xoonya 2.11.0 → 2.12.1

package/RELEASE_NOTES.md

@@ -1,11 +1,12 @@
-# xoonya 2.11.0 Release Notes
+`xoonya` 2.12.1 is the proof-release truth patch line for aligned npm, GitHub, website, code, documentation, and public-copy surfaces.
 
-`xoonya` 2.11.0 is the lowercase-brand-convention line for aligned npm, GitHub, website, code, documentation, and public-copy surfaces.
+This patch keeps the synchronized public-release bundle intact and refreshes the packaged release notes so the published tarball follows the normal release-note format and stays easy to scan later.
 
 Highlights:
 
 - normalizes visible `xoonya`, `xytara`, and `naxytra` product references to the lowercase convention across package docs, native-standard copy, CLI release surfaces, server routes, and verifier call sites
-- preserves XNYA-compatible conformance, native reference implementation boundaries, external proof import boundaries, and the PQ/hybrid design gate
+- preserves XNYA-compatible conformance, native reference implementation boundaries, external proof import boundaries, trust-portability surfaces, and the PQ/hybrid design gate
+- keeps verification services, trust-portability surfaces, and reference-implementation posture aligned with the same synchronized public release line
 - keeps `RELEASE_NOTES.md` scoped to the current release so npm and GitHub release notes stay clean
 - keeps the canonical `https://naxytra.com/xoonya` public product URL and single naxytra website positioning intact
 - verifies the lowercase convention through the release candidate, full package verifier, umbrella pre-deploy gates, and clean-consumer release smoke

package/index.js

@@ -3,6 +3,8 @@
 module.exports = {
   ...require("./proof_sdk"),
   ...require("./integrations/registry"),
+  ...require("./lib/verification_service_pack"),
+  ...require("./lib/trust_portability_pack"),
   ...require("./lib/release_pack"),
   ...require("./lib/release_manifest"),
   ...require("./lib/release_center"),

package/lib/release_history.js

@@ -10,6 +10,17 @@ function buildReleaseHistory() {
     current_version: packageJson.version,
     release_track: "public_release",
     history: [
+      {
+        version: "2.12.1",
+        channel: "public_release",
+        maturity_posture: "release_note_patch",
+        headline: "release-note patch for the 2.12.0 proof-release truth line",
+        milestone_refs: [
+          "release_notes_format_refresh",
+          "packaged_tarball_note_alignment",
+          "synchronized_public_release_history"
+        ]
+      },
       {
         version: "2.11.0",
         channel: "public_release",

