xoonya 2.15.0 → 3.0.1

package/proof_sdk.js

@@ -124,13 +124,15 @@ const NATIVE_SIGNATURE_SUITES = Object.freeze({
     id: "ed25519",
     maturity: "implemented",
     public_key_format: "spki-pem",
-    verification_posture: "native_verified"
+    verification_posture: "native_verified",
+    key_type: "ed25519"
   }),
   secp256k1: Object.freeze({
     id: "secp256k1",
     maturity: "implemented",
     public_key_format: "spki-pem",
     verification_posture: "native_verified",
+    key_type: "ec",
     curve: "secp256k1",
     signing_hash: "sha256"
   }),
@@ -139,6 +141,7 @@ const NATIVE_SIGNATURE_SUITES = Object.freeze({
     maturity: "implemented",
     public_key_format: "spki-pem",
     verification_posture: "native_verified",
+    key_type: "ec",
     curve: "prime256v1",
     signing_hash: "sha256"
   }),
@@ -165,6 +168,20 @@ const NATIVE_SIGNATURE_SUITES = Object.freeze({
     maturity: "planned_pqc",
     public_key_format: "suite_defined",
     verification_posture: "registry_declared_not_yet_verified"
+  }),
+  "ml-dsa-65": Object.freeze({
+    id: "ml-dsa-65",
+    maturity: "implemented",
+    public_key_format: "spki-pem",
+    verification_posture: "native_verified",
+    key_type: "ml-dsa-65"
+  }),
+  "slh-dsa-sha2-128f": Object.freeze({
+    id: "slh-dsa-sha2-128f",
+    maturity: "implemented",
+    public_key_format: "spki-pem",
+    verification_posture: "native_verified",
+    key_type: "slh-dsa-sha2-128f"
   })
 });
 const XOONYA_NATIVE_IDENTITY_TYPES = Object.freeze({
@@ -642,6 +659,60 @@ function getNativeSignatureSuite(suiteId) {
   return suite ? { ...suite } : null;
 }
 
+function listImplementedClassicalNativeSignatureSuites() {
+  return listNativeSignatureSuites().filter((suite) => suite.maturity === "implemented" && !suite.id.startsWith("ml-dsa-") && !suite.id.startsWith("slh-dsa-"));
+}
+
+function listImplementedPqNativeSignatureSuites() {
+  return listNativeSignatureSuites().filter((suite) => suite.maturity === "implemented" && (suite.id.startsWith("ml-dsa-") || suite.id.startsWith("slh-dsa-")));
+}
+
+function buildNativeHybridSuiteId(classicalSuiteId, pqSuiteId) {
+  const classicalSuite = getNativeSignatureSuite(classicalSuiteId);
+  if (!classicalSuite || classicalSuite.maturity !== "implemented") {
+    throw new Error("native hybrid classical signature suite not implemented");
+  }
+  if (classicalSuite.id.startsWith("ml-dsa-") || classicalSuite.id.startsWith("slh-dsa-")) {
+    throw new Error("native hybrid classical signature suite must be classical");
+  }
+  const pqSuite = getNativeSignatureSuite(pqSuiteId);
+  if (!pqSuite || pqSuite.maturity !== "implemented") {
+    throw new Error("native hybrid pq signature suite not implemented");
+  }
+  if (!pqSuite.id.startsWith("ml-dsa-") && !pqSuite.id.startsWith("slh-dsa-")) {
+    throw new Error("native hybrid pq signature suite must be pq");
+  }
+  return `${classicalSuite.id}+${pqSuite.id}`;
+}
+
+function parseNativeHybridSuite(hybridSuiteId) {
+  const normalized = normalizeString(hybridSuiteId);
+  const [classicalSuiteId, pqSuiteId, extra] = normalized.split("+");
+  if (!classicalSuiteId || !pqSuiteId || extra) {
+    throw new Error("native hybrid signature suite unsupported");
+  }
+  return {
+    id: buildNativeHybridSuiteId(classicalSuiteId, pqSuiteId),
+    classical_suite: getNativeSignatureSuite(classicalSuiteId),
+    pq_suite: getNativeSignatureSuite(pqSuiteId)
+  };
+}
+
+function listImplementedNativeHybridSuites() {
+  const suites = [];
