xoonya 2.14.0 → 3.0.0

package/scripts/verify_native_hybrid_design_gate.js

@@ -1,47 +1,52 @@
 "use strict";
 
 const assert = require("assert");
+const crypto = require("crypto");
 const sdk = require("..");
 
-function buildHybridAttemptBundle() {
+function runNativeHybridVerification() {
+  const readiness = sdk.summarizexoonyaNativeHybridReadinessPack();
+  assert.strictEqual(readiness.status, "implemented", "hybrid readiness must be implemented");
+  assert.strictEqual(readiness.implemented_hybrid_suite_count >= 1, true, "hybrid readiness must expose implemented suites");
+  assert.strictEqual(
+    readiness.current_decision.includes("runtime_supported"),
+    true,
+    "hybrid readiness must describe runtime-supported suites"
+  );
+
   const event = sdk.canonicalizeEvent({
     version: "canonical-event-bundle/v1",
-    domain_id: "hybrid.gate",
+    domain_id: "hybrid.live",
     sequence: "1",
     actor_id: "agent-hybrid",
     adapter_source: "verify_native_hybrid_design_gate",
-    event_type: "native.hybrid.attempt",
+    event_type: "native.hybrid.verify",
     event_hash: "89".repeat(32)
   });
+
+  const classical = crypto.generateKeyPairSync("ed25519");
+  const pq = crypto.generateKeyPairSync("ml-dsa-65");
   const receipt = sdk.emitReceipt(event, {
     agent_identity: "agent-hybrid-signing",
-    algorithm: "xoonya-native-sha256-v1"
-  });
-  return sdk.buildProofBundle({
-    ceb: event,
-    receipt: {
-      ...receipt,
-      algorithm: "xoonya-native-hybrid-v1",
-      signature: "xoonya-native-hybrid-v1:design-gated-placeholder"
-    }
+    algorithm: "xoonya-native-hybrid-v1",
+    identity_ref: "did:xoonya:agent-hybrid-signing",
+    classical_signature_suite: "ed25519",
+    pq_signature_suite: "ml-dsa-65",
+    classical_public_key_pem: classical.publicKey.export({ type: "spki", format: "pem" }),
+    classical_private_key_pem: classical.privateKey.export({ type: "pkcs8", format: "pem" }),
+    pq_public_key_pem: pq.publicKey.export({ type: "spki", format: "pem" }),
+    pq_private_key_pem: pq.privateKey.export({ type: "pkcs8", format: "pem" })
   });
-}
-
-function runNativeHybridDesignGateVerification() {
-  const readiness = sdk.summarizexoonyaNativeHybridReadinessPack();
-  assert.strictEqual(readiness.status, "design_gated", "hybrid readiness must stay design gated");
-  assert.strictEqual(
-    readiness.current_decision.includes("do_not_claim_pqc"),
-    true,
-    "hybrid readiness must forbid premature PQ claims"
-  );
 
-  const verification = sdk.verifyProofBundle(buildHybridAttemptBundle());
-  assert.strictEqual(verification.valid, false, "hybrid method must not verify before validators exist");
+  const verification = sdk.verifyProofBundle(sdk.buildProofBundle({
+    ceb: event,
+    receipt
+  }));
+  assert.strictEqual(verification.valid, true, "hybrid method must verify");
   assert.strictEqual(
-    verification.reason,
-    "native_hybrid_design_gated",
-    "hybrid method must fail with deterministic design-gate reason"
+    verification.verification_state,
+    "verified_native_hybrid_signature",
+    "hybrid method verification state mismatch"
   );
 
   const downgradeEvent = sdk.canonicalizeEvent({
@@ -56,7 +61,7 @@ function runNativeHybridDesignGateVerification() {
   const detachedReceipt = sdk.emitReceipt(downgradeEvent, {
     agent_identity: "agent-hybrid-signing",
     algorithm: "detached-assertion-v1",
-    signature: "xoonya-native-hybrid-v1:attempted-downgrade"
+    signature: receipt.signature
   });
   const downgradeVerification = sdk.verifyProofBundle(sdk.buildProofBundle({
     ceb: downgradeEvent,
@@ -72,18 +77,19 @@ function runNativeHybridDesignGateVerification() {
   return {
     ok: true,
     product: "xoonya",
-    category: "xoonya-native-hybrid-design-gate-verification",
+    category: "xoonya-native-hybrid-verification",
     method: "xoonya-native-hybrid-v1",
     readiness_status: readiness.status,
-    deterministic_reject_reason: verification.reason,
+    implemented_hybrid_suites: readiness.implemented_hybrid_suites,
+    verification_state: verification.verification_state,
     downgrade_reject_reason: downgradeVerification.reason,
-    boundary: "pq_or_hybrid_verification_is_not_claimed_until_real_validators_vectors_and_error_codes_exist"
+    boundary: "registered_runtime_supported_vector_covered_hybrid_suites_may_be_claimed"
   };
 }
 
 function main() {
   const json = process.argv.includes("--json");
-  const summary = runNativeHybridDesignGateVerification();
+  const summary = runNativeHybridVerification();
   if (json) {
     process.stdout.write(`${JSON.stringify(summary, null, 2)}\n`);
     return;
@@ -93,7 +99,7 @@ function main() {
       "xoonya verify:native-hybrid-gate passed",
       `method: ${summary.method}`,
       `readiness: ${summary.readiness_status}`,
-      `deterministic reject: ${summary.deterministic_reject_reason}`,
+      `verification state: ${summary.verification_state}`,
       `downgrade reject: ${summary.downgrade_reject_reason}`
     ].join("\n") + "\n"
   );
@@ -104,5 +110,5 @@ if (require.main === module) {
 }
 
 module.exports = {
-  runNativeHybridDesignGateVerification
+  runNativeHybridVerification
 };

package/scripts/verify_release_candidate.js

@@ -64,9 +64,9 @@ function main() {
   assert.strictEqual(conformanceSummary.conformance_count >= 8, true, "conformance vector count too small");
   assert.strictEqual(conformanceSummary.adversarial_count >= 8, true, "adversarial vector count too small");
   assert.strictEqual(
-    conformanceSummary.adversarial_reasons.includes("native_hybrid_design_gated"),
+    conformanceSummary.adversarial_reasons.includes("native_hybrid_pq_signature_invalid"),
     true,
-    "native hybrid design-gate adversarial reason missing"
+    "native hybrid adversarial reason missing"
   );
   assert.deepStrictEqual(
     conformanceSummary.verification_methods,
@@ -79,6 +79,7 @@ function main() {
       "sd-jwt-vc-v1",
       "signed-envelope-v1",
       "xoonya-native-anchored-v1",
+      "xoonya-native-hybrid-v1",
       "xoonya-native-sha256-v1",
       "xoonya-native-signed-v1"
     ],
@@ -99,7 +100,7 @@ function main() {
   assert.strictEqual(dryRun.files.some((entry) => entry.path === "scripts/verify_reference_python_crypto.js"), true, "npm pack dry-run missing Python crypto reference verifier script");
   assert.strictEqual(dryRun.files.some((entry) => entry.path === "scripts/verify_reference_promotion_gate.js"), true, "npm pack dry-run missing reference promotion gate verifier script");
   assert.strictEqual(dryRun.files.some((entry) => entry.path === "scripts/verify_reference_rust_scaffold.js"), true, "npm pack dry-run missing Rust reference scaffold verifier script");
-  assert.strictEqual(dryRun.files.some((entry) => entry.path === "scripts/verify_native_hybrid_design_gate.js"), true, "npm pack dry-run missing native hybrid design-gate verifier script");
+  assert.strictEqual(dryRun.files.some((entry) => entry.path === "scripts/verify_native_hybrid_design_gate.js"), true, "npm pack dry-run missing native hybrid verifier script");
   assert.strictEqual(dryRun.files.some((entry) => entry.path === "scripts/verify_verification_services.js"), true, "npm pack dry-run missing verification services verifier script");
   assert.strictEqual(dryRun.files.some((entry) => entry.path === "scripts/verify_all.js"), true, "npm pack dry-run missing package verifier script");
   assert.strictEqual(dryRun.files.some((entry) => entry.path === "vectors/conformance-vectors.json"), true, "npm pack dry-run missing conformance vectors");

package/scripts/verify_service.js

@@ -127,6 +127,65 @@ async function main() {
     assert.strictEqual(trustPortabilityDetailResponse.status, 200, 'trust portability detail route failed');
     assert.strictEqual(trustPortabilityDetailResponse.json.profile.profile_id, 'agent_identity_portability', 'trust portability detail profile missing');
 
