-core",
176
+ "synthetic": false,
177
+ "sourceFile": "verifier/lib/revocation-core.js",
178
+ "sourceSha256": "99377291d5455b7a01a3eca313cd1289f6df8ce76a37bcb0aacc68ebe70601b1",
179
+ "inlinedSha256": "6a426132b56560771fc187caaeee308cd4aaaf87b211aff87dff04cbc622bd2e",
180
+ "entry": false
181
+ },
182
+ {
183
+ "id": "verify-vh-engine",
184
+ "synthetic": false,
185
+ "sourceFile": "verifier/verify-vh.js",
186
+ "sourceSha256": "0e948e5973cd0faf3acda4fb14640feed13fde6190e345b2aea083addeb4b662",
187
+ "inlinedSha256": "0e7069b4e04d7602110fed07f90a086822750040054da07335b8bbae16c945c0",
188
+ "entry": true,
189
+ "note": "the marked T-66.1 pure-engine slice of verifier/verify-vh.js (the bytes between its BEGIN/END engine markers), wrapped in a build-generated __require preamble + exports postamble; sourceSha256 pins the WHOLE verify-vh.js source file"
190
+ },
191
+ {
192
+ "id": "challenge-fixture",
193
+ "synthetic": true,
194
+ "sourceFile": null,
195
+ "sourceSha256": null,
196
+ "inlinedSha256": "8db0c9080d5f5904ebc2f4c8c26cf80c4012cd9c05e74a5c78ebf970f8f3f462",
197
+ "note": "the verifier's shipped demo packet (DEMO_SIGNER/DEMO_FILES/DEMO_CONTAINER/DEMO_PACKET_NAME), extracted verbatim at build time from verifier/verify-vh.js (pinned by the verify-vh-engine record's sourceSha256) — defined in build-standalone-html.js"
198
+ },
199
+ {
200
+ "id": "challenge",
201
+ "synthetic": true,
202
+ "sourceFile": null,
203
+ "sourceSha256": null,
204
+ "inlinedSha256": "e037b92fa4225cd2375547537195dffe366e124bbfa6db51785b431a40784693",
205
+ "note": "the built-in 60-second-challenge runner over the embedded demo fixture — defined in build-standalone-html.js, not a source file"
206
+ }
207
+ ]
208
+ }
209
+ }
210
+ }