+  for (const classicalSuite of listImplementedClassicalNativeSignatureSuites()) {
+    for (const pqSuite of listImplementedPqNativeSignatureSuites()) {
+      suites.push({
+        id: buildNativeHybridSuiteId(classicalSuite.id, pqSuite.id),
+        classical_suite: classicalSuite.id,
+        pq_suite: pqSuite.id,
+        posture: "dual_signature_verified"
+      });
+    }
+  }
+  return suites;
+}
+
 function listxoonyaNativeIdentityTypes() {
   return Object.values(XOONYA_NATIVE_IDENTITY_TYPES).map((entry) => ({ ...entry }));
 }
@@ -708,11 +779,21 @@ function nativePublicKeyRefFromPem(publicKeyPem, signatureSuite = "ed25519") {
   return `${suite.id}-spki-sha256:${sha256Hex(der)}`;
 }
 
+function nativeHybridPublicKeyRefFromPems(classicalPublicKeyPem, pqPublicKeyPem, hybridSuiteId) {
+  parseNativeHybridSuite(hybridSuiteId);
+  const classicalDer = crypto.createPublicKey(normalizePublicKeyPem(classicalPublicKeyPem)).export({ type: "spki", format: "der" });
+  const pqDer = crypto.createPublicKey(normalizePublicKeyPem(pqPublicKeyPem)).export({ type: "spki", format: "der" });
+  return `${hybridSuiteId}-hybrid-spki-sha256:${sha256Hex(Buffer.concat([classicalDer, pqDer]))}`;
+}
+
 function nativeSigningHashForSuite(suite) {
   return suite && suite.signing_hash ? suite.signing_hash : null;
 }
 
 function assertNativeKeyMatchesSuite(keyObject, suite, label) {
+  if (suite && suite.key_type && keyObject.asymmetricKeyType !== suite.key_type) {
+    throw new Error(`${label} key type must be ${suite.key_type}`);
+  }
   if (suite && suite.curve) {
     const details = keyObject.asymmetricKeyDetails || {};
     if (details.namedCurve !== suite.curve) {
@@ -779,6 +860,132 @@ function buildNativeSignedReceiptProof(receipt, canonicalEvent, options = {}) {
   };
 }
 
+function buildNativeHybridProofMaterial(receipt, canonicalEvent, proofDescriptor) {
+  return {
+    identity_ref: proofDescriptor.identity_ref,
+    method: XOONYA_NATIVE_HYBRID_METHOD,
+    hybrid_suite: proofDescriptor.hybrid_suite,
+    hybrid_public_key_ref: proofDescriptor.hybrid_public_key_ref,
+    classical_public_key_ref: proofDescriptor.classical_public_key_ref,
+    pq_public_key_ref: proofDescriptor.pq_public_key_ref,
+    receipt_signing_material: buildCanonicalReceiptSigningMaterial(receipt),
+    event_commitment: hashEvent(canonicalEvent),
+    standard_version: XOONYA_NATIVE_PROOF_FORMAT_VERSION
+  };
+}
+
+function runtimeSupportsNativeHybridSuite(hybridSuiteId) {
+  try {
+    const hybridSuite = parseNativeHybridSuite(hybridSuiteId);
+    const classicalPair = hybridSuite.classical_suite.id === "secp256k1"
+      ? crypto.generateKeyPairSync("ec", { namedCurve: "secp256k1" })
+      : hybridSuite.classical_suite.id === "p256"
+        ? crypto.generateKeyPairSync("ec", { namedCurve: "P-256" })
+        : crypto.generateKeyPairSync(hybridSuite.classical_suite.key_type);
+    const pqPair = crypto.generateKeyPairSync(hybridSuite.pq_suite.key_type);
+    const probe = Buffer.from(`xoonya-hybrid-runtime-probe:${hybridSuiteId}`, "utf8");
+    const classicalSignature = crypto.sign(nativeSigningHashForSuite(hybridSuite.classical_suite), probe, classicalPair.privateKey);
+    const pqSignature = crypto.sign(nativeSigningHashForSuite(hybridSuite.pq_suite), probe, pqPair.privateKey);
+    return (
+      crypto.verify(nativeSigningHashForSuite(hybridSuite.classical_suite), probe, classicalPair.publicKey, classicalSignature) &&
+      crypto.verify(nativeSigningHashForSuite(hybridSuite.pq_suite), probe, pqPair.publicKey, pqSignature)
+    );