package/lib/trust_portability_pack.js

@@ -0,0 +1,224 @@
+"use strict";
+
+const packageJson = require("../package.json");
+const {
+  buildAuthInteropContract,
+  summarizeAuthInteropContract
+} = require("./auth_interop_contract");
+const {
+  buildIdentityInteropContract,
+  summarizeIdentityInteropContract
+} = require("./identity_interop_contract");
+const {
+  buildResultPackageTrustLanePack,
+  summarizeResultPackageTrustLanePack
+} = require("./result_package_trust_lane_contract");
+const {
+  buildPhase4TrustContinuityPack,
+  summarizePhase4TrustContinuityPack
+} = require("./phase_4_trust_continuity_pack");
+const {
+  buildPhase4IdentityRegistryProofPack,
+  summarizePhase4IdentityRegistryProofPack
+} = require("./phase_4_identity_registry_proof_pack");
+const {
+  buildVerificationServicesPack,
+  summarizeVerificationServicesPack
+} = require("./verification_service_pack");
+
+function buildTrustPortabilityPack() {
+  const authInterop = buildAuthInteropContract();
+  const authInteropSummary = summarizeAuthInteropContract();
+  const identityInterop = buildIdentityInteropContract();
+  const identityInteropSummary = summarizeIdentityInteropContract();
+  const resultPackageTrust = buildResultPackageTrustLanePack();
+  const resultPackageTrustSummary = summarizeResultPackageTrustLanePack();
+  const phase4TrustContinuity = buildPhase4TrustContinuityPack();
+  const phase4TrustContinuitySummary = summarizePhase4TrustContinuityPack();
+  const phase4IdentityRegistry = buildPhase4IdentityRegistryProofPack();
+  const phase4IdentityRegistrySummary = summarizePhase4IdentityRegistryProofPack();
+  const verificationServices = buildVerificationServicesPack();
+  const verificationServicesSummary = summarizeVerificationServicesPack();
+  const servicesById = Object.fromEntries(
+    (verificationServices.verification_services || []).map((entry) => [entry.service_id, entry])
+  );
+
+  const profiles = [
+    {
+      profile_id: "agent_identity_portability",
+      profile_label: "agent identity portability",
+      portability_axis: "agent_identity",
+      claim_status: "bounded_live",
+      portability_state: "identity_attestation_registry_and_bundle_linkage_present",
+      callable_surfaces: [
+        "/v1/identity-interop",
+        "/v1/phases/phase-4/identity-registry/proof/summary",
+        "/v1/receipts/verify"
+      ],
+      supporting_surfaces: [
+        "/v1/identity-interop/summary",
+        "/v1/phases/phase-4/trust-continuity/summary",
+        "/v1/proof-center/verification-services/summary"
+      ],
+      supporting_counts: {
+        identity_interop_profile_count: identityInteropSummary.profile_count,
+        identity_registry_resolution_mode_count: phase4IdentityRegistrySummary.resolution_mode_count,
+        verification_service_count: verificationServicesSummary.service_count
+      },
+      expected_portability_outcome: "identity refs remain reviewable and portable across proof bundles, registry proof, and carried receipts",
+      claim_boundary: "identity_portability_binds_reviewable_identity_refs_and_registry_resolution_without_becoming_global_login_or_external_issuer_truth"
+    },
+    {
+      profile_id: "delegation_capability_portability",
+      profile_label: "delegation/capability portability",
+      portability_axis: "delegation_capabilities",
+      claim_status: "bounded_live",
+      portability_state: "auth_interop_bridge_handoff_and_review_followthrough_present",
+      callable_surfaces: [
+        "/v1/auth-profiles",
+        "/v1/proof-center/bridge/economic-handoff",
+        "/v1/proof-center/result-package-handoff/review/handoff-intake"
+      ],
+      supporting_surfaces: [
+        "/v1/auth-profiles/summary",
+        "/v1/proof-center/bridge/summary",
+        "/v1/result-package-trust/summary"
+      ],
+      supporting_counts: {
+        auth_interop_profile_count: authInteropSummary.profile_count,
+        bridge_flow_count: Array.isArray(resultPackageTrust.first_run_flows) ? resultPackageTrust.first_run_flows.length : 0,
+        delivery_verify_callable_surface_count: Array.isArray(servicesById.delivery_verify && servicesById.delivery_verify.callable_surfaces)
+          ? servicesById.delivery_verify.callable_surfaces.length
+          : 0
+      },
+      expected_portability_outcome: "delegated capability context can cross runtime-to-proof handoff while staying reviewable and bounded",
+      claim_boundary: "delegation_portability_preserves_handoff_capability_context_without_becoming_session_authority_or_runtime_execution_truth"
+    },
+    {
+      profile_id: "delivery_history_portability",
+      profile_label: "delivery history portability",
+      portability_axis: "delivery_history",
+      claim_status: "bounded_live",
+      portability_state: "result_package_delivery_review_and_followthrough_present",
+      callable_surfaces: [
+        "/v1/result-package-trust",
+        "/v1/proof-center/result-package-handoff/review/summary",
+        "/v1/proof-center/transaction-handoff/run"
+      ],
+      supporting_surfaces: [
+        "/v1/result-package-trust/summary",
+        "/v1/phases/phase-4/trust-continuity/summary",
+        "/v1/proof-center/verification-services/summary"
+      ],
+      supporting_counts: {
+        proof_readiness_state: resultPackageTrustSummary.proof_readiness_state,
+        trust_continuity_signal_count: phase4TrustContinuitySummary.signal_count,
+        delivery_verify_callable_surface_count: Array.isArray(servicesById.delivery_verify && servicesById.delivery_verify.callable_surfaces)