+    const proofTruthResponse = await getJson(baseUrl, '/v1/proof-truth');
+    assert.strictEqual(proofTruthResponse.status, 200, 'proof truth route failed');
+    assert.strictEqual(proofTruthResponse.json.category, 'xoonya-proof-truth-model', 'proof truth category missing');
+    assert.strictEqual(proofTruthResponse.json.pack_version, 'xoonya-proof-truth-model-v1', 'proof truth version missing');
+    assert.strictEqual(proofTruthResponse.json.canonical_objects.length >= 6, true, 'proof truth object count missing');
+
+    const proofTruthSummaryResponse = await getJson(baseUrl, '/v1/proof-truth/summary');
+    assert.strictEqual(proofTruthSummaryResponse.status, 200, 'proof truth summary route failed');
+    assert.strictEqual(proofTruthSummaryResponse.json.category, 'xoonya-proof-truth-model', 'proof truth summary category missing');
+    assert.strictEqual(proofTruthSummaryResponse.json.pack_version, 'xoonya-proof-truth-model-v1', 'proof truth summary version missing');
+
+    const proofBundleTruthDetailResponse = await getJson(baseUrl, '/v1/proof-truth/proof_bundle');
+    assert.strictEqual(proofBundleTruthDetailResponse.status, 200, 'proof truth proof_bundle detail route failed');
+    assert.strictEqual(proofBundleTruthDetailResponse.json.object.object_id, 'proof_bundle', 'proof truth proof_bundle detail missing');
+
+    const xnyaTruthDetailResponse = await getJson(baseUrl, '/v1/proof-truth/xnya_native_artifact');
+    assert.strictEqual(xnyaTruthDetailResponse.status, 200, 'proof truth xnya detail route failed');
+    assert.strictEqual(xnyaTruthDetailResponse.json.object.object_id, 'xnya_native_artifact', 'proof truth xnya detail missing');
+
+    const defaultPathResponse = await getJson(baseUrl, '/v1/default-path');
+    assert.strictEqual(defaultPathResponse.status, 200, 'default path route failed');
+    assert.strictEqual(defaultPathResponse.json.category, 'xoonya-default-path-model', 'default path category missing');
+    assert.strictEqual(defaultPathResponse.json.pack_version, 'xoonya-default-path-model-v1', 'default path version missing');
+    assert.strictEqual(defaultPathResponse.json.supported_surface_count >= 5, true, 'default path surface count missing');
+
+    const defaultPathSummaryResponse = await getJson(baseUrl, '/v1/default-path/summary');
+    assert.strictEqual(defaultPathSummaryResponse.status, 200, 'default path summary route failed');
+    assert.strictEqual(defaultPathSummaryResponse.json.category, 'xoonya-default-path-model', 'default path summary category missing');
+    assert.strictEqual(defaultPathSummaryResponse.json.pack_version, 'xoonya-default-path-model-v1', 'default path summary version missing');
+    assert.strictEqual(defaultPathSummaryResponse.json.default_path_stage_count, 7, 'default path stage count missing');
+
+    const cliDefaultPathDetailResponse = await getJson(baseUrl, '/v1/default-path/cli_terminal');
+    assert.strictEqual(cliDefaultPathDetailResponse.status, 200, 'cli default path detail route failed');
+    assert.strictEqual(cliDefaultPathDetailResponse.json.surface.surface_id, 'cli_terminal', 'cli default path detail missing');
+
+    const handoffDefaultPathDetailResponse = await getJson(baseUrl, '/v1/default-path/carried_handoff_review');
+    assert.strictEqual(handoffDefaultPathDetailResponse.status, 200, 'carried handoff default path detail route failed');
+    assert.strictEqual(handoffDefaultPathDetailResponse.json.surface.surface_id, 'carried_handoff_review', 'carried handoff default path detail missing');
+
+    const followthroughTruthResponse = await getJson(baseUrl, '/v1/followthrough-truth');
+    assert.strictEqual(followthroughTruthResponse.status, 200, 'followthrough truth route failed');
+    assert.strictEqual(followthroughTruthResponse.json.category, 'xoonya-followthrough-truth-model', 'followthrough truth category missing');
+    assert.strictEqual(followthroughTruthResponse.json.pack_version, 'xoonya-followthrough-truth-model-v1', 'followthrough truth version missing');
+    assert.strictEqual(followthroughTruthResponse.json.profile_count >= 4, true, 'followthrough truth profile count missing');
+
+    const followthroughTruthSummaryResponse = await getJson(baseUrl, '/v1/followthrough-truth/summary');
+    assert.strictEqual(followthroughTruthSummaryResponse.status, 200, 'followthrough truth summary route failed');
+    assert.strictEqual(followthroughTruthSummaryResponse.json.category, 'xoonya-followthrough-truth-model', 'followthrough truth summary category missing');
+    assert.strictEqual(followthroughTruthSummaryResponse.json.pack_version, 'xoonya-followthrough-truth-model-v1', 'followthrough truth summary version missing');
+    assert.strictEqual(followthroughTruthSummaryResponse.json.bounded_live_profile_count >= 3, true, 'followthrough truth bounded live count missing');
+
+    const bridgeFollowthroughDetailResponse = await getJson(baseUrl, '/v1/followthrough-truth/bridge_followthrough');
+    assert.strictEqual(bridgeFollowthroughDetailResponse.status, 200, 'bridge followthrough detail route failed');
+    assert.strictEqual(bridgeFollowthroughDetailResponse.json.profile.profile_id, 'bridge_followthrough', 'bridge followthrough detail missing');
+
+    const governanceFollowthroughDetailResponse = await getJson(baseUrl, '/v1/followthrough-truth/governance_followthrough');
+    assert.strictEqual(governanceFollowthroughDetailResponse.status, 200, 'governance followthrough detail route failed');
+    assert.strictEqual(governanceFollowthroughDetailResponse.json.profile.profile_id, 'governance_followthrough', 'governance followthrough detail missing');
+
     const providerLaneResponse = await getJson(baseUrl, '/v1/providers');
     assert.strictEqual(providerLaneResponse.status, 200, 'provider lane route failed');
     assert.strictEqual(providerLaneResponse.json.product, 'xoonya', 'provider lane product missing');
@@ -1063,18 +1122,18 @@ async function main() {
     const nativeHybridReadinessResponse = await getJson(baseUrl, '/v1/proof-center/native-hybrid-readiness');
     assert.strictEqual(nativeHybridReadinessResponse.status, 200, 'native hybrid readiness route failed');
     assert.strictEqual(nativeHybridReadinessResponse.json.method, 'xoonya-native-hybrid-v1', 'native hybrid readiness method missing');
-    assert.strictEqual(nativeHybridReadinessResponse.json.status, 'design_gated', 'native hybrid readiness gate missing');
+    assert.strictEqual(nativeHybridReadinessResponse.json.status, 'implemented', 'native hybrid readiness implementation missing');
     assert.strictEqual(nativeHybridReadinessResponse.json.implemented_classical_suites.some((entry) => entry.suite === 'secp256k1'), true, 'native hybrid readiness secp256k1 suite missing');
-    assert.strictEqual(nativeHybridReadinessResponse.json.gated_candidate_suites.some((entry) => entry.suite === 'dilithium'), true, 'native hybrid readiness pq candidate missing');
+    assert.strictEqual(nativeHybridReadinessResponse.json.implemented_hybrid_suites.some((entry) => entry.suite === 'ed25519+ml-dsa-65'), true, 'native hybrid readiness implemented suite missing');
     const nativeHybridReadinessSummaryResponse = await getJson(baseUrl, '/v1/proof-center/native-hybrid-readiness/summary');
     assert.strictEqual(nativeHybridReadinessSummaryResponse.status, 200, 'native hybrid readiness summary route failed');
     assert.strictEqual(nativeHybridReadinessSummaryResponse.json.category, 'xoonya-native-hybrid-readiness-summary', 'native hybrid readiness summary category missing');
-    assert.strictEqual(nativeHybridReadinessSummaryResponse.json.current_decision.includes('do_not_claim_pqc'), true, 'native hybrid readiness summary boundary missing');
+    assert.strictEqual(nativeHybridReadinessSummaryResponse.json.current_decision.includes('runtime_supported'), true, 'native hybrid readiness summary boundary missing');
     const nativeStandardizationResponse = await getJson(baseUrl, '/v1/proof-center/native-standardization');
     assert.strictEqual(nativeStandardizationResponse.status, 200, 'native standardization route failed');
     assert.strictEqual(nativeStandardizationResponse.json.canonical_magic, 'XNYA', 'native standardization magic missing');
     assert.strictEqual(nativeStandardizationResponse.json.conformance_mark_policy.mark, 'XNYA-compatible', 'native standardization mark missing');
-    assert.strictEqual(nativeStandardizationResponse.json.conformance_mark_policy.not_allowed_when.includes('pqc_or_hybrid_support_is_claimed_without_validators_and_vectors'), true, 'native standardization pq boundary missing');
+    assert.strictEqual(nativeStandardizationResponse.json.conformance_mark_policy.not_allowed_when.includes('unregistered_or_runtime_unsupported_pqc_or_hybrid_support_is_claimed'), true, 'native standardization pq boundary missing');
     const nativeStandardizationSummaryResponse = await getJson(baseUrl, '/v1/proof-center/native-standardization/summary');
     assert.strictEqual(nativeStandardizationSummaryResponse.status, 200, 'native standardization summary route failed');
     assert.strictEqual(nativeStandardizationSummaryResponse.json.category, 'xoonya-native-standardization-summary', 'native standardization summary category missing');

package/scripts/verify_vectors.js

@@ -30,7 +30,35 @@ function runVectorVerification() {
     assert.strictEqual(eventCommitment, vector.expected.event_commitment, `${vector.id} event commitment mismatch`);
 
     const receipt = sdk.emitReceipt(vector.event, vector.receipt_options || {});
-    assert.deepStrictEqual(receipt, vector.expected.receipt, `${vector.id} receipt mismatch`);
+    if (vector.expected.receipt.algorithm === "xoonya-native-hybrid-v1") {
+      assert.strictEqual(receipt.version, vector.expected.receipt.version, `${vector.id} hybrid receipt version mismatch`);
+      assert.strictEqual(receipt.receipt_id, vector.expected.receipt.receipt_id, `${vector.id} hybrid receipt id mismatch`);
+      assert.strictEqual(receipt.agent_identity, vector.expected.receipt.agent_identity, `${vector.id} hybrid agent mismatch`);
+      assert.strictEqual(receipt.domain_id, vector.expected.receipt.domain_id, `${vector.id} hybrid domain mismatch`);
+      assert.strictEqual(receipt.sequence, vector.expected.receipt.sequence, `${vector.id} hybrid sequence mismatch`);
+      assert.strictEqual(receipt.event_commitment, vector.expected.receipt.event_commitment, `${vector.id} hybrid event commitment mismatch`);
+      assert.strictEqual(receipt.algorithm, vector.expected.receipt.algorithm, `${vector.id} hybrid algorithm mismatch`);
+      assert.strictEqual(receipt.native_proof.method, vector.expected.receipt.native_proof.method, `${vector.id} hybrid method mismatch`);
+      assert.strictEqual(receipt.native_proof.hybrid_suite, vector.expected.receipt.native_proof.hybrid_suite, `${vector.id} hybrid suite mismatch`);
+      assert.strictEqual(receipt.native_proof.identity_ref, vector.expected.receipt.native_proof.identity_ref, `${vector.id} hybrid identity ref mismatch`);
+      assert.strictEqual(receipt.native_proof.hybrid_public_key_ref, vector.expected.receipt.native_proof.hybrid_public_key_ref, `${vector.id} hybrid public key ref mismatch`);
+      assert.strictEqual(receipt.native_proof.classical_public_key_ref, vector.expected.receipt.native_proof.classical_public_key_ref, `${vector.id} hybrid classical key ref mismatch`);
+      assert.strictEqual(receipt.native_proof.pq_public_key_ref, vector.expected.receipt.native_proof.pq_public_key_ref, `${vector.id} hybrid pq key ref mismatch`);
+      assert.deepStrictEqual(receipt.native_proof.classical_public_key_material, vector.expected.receipt.native_proof.classical_public_key_material, `${vector.id} hybrid classical key material mismatch`);
+      assert.deepStrictEqual(receipt.native_proof.pq_public_key_material, vector.expected.receipt.native_proof.pq_public_key_material, `${vector.id} hybrid pq key material mismatch`);
+      assert.strictEqual(receipt.native_proof.proof_material.signing_material_sha256, vector.expected.receipt.native_proof.proof_material.signing_material_sha256, `${vector.id} hybrid signing material hash mismatch`);
+      assert.strictEqual(typeof receipt.native_proof.proof_material.classical_signature, "string", `${vector.id} hybrid classical signature missing`);
+      assert.strictEqual(receipt.native_proof.proof_material.classical_signature.length > 10, true, `${vector.id} hybrid classical signature too small`);
+      assert.strictEqual(typeof receipt.native_proof.proof_material.pq_signature, "string", `${vector.id} hybrid pq signature missing`);
+      assert.strictEqual(receipt.native_proof.proof_material.pq_signature.length > 100, true, `${vector.id} hybrid pq signature too small`);
+      assert.strictEqual(
+        receipt.signature,
+        `xoonya-native-hybrid-v1:${receipt.native_proof.hybrid_suite}:${receipt.native_proof.proof_material.classical_signature}.${receipt.native_proof.proof_material.pq_signature}`,
+        `${vector.id} hybrid compact signature mismatch`
+      );
+    } else {
+      assert.deepStrictEqual(receipt, vector.expected.receipt, `${vector.id} receipt mismatch`);
+    }
 
     const bundle = sdk.buildProofBundle({
       ceb: vector.event,

package/server.js

@@ -85,6 +85,21 @@ const {
   getTrustPortabilityProfile,
   summarizeTrustPortabilityPack
 } = require('./lib/trust_portability_pack');
+const {
+  buildProofTruthModelPack,
+  summarizeProofTruthModelPack,
+  getProofTruthObjectDetail
+} = require('./lib/proof_truth_contract');
+const {
+  buildDefaultPathPack,
+  summarizeDefaultPathPack,
+  getDefaultPathSurfaceDetail
+} = require('./lib/default_path_contract');
+const {
+  buildFollowthroughTruthPack,
+  summarizeFollowthroughTruthPack,
+  getFollowthroughTruthProfileDetail
+} = require('./lib/followthrough_truth_contract');
 const {
   buildOpenApiDocument,
   summarizeOpenApiDocument,
@@ -796,6 +811,90 @@ async function routeRequest(req, res) {
     return;
   }
 