+  } catch (_error) {
+    return false;
+  }
+}
+
+function buildNativeHybridReceiptProof(receipt, canonicalEvent, options = {}) {
+  const classicalSignatureSuite = normalizeString(
+    options.classical_signature_suite ||
+    options.hybrid_classical_signature_suite ||
+    options.native_classical_signature_suite ||
+    "ed25519"
+  );
+  const pqSignatureSuite = normalizeString(
+    options.pq_signature_suite ||
+    options.hybrid_pq_signature_suite ||
+    options.native_pq_signature_suite ||
+    "ml-dsa-65"
+  );
+  const hybridSuite = parseNativeHybridSuite(buildNativeHybridSuiteId(classicalSignatureSuite, pqSignatureSuite));
+  if (!runtimeSupportsNativeHybridSuite(hybridSuite.id)) {
+    throw new Error("native hybrid runtime validator unavailable");
+  }
+  const classicalPublicKeyPem = normalizePublicKeyPem(
+    options.classical_public_key_pem ||
+    options.hybrid_classical_public_key_pem ||
+    options.native_classical_public_key_pem
+  );
+  const classicalPrivateKeyPem = normalizePrivateKeyPem(
+    options.classical_private_key_pem ||
+    options.hybrid_classical_private_key_pem ||
+    options.native_classical_private_key_pem
+  );
+  const pqPublicKeyPem = normalizePublicKeyPem(
+    options.pq_public_key_pem ||
+    options.hybrid_pq_public_key_pem ||
+    options.native_pq_public_key_pem
+  );
+  const pqPrivateKeyPem = normalizePrivateKeyPem(
+    options.pq_private_key_pem ||
+    options.hybrid_pq_private_key_pem ||
+    options.native_pq_private_key_pem
+  );
+  const classicalPublicKey = crypto.createPublicKey(classicalPublicKeyPem);
+  const classicalPrivateKey = crypto.createPrivateKey(classicalPrivateKeyPem);
+  const pqPublicKey = crypto.createPublicKey(pqPublicKeyPem);
+  const pqPrivateKey = crypto.createPrivateKey(pqPrivateKeyPem);
+  assertNativeKeyMatchesSuite(classicalPublicKey, hybridSuite.classical_suite, "native hybrid classical public key");
+  assertNativeKeyMatchesSuite(classicalPrivateKey, hybridSuite.classical_suite, "native hybrid classical private key");
+  assertNativeKeyMatchesSuite(pqPublicKey, hybridSuite.pq_suite, "native hybrid pq public key");
+  assertNativeKeyMatchesSuite(pqPrivateKey, hybridSuite.pq_suite, "native hybrid pq private key");
+  const identityRef = normalizeString(options.identity_ref || options.native_identity_ref || receipt.agent_identity);
+  if (!identityRef) {
+    throw new Error("native identity_ref required");
+  }
+  const classicalPublicKeyRef = nativePublicKeyRefFromPem(classicalPublicKeyPem, hybridSuite.classical_suite.id);
+  const pqPublicKeyRef = nativePublicKeyRefFromPem(pqPublicKeyPem, hybridSuite.pq_suite.id);
+  const hybridPublicKeyRef = nativeHybridPublicKeyRefFromPems(classicalPublicKeyPem, pqPublicKeyPem, hybridSuite.id);
+  const descriptor = {
+    identity_ref: identityRef,
+    hybrid_suite: hybridSuite.id,
+    hybrid_public_key_ref: hybridPublicKeyRef,
+    classical_public_key_ref: classicalPublicKeyRef,
+    pq_public_key_ref: pqPublicKeyRef
+  };
+  const signingMaterial = buildNativeHybridProofMaterial(receipt, canonicalEvent, descriptor);
+  const signingBytes = Buffer.from(canonicalize(signingMaterial), "utf8");
+  const classicalSignature = base64urlEncode(
+    crypto.sign(nativeSigningHashForSuite(hybridSuite.classical_suite), signingBytes, classicalPrivateKey)
+  );
+  const pqSignature = base64urlEncode(
+    crypto.sign(nativeSigningHashForSuite(hybridSuite.pq_suite), signingBytes, pqPrivateKey)
+  );
+  return {
+    method: XOONYA_NATIVE_HYBRID_METHOD,
+    hybrid_suite: hybridSuite.id,