+          ? servicesById.delivery_verify.callable_surfaces.length
+          : 0
+      },
+      expected_portability_outcome: "delivery history stays inspectable through carried result packages, handoff review, and delivery verification surfaces",
+      claim_boundary: "delivery_history_portability_preserves_reviewable_result_package_continuity_not_runtime_success_truth_beyond_carried_evidence"
+    },
+    {
+      profile_id: "settlement_linked_trust_portability",
+      profile_label: "settlement-linked trust portability",
+      portability_axis: "settlement_linked_trust",
+      claim_status: "bounded_live",
+      portability_state: "bridge_anchor_and_settlement_verification_followthrough_present",
+      callable_surfaces: [
+        "/v1/proof-center/bridge/validator-verify",
+        "/v1/proof-center/bridge/economic-handoff",
+        "/v1/proof-center/native-anchor-profile/summary"
+      ],
+      supporting_surfaces: [
+        "/v1/proof-center/bridge/summary",
+        "/v1/proof-center/verification-services/summary",
+        "/v1/phases/phase-4/trust-continuity/summary"
+      ],
+      supporting_counts: {
+        settlement_verify_callable_surface_count: Array.isArray(servicesById.settlement_verify && servicesById.settlement_verify.callable_surfaces)
+          ? servicesById.settlement_verify.callable_surfaces.length
+          : 0,
+        anchor_verify_callable_surface_count: Array.isArray(servicesById.anchor_finality_verify && servicesById.anchor_finality_verify.callable_surfaces)
+          ? servicesById.anchor_finality_verify.callable_surfaces.length
+          : 0,
+        phase_4_review_mode_count: phase4TrustContinuitySummary.review_mode_count
+      },
+      expected_portability_outcome: "trust continuity can remain attached to settlement evidence, anchor context, and carried economic handoff without overclaiming chain truth",
+      claim_boundary: "settlement_linked_trust_portability_binds_reviewable_settlement_and_anchor_context_without_claiming_external_chain_or_custody_truth"
+    }
+  ];
+
+  return {
+    ok: true,
+    product: packageJson.name,
+    category: "xoonya-trust-portability-pack",
+    pack_version: "xoonya-trust-portability-pack-v1",
+    doctrine: "cross_venue_identity_delegation_delivery_and_settlement_linked_trust_portability",
+    portability_profiles: profiles,
+    supporting_contracts: {
+      auth_interop_summary: authInteropSummary,
+      identity_interop_summary: identityInteropSummary,
+      result_package_trust_summary: resultPackageTrustSummary,
+      phase_4_trust_continuity_summary: phase4TrustContinuitySummary,
+      phase_4_identity_registry_proof_summary: phase4IdentityRegistrySummary,
+      verification_service_summary: verificationServicesSummary
+    },
+    first_run_flow: {
+      flow_ref: "cross_venue_trust_portability_review",
+      recommended_reason: "show that identity, delegation, delivery history, and settlement-linked trust remain portable across proof-facing surfaces",
+      http_sequence: [
+        "/v1/proof-center/trust-portability/summary",
+        "/v1/identity-interop/summary",
+        "/v1/result-package-trust/summary",
+        "/v1/proof-center/verification-services/summary"
+      ]
+    },
+    public_claim_boundaries: [
+      "trust_portability_is_reviewable_followthrough_not_global_identity_or_login_truth",
+      "delegation_portability_stays_bound_to_listed_auth_and_handoff_surfaces",
+      "delivery_history_portability_stays_bound_to_carried_result_package_and_review_surfaces",
+      "settlement_linked_trust_portability_does_not_claim_external_chain_or_custody_truth"
+    ],
+    linked_surfaces: {
+      auth_interop_ref: "/v1/auth-profiles",
+      auth_interop_summary_ref: "/v1/auth-profiles/summary",
+      identity_interop_ref: "/v1/identity-interop",
+      identity_interop_summary_ref: "/v1/identity-interop/summary",
+      result_package_trust_ref: "/v1/result-package-trust",
+      result_package_trust_summary_ref: "/v1/result-package-trust/summary",
+      phase_4_trust_continuity_ref: "/v1/phases/phase-4/trust-continuity",
+      phase_4_trust_continuity_summary_ref: "/v1/phases/phase-4/trust-continuity/summary",
+      phase_4_identity_registry_proof_ref: "/v1/phases/phase-4/identity-registry/proof",
+      phase_4_identity_registry_proof_summary_ref: "/v1/phases/phase-4/identity-registry/proof/summary",
+      verification_services_ref: "/v1/proof-center/verification-services",
+      verification_services_summary_ref: "/v1/proof-center/verification-services/summary"
+    }
+  };
+}
+
+function getTrustPortabilityProfile(profileId) {
+  return buildTrustPortabilityPack().portability_profiles.find((entry) => entry.profile_id === profileId) || null;
+}
+
+function summarizeTrustPortabilityPack() {
+  const pack = buildTrustPortabilityPack();
+  return {
+    ok: true,
+    product: pack.product,
+    category: "xoonya-trust-portability-summary",
+    summary_version: "xoonya-trust-portability-summary-v1",
+    profile_count: pack.portability_profiles.length,
+    bounded_live_profile_count: pack.portability_profiles.filter((entry) => entry.claim_status === "bounded_live").length,
+    callable_profile_count: pack.portability_profiles.filter((entry) => Array.isArray(entry.callable_surfaces) && entry.callable_surfaces.length >= 2).length,
+    portability_axis_count: Array.from(new Set(pack.portability_profiles.map((entry) => entry.portability_axis))).length,
+    linked_surfaces: pack.linked_surfaces
+  };
+}
+
+module.exports = {
+  buildTrustPortabilityPack,
+  getTrustPortabilityProfile,
+  summarizeTrustPortabilityPack
+};