+  if (req.method === 'GET' && url.pathname === '/v1/proof-truth') {
+    sendJson(res, 200, buildProofTruthModelPack());
+    return;
+  }
+
+  if (req.method === 'GET' && url.pathname === '/v1/proof-truth/summary') {
+    sendJson(res, 200, summarizeProofTruthModelPack());
+    return;
+  }
+
+  if (req.method === 'GET' && url.pathname.startsWith('/v1/proof-truth/')) {
+    const suffix = decodeURIComponent(url.pathname.slice('/v1/proof-truth/'.length));
+    if (suffix && suffix !== 'summary') {
+      const objectDetail = getProofTruthObjectDetail(suffix);
+      if (!objectDetail) {
+        sendJson(res, 404, { ok: false, error: 'proof_truth_object_not_found' });
+        return;
+      }
+      sendJson(res, 200, {
+        ok: true,
+        product: 'xoonya',
+        category: 'xoonya-proof-truth-detail',
+        object: objectDetail
+      });
+      return;
+    }
+  }
+
+  if (req.method === 'GET' && url.pathname === '/v1/default-path') {
+    sendJson(res, 200, buildDefaultPathPack());
+    return;
+  }
+
+  if (req.method === 'GET' && url.pathname === '/v1/default-path/summary') {
+    sendJson(res, 200, summarizeDefaultPathPack());
+    return;
+  }
+
+  if (req.method === 'GET' && url.pathname.startsWith('/v1/default-path/')) {
+    const suffix = decodeURIComponent(url.pathname.slice('/v1/default-path/'.length));
+    if (suffix && suffix !== 'summary') {
+      const surface = getDefaultPathSurfaceDetail(suffix);
+      if (!surface) {
+        sendJson(res, 404, { ok: false, error: 'default_path_surface_not_found' });
+        return;
+      }
+      sendJson(res, 200, {
+        ok: true,
+        product: 'xoonya',
+        category: 'xoonya-default-path-surface-detail',
+        surface
+      });
+      return;
+    }
+  }
+
+  if (req.method === 'GET' && url.pathname === '/v1/followthrough-truth') {
+    sendJson(res, 200, buildFollowthroughTruthPack());
+    return;
+  }
+
+  if (req.method === 'GET' && url.pathname === '/v1/followthrough-truth/summary') {
+    sendJson(res, 200, summarizeFollowthroughTruthPack());
+    return;
+  }
+
+  if (req.method === 'GET' && url.pathname.startsWith('/v1/followthrough-truth/')) {
+    const suffix = decodeURIComponent(url.pathname.slice('/v1/followthrough-truth/'.length));
+    if (suffix && suffix !== 'summary') {
+      const profile = getFollowthroughTruthProfileDetail(suffix);
+      if (!profile) {
+        sendJson(res, 404, { ok: false, error: 'followthrough_truth_profile_not_found' });
+        return;
+      }
+      sendJson(res, 200, {
+        ok: true,
+        product: 'xoonya',
+        category: 'xoonya-followthrough-truth-profile-detail',
+        profile
+      });
+      return;
+    }
+  }
+
   if (req.method === 'GET' && url.pathname === '/v1/providers') {
     sendJson(res, 200, buildProviderLanePack());
     return;