+    identity_ref: identityRef,
+    hybrid_public_key_ref: hybridPublicKeyRef,
+    classical_public_key_ref: classicalPublicKeyRef,
+    pq_public_key_ref: pqPublicKeyRef,
+    classical_public_key_material: {
+      format: hybridSuite.classical_suite.public_key_format,
+      value: classicalPublicKeyPem
+    },
+    pq_public_key_material: {
+      format: hybridSuite.pq_suite.public_key_format,
+      value: pqPublicKeyPem
+    },
+    proof_material: {
+      signing_material_sha256: sha256Hex(signingBytes),
+      classical_signature: classicalSignature,
+      pq_signature: pqSignature
+    },
+    compact_signature: `${XOONYA_NATIVE_HYBRID_METHOD}:${hybridSuite.id}:${classicalSignature}.${pqSignature}`
+  };
+}
+
 function normalizeNativeAnchorRefs(anchorRefs, label = "native anchors") {
   if (!Array.isArray(anchorRefs) || anchorRefs.length === 0) {
     throw new Error(`${label} must be a non-empty array`);
@@ -918,6 +1125,101 @@ function verifyNativeSignedReceiptProof(receipt, ceb) {
   }
 }
 
+function verifyNativeHybridReceiptProof(receipt, ceb) {
+  try {
+    const proof = receipt.native_proof;
+    if (!proof || typeof proof !== "object" || Array.isArray(proof)) {
+      return { valid: false, reason: "native_proof_missing" };
+    }
+    if (normalizeString(proof.method) !== XOONYA_NATIVE_HYBRID_METHOD) {
+      return { valid: false, reason: "native_proof_method_mismatch" };
+    }
+    const hybridSuite = parseNativeHybridSuite(proof.hybrid_suite);
+    if (!runtimeSupportsNativeHybridSuite(hybridSuite.id)) {
+      return { valid: false, reason: "native_hybrid_runtime_validator_unavailable" };
+    }
+    const identityRef = normalizeString(proof.identity_ref);
+    if (!identityRef) {
+      return { valid: false, reason: "native_identity_ref_missing" };
+    }
+    const classicalPublicKeyMaterial = proof.classical_public_key_material;
+    const pqPublicKeyMaterial = proof.pq_public_key_material;
+    if (!classicalPublicKeyMaterial || typeof classicalPublicKeyMaterial !== "object" || Array.isArray(classicalPublicKeyMaterial)) {
+      return { valid: false, reason: "native_hybrid_classical_public_key_material_missing" };
+    }
+    if (!pqPublicKeyMaterial || typeof pqPublicKeyMaterial !== "object" || Array.isArray(pqPublicKeyMaterial)) {
+      return { valid: false, reason: "native_hybrid_pq_public_key_material_missing" };
+    }
+    if (normalizeString(classicalPublicKeyMaterial.format) !== hybridSuite.classical_suite.public_key_format) {
+      return { valid: false, reason: "native_hybrid_classical_public_key_format_mismatch" };
+    }
+    if (normalizeString(pqPublicKeyMaterial.format) !== hybridSuite.pq_suite.public_key_format) {
+      return { valid: false, reason: "native_hybrid_pq_public_key_format_mismatch" };
+    }
+    const classicalPublicKeyPem = normalizePublicKeyPem(classicalPublicKeyMaterial.value);
+    const pqPublicKeyPem = normalizePublicKeyPem(pqPublicKeyMaterial.value);
+    const classicalPublicKey = crypto.createPublicKey(classicalPublicKeyPem);
+    const pqPublicKey = crypto.createPublicKey(pqPublicKeyPem);
+    assertNativeKeyMatchesSuite(classicalPublicKey, hybridSuite.classical_suite, "native hybrid classical public key");
+    assertNativeKeyMatchesSuite(pqPublicKey, hybridSuite.pq_suite, "native hybrid pq public key");
+    const expectedClassicalPublicKeyRef = nativePublicKeyRefFromPem(classicalPublicKeyPem, hybridSuite.classical_suite.id);
+    const expectedPqPublicKeyRef = nativePublicKeyRefFromPem(pqPublicKeyPem, hybridSuite.pq_suite.id);