package/lib/verification_service_pack.js

@@ -0,0 +1,149 @@
+"use strict";
+
+const packageJson = require("../package.json");
+const proofSdk = require("../proof_sdk");
+
+function buildVerificationServicesPack() {
+  const proofCenter = proofSdk.summarizeDefaultProofCenter();
+  const resultPackageCenter = proofSdk.summarizeInteractionResultPackageHandoffCenter();
+  const transactionHandoff = proofSdk.summarizeTransactionProofHandoffCenter();
+  const interactionHandoff = proofSdk.summarizeInteractionSpineProofHandoffCenter();
+  const governance = proofSdk.summarizeGovernanceCenter();
+  const nativeAnchor = proofSdk.summarizexoonyaNativeAnchorProfile();
+  const bridge = proofSdk.summarizeBridgeCenter();
+
+  const services = [
+    {
+      service_id: "bundle_verify",
+      service_label: "bundle verify",
+      verification_kind: "bundle_verify",
+      claim_status: "live",
+      callable_surfaces: ["/v1/proof-bundles/verify", "/v1/proof-center/default-loops/run"],
+      supporting_surfaces: ["/v1/proof-center/summary", "/v1/proof-center/default-loops/summary"],
+      verification_methods: proofCenter.verification_methods,
+      claim_boundary: "verifies_xoonya_bundle_contract_and_registered_methods_not_external_issuer_truth"
+    },
+    {
+      service_id: "delivery_verify",
+      service_label: "delivery verify",
+      verification_kind: "delivery_verify",
+      claim_status: "bounded_live",
+      callable_surfaces: [
+        "/v1/proof-center/transaction-handoff/run",
+        "/v1/proof-center/interaction-spine-handoff/run",
+        "/v1/proof-center/result-package-handoff/review/summary"
+      ],
+      supporting_surfaces: [
+        "/v1/proof-center/transaction-handoff/summary",
+        "/v1/proof-center/interaction-spine-handoff/summary",
+        "/v1/proof-center/result-package-handoff/summary"
+      ],
+      supporting_counts: {
+        transaction_source_count: transactionHandoff.transaction_handoff_source_count,
+        interaction_source_count: interactionHandoff.interaction_spine_source_count,
+        result_package_source_count: resultPackageCenter.result_package_source_count
+      },
+      claim_boundary: "delivery_verification_confirms_bundle_continuity_and_handoff_shape_not_runtime_success_beyond_carried_evidence"
+    },
+    {
+      service_id: "settlement_verify",
+      service_label: "settlement verify",
+      verification_kind: "settlement_verify",
+      claim_status: "bounded_live",
+      callable_surfaces: ["/v1/proof-center/bridge/validator-verify"],
+      supporting_surfaces: ["/v1/proof-center/bridge/summary", "/v1/proof-center/native-anchor-profile/summary"],
+      supporting_counts: {
+        bridge_profile_count: bridge.profile_count,
+        anchor_binding_count: nativeAnchor.anchor_ref_type_count
+      },
+      claim_boundary: "settlement_verification_binds_settlement_evidence_and_anchor_context_without_claiming_external_chain_truth_by_default"
+    },
+    {
+      service_id: "dispute_replay",
+      service_label: "dispute replay",
+      verification_kind: "dispute_replay",
+      claim_status: "bounded_live",
+      callable_surfaces: [
+        "/v1/proof-center/governance/disputes/summary",
+        "/v1/proof-center/governance/disputes/case-review",
+        "/v1/proof-center/governance/disputes/case-bundle",
+        "/v1/proof-center/governance/disputes/resolution-pack"
+      ],
+      supporting_surfaces: ["/v1/proof-center/governance/summary", "/v1/proof-center/governance/review-link"],
+      supporting_counts: {
+        workflow_count: governance.workflow_count,
+        dispute_surface_count: 4
+      },
+      claim_boundary: "dispute_replay_preserves_reviewable_evidence_and_resolution_shape_not_external_legal_judgment_truth"
+    },
+    {
+      service_id: "identity_link_verify",
+      service_label: "identity-link verify",
+      verification_kind: "identity_link_verify",
+      claim_status: "bounded_live",
+      callable_surfaces: ["/v1/receipts/verify", "/v1/proof-center/native-anchor-profile/summary"],
+      supporting_surfaces: ["/v1/identity-interop/summary", "/v1/proof-center/result-package-handoff/review/handoff-intake"],
+      supporting_counts: {
+        verification_method_count: proofCenter.verification_method_count,
+        native_methods_present: nativeAnchor.required_method_count
+      },
+      claim_boundary: "identity_link_verification_binds_identity_refs_inside_the_bundle_without_becoming_login_session_or_global_identity_truth"
+    },
+    {
+      service_id: "anchor_finality_verify",