package/vectors/adversarial-vectors.json

@@ -159,33 +159,6 @@
       },
       "expected_reason": "verification_method_unsupported"
     },
-    {
-      "id": "reject-native-hybrid-design-gated",
-      "kind": "verify_bundle_reason",
-      "bundle": {
-        "version": "proof-bundle/v1",
-        "ceb": {
-          "version": "canonical-event-bundle/v1",
-          "domain_id": "vectors.native",
-          "sequence": "7",
-          "actor_id": "agent-native",
-          "adapter_source": "vector-suite",
-          "event_type": "native.event",
-          "event_hash": "3434343434343434343434343434343434343434343434343434343434343434"
-        },
-        "receipt": {
-          "version": "receipt/v1",
-          "receipt_id": "7c4930d56110f0b9623f79025c7be4789e0c0a6155b2645b243ce4c126f53e96",
-          "agent_identity": "agent-native-signing",
-          "domain_id": "vectors.native",
-          "sequence": "7",
-          "event_commitment": "7361278f20b4d6c6f305ebfb490989b0faa3928823954d1852a7d7e78d92d8cd",
-          "algorithm": "xoonya-native-hybrid-v1",
-          "signature": "xoonya-native-hybrid-v1:design-gated-placeholder"
-        }
-      },
-      "expected_reason": "native_hybrid_design_gated"
-    },
     {
       "id": "reject-replayed-receipt-sequence",
       "kind": "verify_bundle_reason",
@@ -267,6 +240,102 @@
       },
       "expected_reason": "signature_method_mismatch"
     },
+    {
+      "id": "reject-native-hybrid-pq-signature-tamper",
+      "kind": "verify_bundle_reason",
+      "bundle": {
+        "version": "proof-bundle/v1",
+        "ceb": {
+          "version": "canonical-event-bundle/v1",
+          "domain_id": "vectors.native.hybrid",
+          "sequence": "11",
+          "actor_id": "agent-native-hybrid",
+          "adapter_source": "vector-suite",
+          "event_type": "native.hybrid.event",
+          "event_hash": "7878787878787878787878787878787878787878787878787878787878787878"
+        },
+        "receipt": {
+          "version": "receipt/v1",
+          "receipt_id": "e425569c2d6ff3768ad2f6026e53ac30b35bc763cccfbbd39eb1a89bded363c9",
+          "agent_identity": "agent-native-hybrid-key",
+          "domain_id": "vectors.native.hybrid",
+          "sequence": "11",
+          "event_commitment": "038909c465d532f536bf2224a3fe18db46ad1672b1cf7df152dd5586354e6a1e",
+          "algorithm": "xoonya-native-hybrid-v1",
+          "native_proof": {
+            "method": "xoonya-native-hybrid-v1",
+            "hybrid_suite": "ed25519+ml-dsa-65",
+            "identity_ref": "did:xoonya:agent-native-hybrid-key",
+            "hybrid_public_key_ref": "ed25519+ml-dsa-65-hybrid-spki-sha256:625b3dcdc278dbeebf2933dffe10f045dd7e0d4c26ec028ed45df967cd4783b6",
+            "classical_public_key_ref": "ed25519-spki-sha256:cfe0edcaec323648d600ef93820a9a185c01fa6b5dc981572a2a2c8aa3e89447",
+            "pq_public_key_ref": "ml-dsa-65-spki-sha256:15912c8aef9ca907bc700af72aed43a5a5401aa19ecf03ac3ce1c0f6d2563a54",
+            "classical_public_key_material": {
+              "format": "spki-pem",
+              "value": "-----BEGIN PUBLIC KEY-----\nMCowBQYDK2VwAyEASl0Xu0vZRLgFIrdzXoH8L2EX3VlMFHwlrz3xWqsz09k=\n-----END PUBLIC KEY-----\n"
+            },
+            "pq_public_key_material": {
+              "format": "spki-pem",
+              "value": "-----BEGIN PUBLIC KEY-----\nMIIHsjALBglghkgBZQMEAxIDggehAAnYgQm/zwBQsoTcuK+PgsdixhoNr9ghxMHT\n8x9GBr88dzxvXtKgAfeaOgAQ+Nh/mkWlt3R5rTqgBvGtr9eaMVaEiILjgw8b2SAM\nuk7Naa1Btheta3e2oMysxPQWxyynMPv1DLLorcRBaUklZDxv+ZyHCbhJh91rBtwy\n81RiVMuXvT3lDZld+HsgAX/q5ZJLZ0Qna91ykMaZ/erDnbc3aoJCC7aCZOgOxkqY\naWDskTKn7XMujweeSlZ8xg7cvytTWFwmJV1yTploQo7WCSv857lR4PCbZcoUdySg\nGloNm0wJGYE2FhR4G0ozVWRab3g4VnbtELcPw04lpgq8kC5ZowaxaQiY2raEc3EU\n/ZVxvEGXqJWVNWRzHZTt1IRq/1QwRbeiAp3Q+Ff8G9i9Ut8c39knI9KF0865eJ6q\nG8v6zXp/wy/IhAXinBxxk8n9YmUaM9Ia7vqMI3ZjggGc34n2hWK+IUOCnVv1mHuP\n/e3DnARbp7+ZyEsPa25nJ5260JfhBAZKXN93EK4d5eY26M9omMwt+ih0PXt1O7X0\nwSiR9JJ8CPTPDmfe8qln4OwZUEEfBAS69MU+3yLwZDJd06ZXc0Vk82zfM2rasDQX\nOAaAcarqyGyeszDAht1SK0/Zfm4hutmRDczjP3Ug3OM+ycqmLfcjlOAVAo4khrWa\nZaDiKkRFRFzWqgqqFmMIyclrinkiVikrXNVG64XwbR/Hytqfi4mPKJU3dJUCcpUR\nUW7Hf3qcjcpou01kw+/4AUU8yUA0pRPYY/A9d8hlo0f5S1Xih/PpLj5sVNN5GTy5\nL9IwoWUPWi44a+2IuMdAoAsUdBQ0pZtkXk85SSqyqZuEpsbUp8wQz3qPjpd85wjv\n5wobvsfIzZbzStOn7oJX/dMsy3NjCLMS5pwflnudNpX9cVyI3Idd6mxyKC6lqNac\njv1B4h4bw9Py4t91x4kJuu6YOH6J0CKTUIFG7ROseZINsVxPBczz0WlZv4ksBhfe\nEAUFarWDBhDyV7q3K6CDXWaDDZ71VvS5P3WdKX0nBOnWuQydb5pBQyOaORNhM9fF\njx2mntGZZ7xeElHleYNZej/sAaBTtxhDpgv2iAnTB1H8tkjRAX9kJfyDHVlue19P\nTPGGeZGT3zgbDudSZ6IiNhDkGnXpGQvn3mSzMGFKdAyuNqOOB75vMacGREK8DE6m\nUx/P+fS0H/U49+rGrq9SkJLUzSbP9lpFhtNfh5FTKDFnIISiVihEoBVdAt2H3pk6\nMozj8c1OlyhpL43jLw2rnGE11S0u4FkDZllQqhFzyT8hVghEy/VGU9UWT3w6Yngz\nS1ee9YJIhq2JZhvrBSy0uh2Bc9DA4Xrb3d4yu81cFHDE0ITyFpYKA34kHwXaoIIb\n3CpVeJyJvKkr0B7gLaVZEZW2q7qBlhyMcK/y1BtssheteapjlcixJ76138N16sE2\niiGLk4Qk8JHtr/6PIz0sz5ZK3JaNusm/XVnhHPS/yySUJ/ApQYUbq2tVPf86+sI5\nQIaZTMFLkc6t2hv2M/vDenOwonZ5fA17yTZNMBnImy+NYehAYllWlEW/x9ijzmAF\nyo9d4CEVBLsdBnc1+0bmnKk8flobgiAcAnUjCuCSEdHWLLGJVgw7GgHkMOj4dTMA\nhDHEQtAT3ELM+RWmsvZjmeJ5/+jDxMkqUFDV4LWNZ2gaJl3X6ydpBaXCE2NRGfeG\nDIK8eM/XvAUClBY13YGx72KDYGa7vgEkNZMK3SqyzCo6aTk/L/ExHcCGQnV82qL8\nMzDSVRHbB3tOnr3v9oQ0lsr9n4Ebze+uyMASRisZAT8Stclunzj41YyDA6Ody1Y1\n2PP/2TqlAeodboaRLbmrnZO0fNbLSQdZIg9JLoLRRhJyOjGPZ2COUE3Q4sHzcI33\nls+MhqrSFWi19eJvjvfmKB9tYLdzHwXosrZyOEuXeL+kU1NvV6IY3P40Z0cFfb8p\nSKGqpDB2LvUbOG8pYa9+hd8oW/K/O75Qe/wuaauTU6SUT4640CR2v6SH52K410Nu\nNc+jDYDKwssqbtk9RFug7W9jUHYb7ncdJ7maldKqNrhDZhmOnfg4H/01mFRSKMMS\nsEzsB/Le9WddRm7KpiPAsZuK/dv8zkkB7gASGLo5/bTvRF+DRn9HTy+CIdE4iGjQ\n6PjoxadNtp/2ONAfS/FlvX5gGaEP9dSJBY6GQUsCmSfaip+/7ze3xu8VfocmVKpV\nuyRN5McTI2lNzEGTwksqY+PiS1YjH2SdojQKQIsEO4SQh3qzec4N2GOIuMmYxPaK\noKpkusiV8ObbwRFXplp3vRQxgh8vKiWduoUbyzo5ARMliby42z8UVBGGzn0XF9Ez\nxlqiuqp30YD+x8pkwvHIkCQDk9ICm5476+hkGmt4ttpkwa5HMLiM9WnSEp44BhYl\noa3ApHYnyXC/qqeld+QN8ALa1oWTXGYdE16lOVWkfe8fP6QqlKYSTfQ09s0diZEN\nn+D19CXKhXI37HGgMs6Z/YF0GrK22lVWc8daHLaEi3n/9UTMrSi1HCgzx/omi16L\n9Yf/BRnACHoNly2D5zAj2gQqPeHzdkp8sOqkcZv8tGhuyqvSOa740RAb8xoHX7/X\nthoRK7+z\n-----END PUBLIC KEY-----\n"