+    const expectedHybridPublicKeyRef = nativeHybridPublicKeyRefFromPems(classicalPublicKeyPem, pqPublicKeyPem, hybridSuite.id);
+    if (normalizeString(proof.classical_public_key_ref) !== expectedClassicalPublicKeyRef) {
+      return { valid: false, reason: "native_hybrid_classical_public_key_ref_mismatch" };
+    }
+    if (normalizeString(proof.pq_public_key_ref) !== expectedPqPublicKeyRef) {
+      return { valid: false, reason: "native_hybrid_pq_public_key_ref_mismatch" };
+    }
+    if (normalizeString(proof.hybrid_public_key_ref) !== expectedHybridPublicKeyRef) {
+      return { valid: false, reason: "native_hybrid_public_key_ref_mismatch" };
+    }
+    const proofMaterial = proof.proof_material;
+    if (!proofMaterial || typeof proofMaterial !== "object" || Array.isArray(proofMaterial)) {
+      return { valid: false, reason: "native_proof_material_missing" };
+    }
+    const classicalSignature = normalizeString(proofMaterial.classical_signature);
+    const pqSignature = normalizeString(proofMaterial.pq_signature);
+    if (!classicalSignature) {
+      return { valid: false, reason: "native_hybrid_classical_signature_missing" };
+    }
+    if (!pqSignature) {
+      return { valid: false, reason: "native_hybrid_pq_signature_missing" };
+    }
+    const expectedCompactSignature = `${XOONYA_NATIVE_HYBRID_METHOD}:${hybridSuite.id}:${classicalSignature}.${pqSignature}`;
+    if (normalizeString(receipt.signature) !== expectedCompactSignature) {
+      return { valid: false, reason: "signature_native_hybrid_mismatch" };
+    }
+    const signingMaterial = buildNativeHybridProofMaterial(receipt, ceb, {
+      identity_ref: identityRef,
+      hybrid_suite: hybridSuite.id,
+      hybrid_public_key_ref: expectedHybridPublicKeyRef,
+      classical_public_key_ref: expectedClassicalPublicKeyRef,
+      pq_public_key_ref: expectedPqPublicKeyRef
+    });
+    const signingBytes = Buffer.from(canonicalize(signingMaterial), "utf8");
+    const expectedSigningHash = sha256Hex(signingBytes);
+    if (normalizeString(proofMaterial.signing_material_sha256).toLowerCase() !== expectedSigningHash) {
+      return { valid: false, reason: "native_hybrid_signing_material_hash_mismatch" };
+    }
+    const classicalSignatureBytes = base64urlDecode(classicalSignature, "native hybrid classical signature");
+    const pqSignatureBytes = base64urlDecode(pqSignature, "native hybrid pq signature");
+    if (!crypto.verify(nativeSigningHashForSuite(hybridSuite.classical_suite), signingBytes, classicalPublicKey, classicalSignatureBytes)) {
+      return { valid: false, reason: "native_hybrid_classical_signature_invalid" };
+    }
+    if (!crypto.verify(nativeSigningHashForSuite(hybridSuite.pq_suite), signingBytes, pqPublicKey, pqSignatureBytes)) {
+      return { valid: false, reason: "native_hybrid_pq_signature_invalid" };
+    }
+    return {
+      valid: true,
+      verification_state: "verified_native_hybrid_signature",
+      signature_suite: hybridSuite.id
+    };
+  } catch (error) {
+    return { valid: false, reason: error.message };
+  }
+}
+
 function verifyNativeAnchoredReceiptProof(receipt, ceb, bundle) {
   try {
     const proof = receipt.native_proof;
@@ -1026,6 +1328,11 @@ function emitReceipt(event, options = {}) {
     signature = nativeProof.compact_signature;
     delete nativeProof.compact_signature;
   }
+  if (!signature && unsignedReceipt.algorithm === XOONYA_NATIVE_HYBRID_METHOD) {
+    nativeProof = buildNativeHybridReceiptProof(unsignedReceipt, canonicalEvent, options);