+      service_label: "anchor/finality verify",
+      verification_kind: "anchor_finality_verify",
+      claim_status: "bounded_live",
+      callable_surfaces: ["/v1/proof-center/native-anchor-profile/summary"],
+      supporting_surfaces: ["/v1/proof-center/native-anchor-profile", "/v1/proof-center/bridge/summary"],
+      supporting_counts: {
+        anchor_ref_type_count: nativeAnchor.anchor_ref_type_count,
+        bridge_profile_count: bridge.profile_count
+      },
+      claim_boundary: "anchor_and_finality_verification_confirms_xoonya_binding_and_declared_anchor_refs_not_external_provider_or_chain_truth"
+    }
+  ];
+
+  return {
+    ok: true,
+    product: packageJson.name,
+    category: "xoonya-verification-services-pack",
+    pack_version: "xoonya-verification-services-pack-v1",
+    doctrine: "native_optional_external_methods_supported_verification_and_replay_are_first_class_services",
+    service_count: services.length,
+    verification_services: services,
+    public_claim_boundaries: [
+      "keep_external_identity_and_signature_truth_outside_xoonya_without_external_verifier_evidence",
+      "keep_native_optional_not_mandatory",
+      "keep_anchor_and_finality_checks_bound_to_xoonya_binding_not_external_chain_truth",
+      "keep_dispute_replay_as_reviewable_evidence_not_universal_judgment_truth"
+    ],
+    linked_surfaces: {
+      proof_center_ref: "/v1/proof-center",
+      proof_center_summary_ref: "/v1/proof-center/summary",
+      bridge_summary_ref: "/v1/proof-center/bridge/summary",
+      governance_summary_ref: "/v1/proof-center/governance/summary",
+      native_anchor_profile_ref: "/v1/proof-center/native-anchor-profile",
+      result_package_handoff_summary_ref: "/v1/proof-center/result-package-handoff/summary"
+    }
+  };
+}
+
+function summarizeVerificationServicesPack() {
+  const pack = buildVerificationServicesPack();
+  return {
+    ok: true,
+    product: pack.product,
+    category: "xoonya-verification-services-summary",
+    summary_version: "xoonya-verification-services-summary-v1",
+    service_count: pack.service_count,
+    live_service_count: pack.verification_services.filter((entry) => entry.claim_status === "live").length,
+    bounded_live_service_count: pack.verification_services.filter((entry) => entry.claim_status === "bounded_live").length,
+    linked_surfaces: pack.linked_surfaces
+  };
+}
+
+module.exports = {
+  buildVerificationServicesPack,
+  summarizeVerificationServicesPack
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "xoonya",
-  "version": "2.11.0",
+  "version": "2.12.1",
   "description": "Deterministic proof and review engine for receipts, handoffs, governance, and verification.",
   "main": "index.js",
   "bin": {
@@ -80,11 +80,13 @@
     "verify:reference-promotion-gate": "node scripts/verify_reference_promotion_gate.js",
     "verify:reference-rust-scaffold": "node scripts/verify_reference_rust_scaffold.js",
     "verify:native-hybrid-gate": "node scripts/verify_native_hybrid_design_gate.js",
+    "verify:verification-services": "node scripts/verify_verification_services.js",
+    "verify:trust-portability": "node scripts/verify_trust_portability.js",
     "verify:vectors": "node scripts/verify_vectors.js",
     "verify:examples": "node scripts/verify_examples.js",
     "verify:service": "node scripts/verify_service.js",
     "verify:release-candidate": "node scripts/verify_release_candidate.js",
-    "verify:all": "node scripts/verify_all.js && node scripts/verify_external_proof_import_gate.js && node scripts/verify_integrations.js && node scripts/verify_tooling.js && node scripts/verify_vectors.js && node scripts/verify_reference_python.js && node scripts/verify_reference_promotion_gate.js && node scripts/verify_reference_rust_scaffold.js && node scripts/verify_native_hybrid_design_gate.js && node scripts/verify_examples.js && node scripts/verify_service.js",
+    "verify:all": "node scripts/verify_all.js && node scripts/verify_external_proof_import_gate.js && node scripts/verify_integrations.js && node scripts/verify_tooling.js && node scripts/verify_vectors.js && node scripts/verify_reference_python.js && node scripts/verify_reference_promotion_gate.js && node scripts/verify_reference_rust_scaffold.js && node scripts/verify_native_hybrid_design_gate.js && node scripts/verify_verification_services.js && node scripts/verify_trust_portability.js && node scripts/verify_examples.js && node scripts/verify_service.js",
     "prepublishOnly": "npm run verify:release-candidate"
   }
 }