+            },
+            "proof_material": {
+              "signing_material_sha256": "90428e067086cba5d076f0ae420a48f13177c2927dfa5f7c8e70d18bcdaad9d8",
+              "classical_signature": "ubSwFZ8wt4iLHEhMsMJ2YB6HVAmVAI25KEyoFbSmQNRcpnI7Gz5H9GwusneInS7M5WjaM5cVK1fa-sptFL9aDw",
+              "pq_signature": "ApCw-CfAbAiF4czyils2cjdyVMqRaNbYls9vp3VeT1D2vUOIC06KtCQRGXy7pjYtGnUjLxCpwmGu1sJJq3a6SDBV-S-bEoG3KW9VdMWWzIuqWdD25jMwfP8LcZxd5zKyB7uarExTc0zn7eHy4j7jQtKa9VuzT9RCxnvyH9OcFwn1TKTJfjXax0Wk4CUtqi1CviGmYlh2VZlBf5E7NcRzQbP5UueAc6pT9OuRMjtHp8zyC_lw6ufL9sjJ1KSVEfGUzEigeNHebgb910d-LChnTSqoleNpjjLC7qGfdHcmcbk8VyuufbCeFxcHGjPfwkqDcchnI3QU_zUjgwsr0xZNu12pGVPunm39HfC6Hd0-VTPR4c0NK7XFylg5TgfsFe_pj0a3X_aWKjkyPOgsvOihQY6AVs7z_qQpfeKXQiCmw83HmhaHUyinUHIKnirNxl7ZkI5QmlB2RG6SB_4Ks5E9ETQArRPeq-Erhe4sEQBBSowJLi5vXYuMsjKT1oLdfTsvxnkjHXZyIg4DOgpEFTUDWAROqzzk6Rn7MKTIEA1Fj_g13nn0dkZsAGwPanky2j7pERejxCjcIKNuFsym0eZ_tJxArUakg-FUz0pMxo2W-kMxcG3Afc6w_dgd5dpoJpDAr6-Wrp10poxyFRi-Yi-HvyVT84uTgKRtPJN5xFUB0lL1C4C-dPuHkSUvQ1VARsbiVZX3o_m5ebBGivi7F8f5ZQmm_FJOH2jrwjNVE_kIBqtq-ecnwN5tns2aSxWeZ1uEaKyoQOjp52Bwo0Vh90gzmy_arJGJkMZq-krgrRIz6dOdR7s6s0_URDbjHBDkbmCcptU0FPTRrtiHdB6WeRUUKzyUrJOD7x437jd4pbckYXA92N08hDfuf9Y5VsaAVQfbKlT8zki6xIdap-E4RPrc8zwZ2VlXX1NlUHignIIzlnwlt90-D3D8xPn697zNuwGeNomMoMSRmhPs7wNw1TtL6Z6j8cclw56KHQT0ndFe5uiBnwApwHqKMjNIVkq6T21IzwgxUaR2h-LUQ06IgjUTvi9I2LbRYF4wJ2WAr-INXxDMmPhDg4oTJxvEaz4CTaJ0kCKEJ8GKxB6_ublEOzkUKxm7hXbmaVoM9nt7E04lDDj8oimredDB2Ye7trnC6rfb3KsofAjf02jkViE7bv_ZZ9-TW5H7pqmHaq1iOc8pJV_icFDKw8t5F5VO1Kf-BpPGE01QJ_tf9hXyIgRlw4kcmyhIQs558Laq9BOB1_itsbY8L0VTQd8aOH-a3X9utC4MXqHplL1BXjfooXBw5Daep54LA8cJwqrwOb15lj-2RUpiBDBu1mXX8kGP0Bf2SnYBrM7HDALZZOPDFGV8a343gEVJJXKOYuRgdLs0Dit4uVShmvahO0CyItPAMOEGBX5u89xEMpSdWpw2b1VkRiGeKdw7_kkWFUMHL7crC29IAD4IGkOMQc6K8QYL4etD6tE7yC6td4rwYAx4C4ZwcWFk1rPjFUr8i08aFQcR4JtK8zXJXuqcjpebIkoldMf_nZn7rwifMiSdMjNVBzo7XtoU3Be8H2Z3UzCNVOj_yeB5xfoY2ptlCqov7BF5Xmiquv6hHlvgwnnUQqTqeqOZiJVNMK-5_q4qllIjACycpxO4e2CXq355wUpUw_kqxiHn1VLox6z05LW7EELRn6soh7FCCKgFUo86_b05XM2XFqmkwYyAsbRuN2d95syRstwwCdHBNrzquMP4a-0hzAMJ5pcIJlY7ucI0URGcPvsYZt0K94LEmFZ1ZmlG-6uBNOrteQaNCsia-4ST53Utsddtwwz7Aec5JMqrcQQg6PvwP9Y_96nGUt3zFGxiSQb4iDJd0X-vqsM3HP6IYNA6Vkual0Gcf8pggM_rxjdUdC8aQfjEeCQHR7hYTt547EyP2djTdSKg9MvDYdtOdvyb-S_rjgSXnWBi-8l3y5rq6ZSm9fd2aHLq3YAshMzstDpuoxxSqWbVWixn8KrBAYbTizbV_6S7MaABan4_ProkQ9VDzkeNWtfxoRKY5eyji9V1LfCpGbSs6ZrR0XUzOXdFTJhnEIN3jYMDJyBGzPKzt3SGEJ9O9ClkE36feKFUUZVXaya7mN39e98NNBPjeC2ky8n7cms_uc6FGReu_uD6X44bI05bc17_HQNSHN4EkwNeGfrrwSdAvZ6jl3FOEsKOxkJua4qnejl8WSe0B6AMLrr9DsLxZeEFKQoKDe706L5nZUqEB06SpRT5gwrrNy3236e-mRMGO3MpBiiepFU22yKRWLFz_lUk_KIdFyECWhey8j7yL9EC85gS3-ZMWRVoADq7weKCu30CHIEvv7q3kJ0H_8r9V9wuNgRUlmkOiiUubuQxDASOgp7nxPh2GRNccufqAkls8gwPBwjAsdERtFlT0PWWiGNHkm1bn78DG5_Ld02a9wW6kjusJ84qia0Wtv1aeZ9KL6xDJ8tyMkLjyOXG0tXRmsJkPw7HhJA-9bBUQe6eihip0GH9nYCS5ns10WKv7jbCZ8PMLggYtKo4EaiAqzff0XA8Po83ms_yFRXV0tCsEo51Ls2hBaI31XSS8ldzEcZOMgyM2kqGAuSZD1IBbnnMQSGNq03lwZLPaMyEJ_w4-nr_ENBMACn1h9DP3iBaYQOaK_jVhCjRTlcIev7vN4xXUSZ7_Pd0U6T7VOqnDBxoxPRkzakTQ71KzKG2KgcMHtQ3PhkUbSnZj-xAFVo7jKjS4ozN_vGf9lME1W1-xLhxcLjqBwrh3rVrjqAu7p-HWf2tDDB0o8LUmku3xR6_jMLakILpohKIlIrDcvJcQqH6AM2fRTUuNicj76MSP9S0GD2wnExy0xWVZ6u3_gfWj7Wmoxsv4wrf8u_uUramydyN-BIhti6EM-2MUkZVjlwCPlb6mhECWY0pQCUcy-EjjSMUcGe5CiQe2S42AtHiuTzEdMhrSZVoi8wK2m7V-t6X5aTLP7vZO-ORasWswspeI3-BQ2N08zdnTSvBGUgwjRXb-86LBOTPv_DoIj2bYKxuGJNzu0S_ctlFHKI_FmtAJ_AyxQwVw7_ZojTtuFaQCPAYsbPYQv5qCBx8LRz7EJCpYz2oicBz_1Wof5ecB_sLXZjvR4k68RHVhkeliR0bbBR7tWQmd5A8m3oOwOoY8V3Rme0yP6XPm22mLa1e8G0qf0-XAI421E0bjQq6V31LotZWR8uBmvES1g7lSHKjO27kd35UeCR_rBty-0-PQ93y_UyVhZIvE4Ywu2NvfrXyNqe--euyi4RkxJsM6IEha86C2WEipT-UP7i3dnG-1P8T0WoYT5SNQgX2Yt62v8_M-OoVVNufueZHTlDTQLa1zSRLQMfL5KDkfpIVTKNB2_qTme4MQ5iZlCMQjb5xU_1e1HFW2SXPnX9MyqQlS6lDJz5HSIv2u5g2RW2QkVPsWkwpJAZla4wf0s0_DfQJ4uGNoK2Hj6pWUW9QfupO23fEfyLT8bi_2jgaylcT9o9kVuZLEwEfTiTtwojPpiz_7DHW-Un3QhCgEiFfN0hHgfIpadQlmnLXhB6k8Zuo7jn4c2_tu-XJ7wdUo701S9t9WM4kmBb_olHr6wM1Q1w3j-YyjC86bGD0EKWytync0tgVZNZZtCrqy_POVKww1-n5PSRdSfIJdyH_X8aFoXKACdfzRv6Oi24t226sPHMfF6VyJFsWAhbD83NpOCS6GWpYx948eSxkMFvS350Ky3QjhTv9rkf15akcm0BVx9YTQNNVCaooh8vlPYwVgUefEDARAl7T16hqO-gL9k5hDcz-Ff3KPsbOmiCPcGuyFP4HV-1f63t-ARD0nyCFhCNQOugEgAQ6iyc9n0u6MoTI1W90AQ-ISS9lNZgtrH8i7pLlDUYdRKeHfuj5aT-ZMT5xYi3e-tCg4AirknGUoRDXiKPopQvs2uII1VrRWSJNQiJZVDYRR725X8V-T1CR3xHaXyoQweGWx-T8o4dr_dZM0mmlhQBGI_wP71xThxTPYET1sCaLXdezFT7OoRRNtr4jV9JuD8pb2A2w9fs2mM-eKsSb7h7rqZ0rCP_voUZTBQ_BOvmGp9b6Y5_BxVDj7LqqcpN8Lw1FZrTtYgjR0tHmtWajYBp88Qmic1s9boD1B4zisr-12bQYzzzvXTdi1ju3PICH1wpfQgVsmF9v0DlvCyQP0XntmDshNIt9rwAIvXV1a1X5JCqyFBvt5w36af7j6DlaszayJ3P1Bd4zQ61OGc2XSuvFyWu6mYhn78OlZbaK-Q-aniqnnC_6A8Iz8YB-aCVUDmQ9-1YWpQm6r4EDd4i5T1d9xRC46d-PwxwbXYK0mpQHDI-SCQmSzHdDaW6crMUPqKziCT128yBTcZCotr3cAg8gOFFVfe8TTE1SaKnB7gAAAAAAAAAAAAAAAAAAAAAABgoOFh4m"
+            }
+          },
+          "signature": "xoonya-native-hybrid-v1:ed25519+ml-dsa-65:ubSwFZ8wt4iLHEhMsMJ2YB6HVAmVAI25KEyoFbSmQNRcpnI7Gz5H9GwusneInS7M5WjaM5cVK1fa-sptFL9aDw.ApCw-CfAbAiF4czyils2cjdyVMqRaNbYls9vp3VeT1D2vUOIC06KtCQRGXy7pjYtGnUjLxCpwmGu1sJJq3a6SDBV-S-bEoG3KW9VdMWWzIuqWdD25jMwfP8LcZxd5zKyB7uarExTc0zn7eHy4j7jQtKa9VuzT9RCxnvyH9OcFwn1TKTJfjXax0Wk4CUtqi1CviGmYlh2VZlBf5E7NcRzQbP5UueAc6pT9OuRMjtHp8zyC_lw6ufL9sjJ1KSVEfGUzEigeNHebgb910d-LChnTSqoleNpjjLC7qGfdHcmcbk8VyuufbCeFxcHGjPfwkqDcchnI3QU_zUjgwsr0xZNu12pGVPunm39HfC6Hd0-VTPR4c0NK7XFylg5TgfsFe_pj0a3X_aWKjkyPOgsvOihQY6AVs7z_qQpfeKXQiCmw83HmhaHUyinUHIKnirNxl7ZkI5QmlB2RG6SB_4Ks5E9ETQArRPeq-Erhe4sEQBBSowJLi5vXYuMsjKT1oLdfTsvxnkjHXZyIg4DOgpEFTUDWAROqzzk6Rn7MKTIEA1Fj_g13nn0dkZsAGwPanky2j7pERejxCjcIKNuFsym0eZ_tJxArUakg-FUz0pMxo2W-kMxcG3Afc6w_dgd5dpoJpDAr6-Wrp10poxyFRi-Yi-HvyVT84uTgKRtPJN5xFUB0lL1C4C-dPuHkSUvQ1VARsbiVZX3o_m5ebBGivi7F8f5ZQmm_FJOH2jrwjNVE_kIBqtq-ecnwN5tns2aSxWeZ1uEaKyoQOjp52Bwo0Vh90gzmy_arJGJkMZq-krgrRIz6dOdR7s6s0_URDbjHBDkbmCcptU0FPTRrtiHdB6WeRUUKzyUrJOD7x437