+    signature = nativeProof.compact_signature;
+    delete nativeProof.compact_signature;
+  }
   if (!signature && unsignedReceipt.algorithm === XOONYA_NATIVE_ANCHORED_METHOD) {
     nativeProof = buildNativeAnchoredReceiptProof(unsignedReceipt, canonicalEvent, options);
     signature = nativeProof.compact_signature;
@@ -1057,7 +1364,21 @@ function verifyReceiptProofMethod(receipt, ceb, bundle) {
     return { valid: false, reason: "verification_method_none" };
   }
   if (algorithm === XOONYA_NATIVE_HYBRID_METHOD) {
-    return { valid: false, reason: "native_hybrid_design_gated" };
+    const verification = verifyNativeHybridReceiptProof(receipt, ceb);
+    if (!verification.valid) {
+      return { valid: false, reason: verification.reason };
+    }
+    return {
+      valid: true,
+      method: {
+        id: XOONYA_NATIVE_HYBRID_METHOD,
+        family: "xoonya_native",
+        verification_posture: "native_hybrid_signature_verified",
+        description: "Verifies xoonya's native hybrid proof envelope with a classical and PQ signature bound to one deterministic signing material."
+      },
+      verification_state: verification.verification_state,
+      signature_suite: verification.signature_suite
+    };
   }
 
   const method = PROOF_VERIFICATION_METHODS[algorithm];
@@ -2699,15 +3020,14 @@ function buildxoonyaNativeProofStandard() {
         method: XOONYA_NATIVE_ANCHORED_METHOD,
         maturity: "implemented",
         purpose: "native anchor binding for chain, batch, finality, or external attestation references"
-      }
-    ],
-    planned_native_methods: [
+      },
       {
         method: XOONYA_NATIVE_HYBRID_METHOD,
-        maturity: "future_extension",
-        purpose: "stronger-crypto or PQC-sensitive proof lane without changing the native object model"
+        maturity: "implemented",
+        purpose: "dual-signature classical-plus-pq native proof lane for stronger replay-sensitive verification"
       }
     ],
+    planned_native_methods: [],
     supported_external_method_families: listProofVerificationMethods()
       .filter((method) => method.verification_posture === "structure_verified_external_signature")
       .map((method) => ({
@@ -2839,15 +3159,19 @@ function summarizexoonyaNativeProofStandard() {
 }
 
 function buildxoonyaNativeHybridReadinessPack() {
+  const implementedHybridSuites = listImplementedNativeHybridSuites();
+  const runtimeSupportedHybridSuites = implementedHybridSuites.filter((suite) => runtimeSupportsNativeHybridSuite(suite.id));
   return {
     ok: true,
     product: "xoonya",
     category: "xoonya-native-hybrid-readiness-pack",
     pack_version: "xoonya-native-hybrid-readiness-v1",
     method: XOONYA_NATIVE_HYBRID_METHOD,
-    status: "design_gated",
-    posture: "future_stronger_crypto_or_pqc_sensitive_lane_without_changing_xnya_atom_core",
-    current_decision: "do_not_claim_pqc_or_hybrid_verification_until_runtime_validators_and_vectors_exist",
+    status: runtimeSupportedHybridSuites.length > 0 ? "implemented" : "runtime_gated",
+    posture: "dual_signature_classical_plus_pq_lane_without_changing_xnya_atom_core",
+    current_decision: runtimeSupportedHybridSuites.length > 0
+      ? "claim_registered_native_hybrid_verification_only_for_runtime_supported_vector_covered_suites"
+      : "runtime_support_missing_for_registered_native_hybrid_verification",
     implemented_classical_suites: listNativeSignatureSuites()
       .filter((suite) => suite.maturity === "implemented")