package/scripts/verify_release_candidate.js

@@ -18,12 +18,10 @@ function parsePackDryRun() {
 function verifyReleaseNotes() {
   const notesPath = path.resolve(__dirname, "..", "RELEASE_NOTES.md");
   const notes = fs.readFileSync(notesPath, "utf8");
-  const headings = (notes.match(/^#\s+xoonya\s+\d+\.\d+\.\d+\s+Release Notes\s*$/gm) || [])
-    .map((heading) => heading.trim());
-  assert.deepStrictEqual(
-    headings,
-    [`# xoonya ${packageJson.version} Release Notes`],
-    "RELEASE_NOTES.md must contain only the current xoonya release heading"
+  assert.strictEqual(
+    /^#\s+xoonya\s+\d+\.\d+\.\d+\s+Release Notes\s*$/m.test(notes),
+    false,
+    "RELEASE_NOTES.md must not duplicate the GitHub release title as a heading"
   );
   assert.strictEqual(
     notes.includes(`xoonya\` ${packageJson.version}`),
@@ -102,6 +100,7 @@ function main() {
   assert.strictEqual(dryRun.files.some((entry) => entry.path === "scripts/verify_reference_promotion_gate.js"), true, "npm pack dry-run missing reference promotion gate verifier script");
   assert.strictEqual(dryRun.files.some((entry) => entry.path === "scripts/verify_reference_rust_scaffold.js"), true, "npm pack dry-run missing Rust reference scaffold verifier script");
   assert.strictEqual(dryRun.files.some((entry) => entry.path === "scripts/verify_native_hybrid_design_gate.js"), true, "npm pack dry-run missing native hybrid design-gate verifier script");
+  assert.strictEqual(dryRun.files.some((entry) => entry.path === "scripts/verify_verification_services.js"), true, "npm pack dry-run missing verification services verifier script");
   assert.strictEqual(dryRun.files.some((entry) => entry.path === "scripts/verify_all.js"), true, "npm pack dry-run missing package verifier script");
   assert.strictEqual(dryRun.files.some((entry) => entry.path === "vectors/conformance-vectors.json"), true, "npm pack dry-run missing conformance vectors");
   assert.strictEqual(dryRun.files.some((entry) => entry.path === "vectors/adversarial-vectors.json"), true, "npm pack dry-run missing adversarial vectors");

package/scripts/verify_service.js

@@ -105,6 +105,22 @@ async function main() {
     assert.strictEqual(identityInteropSummaryResponse.json.product, 'xoonya', 'identity interop summary product missing');
     assert.strictEqual(identityInteropSummaryResponse.json.profile_count >= 4, true, 'identity interop summary count missing');
 
+    const trustPortabilityResponse = await getJson(baseUrl, '/v1/proof-center/trust-portability');
+    assert.strictEqual(trustPortabilityResponse.status, 200, 'trust portability route failed');
+    assert.strictEqual(trustPortabilityResponse.json.product, 'xoonya', 'trust portability product missing');
+    assert.strictEqual(trustPortabilityResponse.json.category, 'xoonya-trust-portability-pack', 'trust portability category missing');
+    assert.strictEqual(Array.isArray(trustPortabilityResponse.json.portability_profiles), true, 'trust portability profiles missing');
+    assert.strictEqual(trustPortabilityResponse.json.portability_profiles.length >= 4, true, 'trust portability profile count missing');
+
+    const trustPortabilitySummaryResponse = await getJson(baseUrl, '/v1/proof-center/trust-portability/summary');
+    assert.strictEqual(trustPortabilitySummaryResponse.status, 200, 'trust portability summary route failed');
+    assert.strictEqual(trustPortabilitySummaryResponse.json.product, 'xoonya', 'trust portability summary product missing');
+    assert.strictEqual(trustPortabilitySummaryResponse.json.profile_count >= 4, true, 'trust portability summary profile count missing');
+
+    const trustPortabilityDetailResponse = await getJson(baseUrl, '/v1/proof-center/trust-portability/agent_identity_portability');
+    assert.strictEqual(trustPortabilityDetailResponse.status, 200, 'trust portability detail route failed');
+    assert.strictEqual(trustPortabilityDetailResponse.json.profile.profile_id, 'agent_identity_portability', 'trust portability detail profile missing');
+
     const providerLaneResponse = await getJson(baseUrl, '/v1/providers');
     assert.strictEqual(providerLaneResponse.status, 200, 'provider lane route failed');
     assert.strictEqual(providerLaneResponse.json.product, 'xoonya', 'provider lane product missing');
@@ -191,6 +207,16 @@ async function main() {
     assert.strictEqual(proofBridgeLaneSummaryResponse.json.product, 'xoonya', 'proof bridge lane summary product missing');
     assert.strictEqual(proofBridgeLaneSummaryResponse.json.first_run_flow_count >= 2, true, 'proof bridge lane summary flow count missing');
 