jd4pbckYXA92N08hDfuf9Y5VsaAVQfbKlT8zki6xIdap-E4RPrc8zwZ2VlXX1NlUHignIIzlnwlt90-D3D8xPn697zNuwGeNomMoMSRmhPs7wNw1TtL6Z6j8cclw56KHQT0ndFe5uiBnwApwHqKMjNIVkq6T21IzwgxUaR2h-LUQ06IgjUTvi9I2LbRYF4wJ2WAr-INXxDMmPhDg4oTJxvEaz4CTaJ0kCKEJ8GKxB6_ublEOzkUKxm7hXbmaVoM9nt7E04lDDj8oimredDB2Ye7trnC6rfb3KsofAjf02jkViE7bv_ZZ9-TW5H7pqmHaq1iOc8pJV_icFDKw8t5F5VO1Kf-BpPGE01QJ_tf9hXyIgRlw4kcmyhIQs558Laq9BOB1_itsbY8L0VTQd8aOH-a3X9utC4MXqHplL1BXjfooXBw5Daep54LA8cJwqrwOb15lj-2RUpiBDBu1mXX8kGP0Bf2SnYBrM7HDALZZOPDFGV8a343gEVJJXKOYuRgdLs0Dit4uVShmvahO0CyItPAMOEGBX5u89xEMpSdWpw2b1VkRiGeKdw7_kkWFUMHL7crC29IAD4IGkOMQc6K8QYL4etD6tE7yC6td4rwYAx4C4ZwcWFk1rPjFUr8i08aFQcR4JtK8zXJXuqcjpebIkoldMf_nZn7rwifMiSdMjNVBzo7XtoU3Be8H2Z3UzCNVOj_yeB5xfoY2ptlCqov7BF5Xmiquv6hHlvgwnnUQqTqeqOZiJVNMK-5_q4qllIjACycpxO4e2CXq355wUpUw_kqxiHn1VLox6z05LW7EELRn6soh7FCCKgFUo86_b05XM2XFqmkwYyAsbRuN2d95syRstwwCdHBNrzquMP4a-0hzAMJ5pcIJlY7ucI0URGcPvsYZt0K94LEmFZ1ZmlG-6uBNOrteQaNCsia-4ST53Utsddtwwz7Aec5JMqrcQQg6PvwP9Y_96nGUt3zFGxiSQb4iDJd0X-vqsM3HP6IYNA6Vkual0Gcf8pggM_rxjdUdC8aQfjEeCQHR7hYTt547EyP2djTdSKg9MvDYdtOdvyb-S_rjgSXnWBi-8l3y5rq6ZSm9fd2aHLq3YAshMzstDpuoxxSqWbVWixn8KrBAYbTizbV_6S7MaABan4_ProkQ9VDzkeNWtfxoRKY5eyji9V1LfCpGbSs6ZrR0XUzOXdFTJhnEIN3jYMDJyBGzPKzt3SGEJ9O9ClkE36feKFUUZVXaya7mN39e98NNBPjeC2ky8n7cms_uc6FGReu_uD6X44bI05bc17_HQNSHN4EkwNeGfrrwSdAvZ6jl3FOEsKOxkJua4qnejl8WSe0B6AMLrr9DsLxZeEFKQoKDe706L5nZUqEB06SpRT5gwrrNy3236e-mRMGO3MpBiiepFU22yKRWLFz_lUk_KIdFyECWhey8j7yL9EC85gS3-ZMWRVoADq7weKCu30CHIEvv7q3kJ0H_8r9V9wuNgRUlmkOiiUubuQxDASOgp7nxPh2GRNccufqAkls8gwPBwjAsdERtFlT0PWWiGNHkm1bn78DG5_Ld02a9wW6kjusJ84qia0Wtv1aeZ9KL6xDJ8tyMkLjyOXG0tXRmsJkPw7HhJA-9bBUQe6eihip0GH9nYCS5ns10WKv7jbCZ8PMLggYtKo4EaiAqzff0XA8Po83ms_yFRXV0tCsEo51Ls2hBaI31XSS8ldzEcZOMgyM2kqGAuSZD1IBbnnMQSGNq03lwZLPaMyEJ_w4-nr_ENBMACn1h9DP3iBaYQOaK_jVhCjRTlcIev7vN4xXUSZ7_Pd0U6T7VOqnDBxoxPRkzakTQ71KzKG2KgcMHtQ3PhkUbSnZj-xAFVo7jKjS4ozN_vGf9lME1W1-xLhxcLjqBwrh3rVrjqAu7p-HWf2tDDB0o8LUmku3xR6_jMLakILpohKIlIrDcvJcQqH6AM2fRTUuNicj76MSP9S0GD2wnExy0xWVZ6u3_gfWj7Wmoxsv4wrf8u_uUramydyN-BIhti6EM-2MUkZVjlwCPlb6mhECWY0pQCUcy-EjjSMUcGe5CiQe2S42AtHiuTzEdMhrSZVoi8wK2m7V-t6X5aTLP7vZO-ORasWswspeI3-BQ2N08zdnTSvBGUgwjRXb-86LBOTPv_DoIj2bYKxuGJNzu0S_ctlFHKI_FmtAJ_AyxQwVw7_ZojTtuFaQCPAYsbPYQv5qCBx8LRz7EJCpYz2oicBz_1Wof5ecB_sLXZjvR4k68RHVhkeliR0bbBR7tWQmd5A8m3oOwOoY8V3Rme0yP6XPm22mLa1e8G0qf0-XAI421E0bjQq6V31LotZWR8uBmvES1g7lSHKjO27kd35UeCR_rBty-0-PQ93y_UyVhZIvE4Ywu2NvfrXyNqe--euyi4RkxJsM6IEha86C2WEipT-UP7i3dnG-1P8T0WoYT5SNQgX2Yt62v8_M-OoVVNufueZHTlDTQLa1zSRLQMfL5KDkfpIVTKNB2_qTme4MQ5iZlCMQjb5xU_1e1HFW2SXPnX9MyqQlS6lDJz5HSIv2u5g2RW2QkVPsWkwpJAZla4wf0s0_DfQJ4uGNoK2Hj6pWUW9QfupO23fEfyLT8bi_2jgaylcT9o9kVuZLEwEfTiTtwojPpiz_7DHW-Un3QhCgEiFfN0hHgfIpadQlmnLXhB6k8Zuo7jn4c2_tu-XJ7wdUo701S9t9WM4kmBb_olHr6wM1Q1w3j-YyjC86bGD0EKWytync0tgVZNZZtCrqy_POVKww1-n5PSRdSfIJdyH_X8aFoXKACdfzRv6Oi24t226sPHMfF6VyJFsWAhbD83NpOCS6GWpYx948eSxkMFvS350Ky3QjhTv9rkf15akcm0BVx9YTQNNVCaooh8vlPYwVgUefEDARAl7T16hqO-gL9k5hDcz-Ff3KPsbOmiCPcGuyFP4HV-1f63t-ARD0nyCFhCNQOugEgAQ6iyc9n0u6MoTI1W90AQ-ISS9lNZgtrH8i7pLlDUYdRKeHfuj5aT-ZMT5xYi3e-tCg4AirknGUoRDXiKPopQvs2uII1VrRWSJNQiJZVDYRR725X8V-T1CR3xHaXyoQweGWx-T8o4dr_dZM0mmlhQBGI_wP71xThxTPYET1sCaLXdezFT7OoRRNtr4jV9JuD8pb2A2w9fs2mM-eKsSb7h7rqZ0rCP_voUZTBQ_BOvmGp9b6Y5_BxVDj7LqqcpN8Lw1FZrTtYgjR0tHmtWajYBp88Qmic1s9boD1B4zisr-12bQYzzzvXTdi1ju3PICH1wpfQgVsmF9v0DlvCyQP0XntmDshNIt9rwAIvXV1a1X5JCqyFBvt5w36af7j6DlaszayJ3P1Bd4zQ61OGc2XSuvFyWu6mYhn78OlZbaK-Q-aniqnnC_6A8Iz8YB-aCVUDmQ9-1YWpQm6r4EDd4i5T1d9xRC46d-PwxwbXYK0mpQHDI-SCQmSzHdDaW6crMUPqKziCT128yBTcZCotr3cAg8gOFFVfe8TTE1SaKnB7gAAAAAAAAAAAAAAAAAAAAAABgoOFh4m"
+        }
+      },
+      "expected_reason": "native_hybrid_pq_signature_invalid"
+    },
+    {
+      "id": "reject-native-hybrid-public-key-ref-mismatch",
+      "kind": "verify_bundle_reason",
+      "bundle": {
+        "version": "proof-bundle/v1",
+        "ceb": {
+          "version": "canonical-event-bundle/v1",
+          "domain_id": "vectors.native.hybrid",
+          "sequence": "11",
+          "actor_id": "agent-native-hybrid",
+          "adapter_source": "vector-suite",
+          "event_type": "native.hybrid.event",
+          "event_hash": "7878787878787878787878787878787878787878787878787878787878787878"
+        },
+        "receipt": {
+          "version": "receipt/v1",
+          "receipt_id": "e425569c2d6ff3768ad2f6026e53ac30b35bc763cccfbbd39eb1a89bded363c9",
+          "agent_identity": "agent-native-hybrid-key",
+          "domain_id": "vectors.native.hybrid",
+          "sequence": "11",
+          "event_commitment": "038909c465d532f536bf2224a3fe18db46ad1672b1cf7df152dd5586354e6a1e",
+          "algorithm": "xoonya-native-hybrid-v1",
+          "native_proof": {
+            "method": "xoonya-native-hybrid-v1",
+            "hybrid_suite": "ed25519+ml-dsa-65",
+            "identity_ref": "did:xoonya:agent-native-hybrid-key",
+            "hybrid_public_key_ref": "ed25519+ml-dsa-65-hybrid-spki-sha256:625b3dcdc278dbeebf2933dffe10f045dd7e0d4c26ec028ed45df967cd4783b0",
+            "classical_public_key_ref": "ed25519-spki-sha256:cfe0edcaec323648d600ef93820a9a185c01fa6b5dc981572a2a2c8aa3e89447",
+            "pq_public_key_ref": "ml-dsa-65-spki-sha256:15912c8aef9ca907bc700af72aed43a5a5401aa19ecf03ac3ce1c0f6d2563a54",
+            "classical_public_key_material": {
+              "format": "spki-pem",
+              "value": "-----BEGIN PUBLIC KEY-----\nMCowBQYDK2VwAyEASl0Xu0vZRLgFIrdzXoH8L2EX3VlMFHwlrz3xWqsz09k=\n-----END PUBLIC KEY-----\n"
+            },
+            "pq_public_key_material": {
+              "format": "spki-pem",
+              "value": "-----BEGIN PUBLIC KEY-----\nMIIHsjALBglghkgBZQMEAxIDggehAAnYgQm/zwBQsoTcuK+PgsdixhoNr9ghxMHT\n8x9GBr88dzxvXtKgAfeaOgAQ+Nh/mkWlt3R5rTqgBvGtr9eaMVaEiILjgw8b2SAM\nuk7Naa1Btheta3e2oMysxPQWxyynMPv1DLLorcRBaUklZDxv+ZyHCbhJh91rBtwy\n81RiVMuXvT3lDZld+HsgAX/q5ZJLZ0Qna91ykMaZ/erDnbc3aoJCC7aCZOgOxkqY\naWDskTKn7XMujweeSlZ8xg7cvytTWFwmJV1yTploQo7WCSv857lR4PCbZcoUdySg\nGloNm0wJGYE2FhR4G0ozVWRab3g4VnbtELcPw04lpgq8kC5ZowaxaQiY2raEc3EU\n/ZVxvEGXqJWVNWRzHZTt1IRq/1QwRbeiAp3Q+Ff8G9i9Ut8c39knI9KF0865eJ6q\nG8v6zXp/wy/IhAXinBxxk8n9YmUaM9Ia7vqMI3ZjggGc34n2hWK+IUOCnVv1mHuP\n/e3DnARbp7+ZyEsPa25nJ5260JfhBAZKXN93EK4d5eY26M9omMwt+ih0PXt1O7X0\nwSiR9JJ8CPTPDmfe8qln4OwZUEEfBAS69MU+3yLwZDJd06ZXc0Vk82zfM2rasDQX\nOAaAcarqyGyeszDAht1SK0/Zfm4hutmRDczjP3Ug3OM+ycqmLfcjlOAVAo4khrWa\nZaDiKkRFRFzWqgqqFmMIyclrinkiVikrXNVG64XwbR/Hytqfi4mPKJU3dJUCcpUR\nUW7Hf3qcjcpou01kw+/4AUU8yUA0pRPYY/A9d8hlo0f5S1Xih/PpLj5sVNN5GTy5\nL9IwoWUPWi44a+2IuMdAoAsUdBQ0pZtkXk85SSqyqZuEpsbUp8wQz3qPjpd85wjv\n5wobvsfIzZbzStOn7oJX/dMsy3NjCLMS5pwflnudNpX9cVyI3Idd6mxyKC6lqNac\njv1B4h4bw9Py4t91x4kJuu6YOH6J0CKTUIFG7ROseZINsVxPBczz0WlZv4ksBhfe\nEAUFarWDBhDyV7q3K6CDXWaDDZ71VvS5P3WdKX0nBOnWuQydb5pBQyOaORNhM9fF\njx2mntGZZ7xeElHleYNZej/sAaBTtxhDpgv2iAnTB1H8tkjRAX9kJfyDHVlue19P\nTPGGeZGT3zgbDudSZ6IiNhDkGnXpGQvn3mSzMGFKdAyuNqOOB75vMacGREK8DE6m\nUx/P+fS0H/U49+rGrq9SkJLUzSbP9lpFhtNfh5FTKDFnIISiVihEoBVdAt2H3pk6\nMozj8c1OlyhpL43jLw2rnGE11S0u4FkDZllQqhFzyT8hVghEy/VGU9UWT3w6Yngz\nS1ee9YJIhq2JZhvrBSy0uh2Bc9DA4Xrb3d4yu81cFHDE0ITyFpYKA34kHwXaoIIb\n3CpVeJyJvKkr0B7gLaVZEZW2q7qBlhyMcK/y1BtssheteapjlcixJ76138N16sE2\niiGLk4Qk8JHtr/6PIz0sz5ZK3JaNusm/XVnhHPS/yySUJ/ApQYUbq2tVPf86+sI5\nQIaZTMFLkc6t2hv2M/vDenOwonZ5fA17yTZNMBnImy+NYehAYllWlEW/x9ijzmAF\nyo9d4CEVBLsdBnc1+0bmnKk8flobgiAcAnUjCuCSEdHWLLGJVgw7GgHkMOj4dTMA\nhDHEQtAT3ELM+RWmsvZjmeJ5/+jDxMkqUFDV4LWNZ2gaJl3X6ydpBaXCE2NRGfeG\nDIK8eM/XvAUClBY13YGx72KDYGa7vgEkNZMK3SqyzCo6aTk/L/ExHcCGQnV82qL8\nMzDSVRHbB3tOnr3v9oQ0lsr9n4Ebze+uyMASRisZAT8Stclunzj41YyDA6Ody1Y1\n2PP/2TqlAeodboaRLbmrnZO0fNbLSQdZIg9JLoLRRhJyOjGPZ2COUE3Q4sHzcI33\nls+MhqrSFWi19eJvjvfmKB9tYLdzHwXosrZyOEuXeL+kU1NvV6IY3P40Z0cFfb8p\nSKGqpDB2LvUbOG8pYa9+hd8oW/K/O75Qe/wuaauTU6SUT4640CR2v6SH52K410Nu\nNc+jDYDKwssqbtk9RFug7W9jUHYb7ncdJ7maldKqNrhDZhmOnfg4H/01mFRSKMMS\nsEzsB/Le9WddRm7KpiPAsZuK/dv8zkkB7gASGLo5/bTvRF+DRn9HTy+CIdE4iGjQ\n6PjoxadNtp/2ONAfS/FlvX5gGaEP9dSJBY6GQUsCmSfaip+/7ze3xu8VfocmVKpV\nuyRN5McTI2lNzEGTwksqY+PiS1YjH2SdojQKQIsEO4SQh3qzec4N2GOIuMmYxPaK\noKpkusiV8ObbwRFXplp3vRQxgh8vKiWduoUbyzo5ARMliby42z8UVBGGzn0XF9Ez\nxlqiuqp30YD+x8pkwvHIkCQDk9ICm5476+hkGmt4ttpkwa5HMLiM9WnSEp44BhYl\noa3ApHYnyXC/qqeld+QN8ALa1oWTXGYdE16lOVWkfe8fP6QqlKYSTfQ09s0diZEN\nn+D19CXKhXI37HGgMs6Z/YF0GrK22lVWc8daHLaEi3n/9UTMrSi1HCgzx/omi16L\n9Yf/BRnACHoNly2D5zAj2gQqPeHzdkp8sOqkcZv8tGhuyqvSOa740RAb8xoHX7/X\nthoRK7+z\n-----END PUBLIC KEY-----\n"
+            },
+            "proof_material": {
+              "signing_material_sha256": "90428e067086cba5d076f0ae420a48f13177c2927dfa5f7c8e70d18bcdaad9d8",
+              "classical_signature": "ubSwFZ8wt4iLHEhMsMJ2YB6HVAmVAI25KEyoFbSmQNRcpnI7Gz5H9GwusneInS7M5WjaM5cVK1fa-sptFL9aDw",
+              "pq_signature": "UpCw-CfAbAiF4czyils2cjdyVMqRaNbYls9vp3VeT1D2vUOIC06KtCQRGXy7pjYtGnUjLxCpwmGu1sJJq3a6SDBV-S-bEoG3KW9VdMWWzIuqWdD25jMwfP8LcZxd5zKyB7uarExTc0zn7eHy4j7jQtKa9VuzT9RCxnvyH9OcFwn1TKTJfjXax0Wk4CUtqi1CviGmYlh2VZlBf5E7NcRzQbP5UueAc6pT9OuRMjtHp8zyC_lw6ufL9sjJ1KSVEfGUzEigeNHebgb910d-LChnTSqoleNpjjLC7qGfdHcmcbk8VyuufbCeFxcHGjPfwkqDcchnI3QU_zUjgwsr0xZNu12pGVPunm39HfC6Hd0-VTPR4c0NK7XFylg5TgfsFe_pj0a3X_aWKjkyPOgsvOihQY6AVs7z_qQpfeKXQiCmw83HmhaHUyinUHIKnirNxl7ZkI5QmlB2RG6SB_4Ks5E9ETQArRPeq-Erhe4sEQBBSowJLi5vXYuMsjKT1oLdfTsvxnkjHXZyIg4DOgpEFTUDWAROqzzk6Rn7MKTIEA1Fj_g13nn0dkZsAGwPanky2j7pERejxCjcIKNuFsym0eZ_tJxArUakg-FUz0pMxo2W-kMxcG3Afc6w_dgd5dpoJpDAr6-Wrp10poxyFRi-Yi-HvyVT84uTgKRtPJN5xFUB0lL1C4C-dPuHkSUvQ1VARsbiVZX3o_m5ebBGivi7F8f5ZQmm_FJOH2jrwjNVE_kIBqtq-ecnwN5tns2aSxWeZ1uEaKyoQOjp52Bwo0Vh90gzmy_arJGJkMZq-krgrRIz6dOdR7s6s0_URDbjHBDkbmCcptU0FPTRrtiHdB6WeRUUKzyUrJOD7x437jd4pbckYXA92N08hDfuf9Y5VsaAVQfbKlT8zki6xIdap-E4RPrc8zwZ2VlXX1NlUHignIIzlnwlt90-D3D8xPn697zNuwGeNomMoMSRmhPs7wNw1TtL6Z6j8cclw56KHQT0ndFe5uiBnwApwHqKMjNIVkq6T21IzwgxUaR2h-LUQ06IgjUTvi9I2LbRYF4wJ2WAr-INXxDMmPhDg4oTJxvEaz4CTaJ0kCKEJ8GKxB6_ublEOzkUKxm7hXbmaVoM9nt7E04lDDj8oimredDB2Ye7trnC6rfb3KsofAjf02jkViE7bv_ZZ9-TW5H7pqmHaq1iOc8pJV_icFDKw8t5F5VO1Kf-BpPGE01QJ_tf9hXyIgRlw4kcmyhIQs558Laq9BOB1_itsbY8L0VTQd8aOH-a3X9utC4MXqHplL1BXjfooXBw5Daep54LA8cJwqrwOb15lj-2RUpiBDBu1mXX8kGP0Bf2SnYBrM7HDALZZOPDFGV8a343gEVJJXKOYuRgdLs0Dit4uVShmvahO0CyItPAMOEGBX5u89xEMpSdWpw2b1VkRiGeKdw7_kkWFUMHL7crC29IAD4IGkOMQc6K8QYL4etD6tE7yC6td4rwYAx4C4ZwcWFk1rPjFUr8i08aFQcR4JtK8zXJXuqcjpebIkoldMf_nZn7rwifMiSdMjNVBzo7XtoU3Be8H2Z3UzCNVOj_yeB5xfoY2ptlCqov7BF5Xmiquv6hHlvgwnnUQqTqeqOZiJVNMK-5_q4qllIjACycpxO4e2CXq355wUpUw_kqxiHn1VLox6z05LW7EELRn6soh7FCCKgFUo86_b05XM2XFqmkwYyAsbRuN2d95syRstwwCdHBNrzquMP4a-0hzAMJ5pcIJlY7ucI0URGcPvsYZt0K94LEmFZ1ZmlG-6uBNOrteQaNCsia-4ST53Utsddtwwz7Aec5JMqrcQQg6PvwP9Y_96nGUt3zFGxiSQb4iDJd0X-vqsM3HP6IYNA6Vkual0Gcf8pggM_rxjdUdC8aQfjEeCQHR7hYTt547EyP2djTdSKg9MvDYdtOdvyb-S_rjgSXnWBi-8l3y5rq6ZSm9fd2aHLq3YAshMzstDpuoxxSqWbVWixn8KrBAYbTizbV_6S7MaABan4_ProkQ9VDzkeNWtfxoRKY5eyji9V1LfCpGbSs6ZrR0XUzOXdFTJhnEIN3jYMDJyBGzPKzt3SGEJ9O9ClkE36feKFUUZVXaya7mN39e98NNBPjeC2ky8n7cms_uc6FGReu_uD6X44bI05bc17_HQNSHN4EkwNeGfrrwSdAvZ6jl3FOEsKOxkJua4qnejl8WSe0B6AMLrr9DsLxZeEFKQoKDe706L5nZUqEB06SpRT5gwrrNy3236e-mRMGO3MpBiiepFU22yKRWLFz_lUk_KIdFyECWhey8j7yL9EC85gS3-ZMWRVoADq7weKCu30CHIEvv7q3kJ0H_8r9V9wuNgRUlmkOiiUubuQxDASOgp7nxPh2GRNccufqAkls8gwPBwjAsdERtFlT0PWWiGNHkm1bn78DG5_Ld02a9wW6kjusJ84qia0Wtv1aeZ9KL6xDJ8tyMkLjyOXG0tXRmsJkPw7HhJA-9bBUQe6eihip0GH9nYCS5ns10WKv7jbCZ8PMLggYtKo4EaiAqzff0XA8Po83ms_yFRXV0tCsEo51Ls2hBaI31XSS8ldzEcZOMgyM2kqGAuSZD1IBbnnMQSGNq03lwZLPaMyEJ_w4-nr_ENBMACn1h9DP3iBaYQOaK_jVhCjRTlcIev7vN4xXUSZ7_Pd0U6T7VOqnDBxoxPRkzakTQ71KzKG2KgcMHtQ3PhkUbSnZj-xAFVo7jKjS4ozN_vGf9lME1W1-xLhxcLjqBwrh3rVrjqAu7p-HWf2tDDB0o8LUmku3xR6_jMLakILpohKIlIrDcvJcQqH6AM2fRTUuNicj76MSP9S0GD2wnExy0xWVZ6u3_gfWj7Wmoxsv4wrf8u_uUramydyN-BIhti6EM-2MUkZVjlwCPlb6mhECWY0pQCUcy-EjjSMUcGe5CiQe2S42AtHiuTzEdMhrSZVoi8wK2m7V-t6X5aTLP7vZO-ORasWswspeI3-BQ2N08zdnTSvBGUgwjRXb-86LBOTPv_DoIj2bYKxuGJNzu0S_ctlFHKI_FmtAJ_AyxQwVw7_ZojTtuFaQCPAYsbPYQv5qCBx8LRz7EJCpYz2oicBz_1Wof5ecB_sLXZjvR4k68RHVhkeliR0bbBR7tWQmd5A8m3oOwOoY8V3Rme0yP6XPm22mLa1e8G0qf0-XAI421E0bjQq6V31LotZWR8uBmvES1g7lSHKjO27kd35UeCR_rBty-0-PQ93y_UyVhZIvE4Ywu