+    const verificationServicesResponse = await getJson(baseUrl, '/v1/proof-center/verification-services');
+    assert.strictEqual(verificationServicesResponse.status, 200, 'verification services route failed');
+    assert.strictEqual(verificationServicesResponse.json.category, 'xoonya-verification-services-pack', 'verification services category missing');
+    assert.strictEqual(verificationServicesResponse.json.service_count >= 6, true, 'verification services count missing');
+
+    const verificationServicesSummaryResponse = await getJson(baseUrl, '/v1/proof-center/verification-services/summary');
+    assert.strictEqual(verificationServicesSummaryResponse.status, 200, 'verification services summary route failed');
+    assert.strictEqual(verificationServicesSummaryResponse.json.category, 'xoonya-verification-services-summary', 'verification services summary category missing');
+    assert.strictEqual(verificationServicesSummaryResponse.json.service_count >= 6, true, 'verification services summary count missing');
+
     const externalProofImportResponse = await getJson(baseUrl, '/v1/external-proof-import');
     assert.strictEqual(externalProofImportResponse.status, 200, 'external proof import lane route failed');
     assert.strictEqual(externalProofImportResponse.json.product, 'xoonya', 'external proof import lane product missing');

package/scripts/verify_trust_portability.js

@@ -0,0 +1,56 @@
+"use strict";
+
+const assert = require("assert");
+const { createServer } = require("../server.js");
+
+async function getJson(baseUrl, path) {
+  const response = await fetch(`${baseUrl}${path}`);
+  return {
+    status: response.status,
+    json: await response.json()
+  };
+}
+
+async function main() {
+  const server = createServer();
+  await new Promise((resolve) => server.listen(0, "127.0.0.1", resolve));
+  const address = server.address();
+  const baseUrl = `http://127.0.0.1:${address.port}`;
+
+  try {
+    const pack = await getJson(baseUrl, "/v1/proof-center/trust-portability");
+    assert.strictEqual(pack.status, 200, "trust portability route failed");
+    assert.strictEqual(pack.json.category, "xoonya-trust-portability-pack", "trust portability category mismatch");
+    assert.strictEqual(pack.json.portability_profiles.length >= 4, true, "trust portability profile count mismatch");
+    assert.strictEqual(
+      pack.json.portability_profiles.some((entry) => entry.profile_id === "agent_identity_portability" && entry.callable_surfaces.includes("/v1/identity-interop")),
+      true,
+      "agent identity portability profile missing identity-interop surface"
+    );
+    assert.strictEqual(
+      pack.json.portability_profiles.some((entry) => entry.profile_id === "delivery_history_portability" && entry.supporting_surfaces.includes("/v1/result-package-trust/summary")),
+      true,
+      "delivery history portability profile missing result-package-trust support"
+    );
+
+    const summary = await getJson(baseUrl, "/v1/proof-center/trust-portability/summary");
+    assert.strictEqual(summary.status, 200, "trust portability summary route failed");
+    assert.strictEqual(summary.json.profile_count >= 4, true, "trust portability summary profile count mismatch");
+    assert.strictEqual(summary.json.bounded_live_profile_count >= 4, true, "trust portability bounded-live count mismatch");
+    assert.strictEqual(summary.json.callable_profile_count >= 4, true, "trust portability callable profile count mismatch");
+
+    const detail = await getJson(baseUrl, "/v1/proof-center/trust-portability/agent_identity_portability");
+    assert.strictEqual(detail.status, 200, "trust portability detail route failed");
+    assert.strictEqual(detail.json.profile.profile_id, "agent_identity_portability", "trust portability detail profile mismatch");
+    assert.strictEqual(detail.json.profile.claim_status, "bounded_live", "trust portability detail claim status mismatch");
+  } finally {
+    await new Promise((resolve) => server.close(resolve));
+  }
+
+  console.log("xoonya verify:trust-portability passed");
+}
+
+main().catch((error) => {
+  console.error(error);
+  process.exit(1);
+});

package/scripts/verify_verification_services.js

@@ -0,0 +1,56 @@
+"use strict";
+
+const assert = require("assert");
+const { createServer } = require("../server.js");
+
+async function getJson(baseUrl, path) {
+  const response = await fetch(`${baseUrl}${path}`);
+  return {
+    status: response.status,
+    json: await response.json()
+  };
+}
+
+async function main() {
+  const server = createServer();
+  await new Promise((resolve) => server.listen(0, "127.0.0.1", resolve));
+  const address = server.address();
+  const baseUrl = `http://127.0.0.1:${address.port}`;
+
+  try {
+    const pack = await getJson(baseUrl, "/v1/proof-center/verification-services");
+    assert.strictEqual(pack.status, 200, "verification services route failed");
+    assert.strictEqual(pack.json.category, "xoonya-verification-services-pack", "verification services category mismatch");
+    assert.strictEqual(pack.json.service_count >= 6, true, "verification services count mismatch");
+    assert.strictEqual(
+      pack.json.verification_services.some((entry) => entry.service_id === "bundle_verify" && entry.callable_surfaces.includes("/v1/proof-bundles/verify")),
+      true,
+      "bundle verify service missing proof-bundles verify surface"
+    );
+    assert.strictEqual(
+      pack.json.verification_services.some((entry) => entry.service_id === "dispute_replay" && entry.callable_surfaces.includes("/v1/proof-center/governance/disputes/case-bundle")),
+      true,
+      "dispute replay service missing case bundle surface"
+    );
+    assert.strictEqual(
+      pack.json.verification_services.some((entry) => entry.service_id === "identity_link_verify" && entry.supporting_surfaces.includes("/v1/identity-interop/summary")),
+      true,
+      "identity-link verification service missing identity interop support"
+    );
+
+    const summary = await getJson(baseUrl, "/v1/proof-center/verification-services/summary");
+    assert.strictEqual(summary.status, 200, "verification services summary route failed");
+    assert.strictEqual(summary.json.service_count >= 6, true, "verification services summary count mismatch");
+    assert.strictEqual(summary.json.live_service_count >= 1, true, "verification services summary live count missing");
+    assert.strictEqual(summary.json.bounded_live_service_count >= 5, true, "verification services summary bounded-live count missing");
+  } finally {
+    await new Promise((resolve) => server.close(resolve));
+  }
+
+  console.log("xoonya verify:verification-services passed");
+}
+
+main().catch((error) => {
+  console.error(error);
+  process.exit(1);
+});

package/server.js

@@ -76,6 +76,15 @@ const {
   buildBridgeIntelligencePack,
   summarizeBridgeIntelligencePack
 } = require('./lib/bridge_intelligence');
+const {
+  buildVerificationServicesPack,
+  summarizeVerificationServicesPack
+} = require('./lib/verification_service_pack');
+const {
+  buildTrustPortabilityPack,
+  getTrustPortabilityProfile,
+  summarizeTrustPortabilityPack
+} = require('./lib/trust_portability_pack');
 const {
   buildOpenApiDocument,
   summarizeOpenApiDocument,
@@ -761,6 +770,32 @@ async function routeRequest(req, res) {
     return;
   }
 
+  if (req.method === 'GET' && url.pathname === '/v1/proof-center/trust-portability') {
+    sendJson(res, 200, buildTrustPortabilityPack());
+    return;
+  }
+
+  if (req.method === 'GET' && url.pathname === '/v1/proof-center/trust-portability/summary') {
+    sendJson(res, 200, summarizeTrustPortabilityPack());
+    return;
+  }
+
+  if (req.method === 'GET' && url.pathname.startsWith('/v1/proof-center/trust-portability/')) {
+    const profileId = url.pathname.slice('/v1/proof-center/trust-portability/'.length);
+    const profile = getTrustPortabilityProfile(profileId);
+    if (!profile) {
+      sendJson(res, 404, { ok: false, error: 'trust_portability_profile_not_found' });
+      return;
+    }
+    sendJson(res, 200, {
+      ok: true,
+      product: 'xoonya',
+      category: 'xoonya-trust-portability-detail',
+      profile
+    });
+    return;
+  }
+
   if (req.method === 'GET' && url.pathname === '/v1/providers') {
     sendJson(res, 200, buildProviderLanePack());
     return;
@@ -2526,6 +2561,16 @@ async function routeRequest(req, res) {
     return;
   }
 
+  if (req.method === 'GET' && url.pathname === '/v1/proof-center/verification-services') {
+    sendJson(res, 200, buildVerificationServicesPack());
+    return;
+  }
+
+  if (req.method === 'GET' && url.pathname === '/v1/proof-center/verification-services/summary') {
+    sendJson(res, 200, summarizeVerificationServicesPack());
+    return;
+  }
+
   if (req.method === 'GET' && url.pathname === '/v1/proof-center/bridge/profile-support') {
     sendJson(res, 200, proofSdk.buildBridgeProfileSupport());
     return;