2NvfrXyNqe--euyi4RkxJsM6IEha86C2WEipT-UP7i3dnG-1P8T0WoYT5SNQgX2Yt62v8_M-OoVVNufueZHTlDTQLa1zSRLQMfL5KDkfpIVTKNB2_qTme4MQ5iZlCMQjb5xU_1e1HFW2SXPnX9MyqQlS6lDJz5HSIv2u5g2RW2QkVPsWkwpJAZla4wf0s0_DfQJ4uGNoK2Hj6pWUW9QfupO23fEfyLT8bi_2jgaylcT9o9kVuZLEwEfTiTtwojPpiz_7DHW-Un3QhCgEiFfN0hHgfIpadQlmnLXhB6k8Zuo7jn4c2_tu-XJ7wdUo701S9t9WM4kmBb_olHr6wM1Q1w3j-YyjC86bGD0EKWytync0tgVZNZZtCrqy_POVKww1-n5PSRdSfIJdyH_X8aFoXKACdfzRv6Oi24t226sPHMfF6VyJFsWAhbD83NpOCS6GWpYx948eSxkMFvS350Ky3QjhTv9rkf15akcm0BVx9YTQNNVCaooh8vlPYwVgUefEDARAl7T16hqO-gL9k5hDcz-Ff3KPsbOmiCPcGuyFP4HV-1f63t-ARD0nyCFhCNQOugEgAQ6iyc9n0u6MoTI1W90AQ-ISS9lNZgtrH8i7pLlDUYdRKeHfuj5aT-ZMT5xYi3e-tCg4AirknGUoRDXiKPopQvs2uII1VrRWSJNQiJZVDYRR725X8V-T1CR3xHaXyoQweGWx-T8o4dr_dZM0mmlhQBGI_wP71xThxTPYET1sCaLXdezFT7OoRRNtr4jV9JuD8pb2A2w9fs2mM-eKsSb7h7rqZ0rCP_voUZTBQ_BOvmGp9b6Y5_BxVDj7LqqcpN8Lw1FZrTtYgjR0tHmtWajYBp88Qmic1s9boD1B4zisr-12bQYzzzvXTdi1ju3PICH1wpfQgVsmF9v0DlvCyQP0XntmDshNIt9rwAIvXV1a1X5JCqyFBvt5w36af7j6DlaszayJ3P1Bd4zQ61OGc2XSuvFyWu6mYhn78OlZbaK-Q-aniqnnC_6A8Iz8YB-aCVUDmQ9-1YWpQm6r4EDd4i5T1d9xRC46d-PwxwbXYK0mpQHDI-SCQmSzHdDaW6crMUPqKziCT128yBTcZCotr3cAg8gOFFVfe8TTE1SaKnB7gAAAAAAAAAAAAAAAAAAAAAABgoOFh4m"
+            }
+          },
+          "signature": "xoonya-native-hybrid-v1:ed25519+ml-dsa-65:ubSwFZ8wt4iLHEhMsMJ2YB6HVAmVAI25KEyoFbSmQNRcpnI7Gz5H9GwusneInS7M5WjaM5cVK1fa-sptFL9aDw.UpCw-CfAbAiF4czyils2cjdyVMqRaNbYls9vp3VeT1D2vUOIC06KtCQRGXy7pjYtGnUjLxCpwmGu1sJJq3a6SDBV-S-bEoG3KW9VdMWWzIuqWdD25jMwfP8LcZxd5zKyB7uarExTc0zn7eHy4j7jQtKa9VuzT9RCxnvyH9OcFwn1TKTJfjXax0Wk4CUtqi1CviGmYlh2VZlBf5E7NcRzQbP5UueAc6pT9OuRMjtHp8zyC_lw6ufL9sjJ1KSVEfGUzEigeNHebgb910d-LChnTSqoleNpjjLC7qGfdHcmcbk8VyuufbCeFxcHGjPfwkqDcchnI3QU_zUjgwsr0xZNu12pGVPunm39HfC6Hd0-VTPR4c0NK7XFylg5TgfsFe_pj0a3X_aWKjkyPOgsvOihQY6AVs7z_qQpfeKXQiCmw83HmhaHUyinUHIKnirNxl7ZkI5QmlB2RG6SB_4Ks5E9ETQArRPeq-Erhe4sEQBBSowJLi5vXYuMsjKT1oLdfTsvxnkjHXZyIg4DOgpEFTUDWAROqzzk6Rn7MKTIEA1Fj_g13nn0dkZsAGwPanky2j7pERejxCjcIKNuFsym0eZ_tJxArUakg-FUz0pMxo2W-kMxcG3Afc6w_dgd5dpoJpDAr6-Wrp10poxyFRi-Yi-HvyVT84uTgKRtPJN5xFUB0lL1C4C-dPuHkSUvQ1VARsbiVZX3o_m5ebBGivi7F8f5ZQmm_FJOH2jrwjNVE_kIBqtq-ecnwN5tns2aSxWeZ1uEaKyoQOjp52Bwo0Vh90gzmy_arJGJkMZq-krgrRIz6dOdR7s6s0_URDbjHBDkbmCcptU0FPTRrtiHdB6WeRUUKzyUrJOD7x437jd4pbckYXA92N08hDfuf9Y5VsaAVQfbKlT8zki6xIdap-E4RPrc8zwZ2VlXX1NlUHignIIzlnwlt90-D3D8xPn697zNuwGeNomMoMSRmhPs7wNw1TtL6Z6j8cclw56KHQT0ndFe5uiBnwApwHqKMjNIVkq6T21IzwgxUaR2h-LUQ06IgjUTvi9I2LbRYF4wJ2WAr-INXxDMmPhDg4oTJxvEaz4CTaJ0kCKEJ8GKxB6_ublEOzkUKxm7hXbmaVoM9nt7E04lDDj8oimredDB2Ye7trnC6rfb3KsofAjf02jkViE7bv_ZZ9-TW5H7pqmHaq1iOc8pJV_icFDKw8t5F5VO1Kf-BpPGE01QJ_tf9hXyIgRlw4kcmyhIQs558Laq9BOB1_itsbY8L0VTQd8aOH-a3X9utC4MXqHplL1BXjfooXBw5Daep54LA8cJwqrwOb15lj-2RUpiBDBu1mXX8kGP0Bf2SnYBrM7HDALZZOPDFGV8a343gEVJJXKOYuRgdLs0Dit4uVShmvahO0CyItPAMOEGBX5u89xEMpSdWpw2b1VkRiGeKdw7_kkWFUMHL7crC29IAD4IGkOMQc6K8QYL4etD6tE7yC6td4rwYAx4C4ZwcWFk1rPjFUr8i08aFQcR4JtK8zXJXuqcjpebIkoldMf_nZn7rwifMiSdMjNVBzo7XtoU3Be8H2Z3UzCNVOj_yeB5xfoY2ptlCqov7BF5Xmiquv6hHlvgwnnUQqTqeqOZiJVNMK-5_q4qllIjACycpxO4e2CXq355wUpUw_kqxiHn1VLox6z05LW7EELRn6soh7FCCKgFUo86_b05XM2XFqmkwYyAsbRuN2d95syRstwwCdHBNrzquMP4a-0hzAMJ5pcIJlY7ucI0URGcPvsYZt0K94LEmFZ1ZmlG-6uBNOrteQaNCsia-4ST53Utsddtwwz7Aec5JMqrcQQg6PvwP9Y_96nGUt3zFGxiSQb4iDJd0X-vqsM3HP6IYNA6Vkual0Gcf8pggM_rxjdUdC8aQfjEeCQHR7hYTt547EyP2djTdSKg9MvDYdtOdvyb-S_rjgSXnWBi-8l3y5rq6ZSm9fd2aHLq3YAshMzstDpuoxxSqWbVWixn8KrBAYbTizbV_6S7MaABan4_ProkQ9VDzkeNWtfxoRKY5eyji9V1LfCpGbSs6ZrR0XUzOXdFTJhnEIN3jYMDJyBGzPKzt3SGEJ9O9ClkE36feKFUUZVXaya7mN39e98NNBPjeC2ky8n7cms_uc6FGReu_uD6X44bI05bc17_HQNSHN4EkwNeGfrrwSdAvZ6jl3FOEsKOxkJua4qnejl8WSe0B6AMLrr9DsLxZeEFKQoKDe706L5nZUqEB06SpRT5gwrrNy3236e-mRMGO3MpBiiepFU22yKRWLFz_lUk_KIdFyECWhey8j7yL9EC85gS3-ZMWRVoADq7weKCu30CHIEvv7q3kJ0H_8r9V9wuNgRUlmkOiiUubuQxDASOgp7nxPh2GRNccufqAkls8gwPBwjAsdERtFlT0PWWiGNHkm1bn78DG5_Ld02a9wW6kjusJ84qia0Wtv1aeZ9KL6xDJ8tyMkLjyOXG0tXRmsJkPw7HhJA-9bBUQe6eihip0GH9nYCS5ns10WKv7jbCZ8PMLggYtKo4EaiAqzff0XA8Po83ms_yFRXV0tCsEo51Ls2hBaI31XSS8ldzEcZOMgyM2kqGAuSZD1IBbnnMQSGNq03lwZLPaMyEJ_w4-nr_ENBMACn1h9DP3iBaYQOaK_jVhCjRTlcIev7vN4xXUSZ7_Pd0U6T7VOqnDBxoxPRkzakTQ71KzKG2KgcMHtQ3PhkUbSnZj-xAFVo7jKjS4ozN_vGf9lME1W1-xLhxcLjqBwrh3rVrjqAu7p-HWf2tDDB0o8LUmku3xR6_jMLakILpohKIlIrDcvJcQqH6AM2fRTUuNicj76MSP9S0GD2wnExy0xWVZ6u3_gfWj7Wmoxsv4wrf8u_uUramydyN-BIhti6EM-2MUkZVjlwCPlb6mhECWY0pQCUcy-EjjSMUcGe5CiQe2S42AtHiuTzEdMhrSZVoi8wK2m7V-t6X5aTLP7vZO-ORasWswspeI3-BQ2N08zdnTSvBGUgwjRXb-86LBOTPv_DoIj2bYKxuGJNzu0S_ctlFHKI_FmtAJ_AyxQwVw7_ZojTtuFaQCPAYsbPYQv5qCBx8LRz7EJCpYz2oicBz_1Wof5ecB_sLXZjvR4k68RHVhkeliR0bbBR7tWQmd5A8m3oOwOoY8V3Rme0yP6XPm22mLa1e8G0qf0-XAI421E0bjQq6V31LotZWR8uBmvES1g7lSHKjO27kd35UeCR_rBty-0-PQ93y_UyVhZIvE4Ywu2NvfrXyNqe--euyi4RkxJsM6IEha86C2WEipT-UP7i3dnG-1P8T0WoYT5SNQgX2Yt62v8_M-OoVVNufueZHTlDTQLa1zSRLQMfL5KDkfpIVTKNB2_qTme4MQ5iZlCMQjb5xU_1e1HFW2SXPnX9MyqQlS6lDJz5HSIv2u5g2RW2QkVPsWkwpJAZla4wf0s0_DfQJ4uGNoK2Hj6pWUW9QfupO23fEfyLT8bi_2jgaylcT9o9kVuZLEwEfTiTtwojPpiz_7DHW-Un3QhCgEiFfN0hHgfIpadQlmnLXhB6k8Zuo7jn4c2_tu-XJ7wdUo701S9t9WM4kmBb_olHr6wM1Q1w3j-YyjC86bGD0EKWytync0tgVZNZZtCrqy_POVKww1-n5PSRdSfIJdyH_X8aFoXKACdfzRv6Oi24t226sPHMfF6VyJFsWAhbD83NpOCS6GWpYx948eSxkMFvS350Ky3QjhTv9rkf15akcm0BVx9YTQNNVCaooh8vlPYwVgUefEDARAl7T16hqO-gL9k5hDcz-Ff3KPsbOmiCPcGuyFP4HV-1f63t-ARD0nyCFhCNQOugEgAQ6iyc9n0u6MoTI1W90AQ-ISS9lNZgtrH8i7pLlDUYdRKeHfuj5aT-ZMT5xYi3e-tCg4AirknGUoRDXiKPopQvs2uII1VrRWSJNQiJZVDYRR725X8V-T1CR3xHaXyoQweGWx-T8o4dr_dZM0mmlhQBGI_wP71xThxTPYET1sCaLXdezFT7OoRRNtr4jV9JuD8pb2A2w9fs2mM-eKsSb7h7rqZ0rCP_voUZTBQ_BOvmGp9b6Y5_BxVDj7LqqcpN8Lw1FZrTtYgjR0tHmtWajYBp88Qmic1s9boD1B4zisr-12bQYzzzvXTdi1ju3PICH1wpfQgVsmF9v0DlvCyQP0XntmDshNIt9rwAIvXV1a1X5JCqyFBvt5w36af7j6DlaszayJ3P1Bd4zQ61OGc2XSuvFyWu6mYhn78OlZbaK-Q-aniqnnC_6A8Iz8YB-aCVUDmQ9-1YWpQm6r4EDd4i5T1d9xRC46d-PwxwbXYK0mpQHDI-SCQmSzHdDaW6crMUPqKziCT128yBTcZCotr3cAg8gOFFVfe8TTE1SaKnB7gAAAAAAAAAAAAAAAAAAAAAABgoOFh4m"
+        }
+      },
+      "expected_reason": "native_hybrid_public_key_ref_mismatch"
+    },
     {
       "id": "reject-native-signed-signature-tamper",
       "kind": "verify_bundle_reason",