       .map((suite) => ({
@@ -2855,6 +3179,12 @@ function buildxoonyaNativeHybridReadinessPack() {
         public_key_format: suite.public_key_format,
         verification_posture: suite.verification_posture
       })),
+    implemented_hybrid_suites: runtimeSupportedHybridSuites.map((suite) => ({
+      suite: suite.id,
+      classical_suite: suite.classical_suite,
+      pq_suite: suite.pq_suite,
+      verification_posture: suite.posture
+    })),
     gated_candidate_suites: listNativeSignatureSuites()
       .filter((suite) => suite.maturity !== "implemented")
       .map((suite) => ({
@@ -2866,7 +3196,6 @@ function buildxoonyaNativeHybridReadinessPack() {
     promotion_requirements: [
       "runtime_validator_available_without_experimental_flags",
       "positive_conformance_vectors",
-      "design_gate_adversarial_vector",
       "wrong_key_adversarial_vectors",
       "tampered_signature_adversarial_vectors",
       "downgrade_and_method_confusion_vectors",
@@ -2877,9 +3206,9 @@ function buildxoonyaNativeHybridReadinessPack() {
     hybrid_object_model_boundary: {
       atom_rule: "XNYA_atom_remains_commitment_only",
       envelope_rule: "hybrid_or_pqc_material_lives_in_proof_envelope_or_profile",
-      current_deterministic_reject_reason: "native_hybrid_design_gated",
+      current_deterministic_reject_reason: runtimeSupportedHybridSuites.length > 0 ? null : "native_hybrid_runtime_validator_unavailable",
       downgrade_rule: "hybrid_receipts_must_not_verify_as_classical_native_signed_receipts",
-      claim_rule: "claim_candidate_or_design_gated_until_validators_and_vectors_are_real"
+      claim_rule: "claim_only_registered_runtime_supported_vector_covered_hybrid_suites"
     },
     linked_surfaces: {
       native_standard_ref: "/v1/proof-center/native-standard",
@@ -2902,6 +3231,8 @@ function summarizexoonyaNativeHybridReadinessPack() {
     posture: pack.posture,
     implemented_classical_suite_count: pack.implemented_classical_suites.length,
     implemented_classical_suites: pack.implemented_classical_suites.map((entry) => entry.suite),
+    implemented_hybrid_suite_count: pack.implemented_hybrid_suites.length,
+    implemented_hybrid_suites: pack.implemented_hybrid_suites.map((entry) => entry.suite),
     gated_candidate_suite_count: pack.gated_candidate_suites.length,
     promotion_requirement_count: pack.promotion_requirements.length,
     deterministic_reject_reason: pack.hybrid_object_model_boundary.current_deterministic_reject_reason,
@@ -3051,7 +3382,7 @@ function buildxoonyaNativeStandardizationPack() {
         "magic_or_atom_layout_is_changed",
         "algorithm_none_is_accepted_as_production_proof",
         "external_issuer_truth_is_claimed_without_external_verifier",
-        "pqc_or_hybrid_support_is_claimed_without_validators_and_vectors"
+        "unregistered_or_runtime_unsupported_pqc_or_hybrid_support_is_claimed"
       ]
     },
     standard_artifacts: [
@@ -3287,7 +3618,7 @@ function buildxoonyaNativeReferenceImplementationPack() {
       "return_stable_error_codes_for_rejects",
       "reject_algorithm_none_for_production_native_proofs",
       "verify_ed25519_secp256k1_and_p256_only_when_suite_specific_validators_exist",
-      "treat_pq_hybrid_as_design_gated_until_validators_and_vectors_exist",
+      "verify_registered_native_hybrid_suites_only_when_runtime_support_and_vectors_exist",
       "bind_external_methods_without_claiming_external_issuer_truth",
       "preserve_anchor_binding_boundary_without_claiming_external_finality_truth"
     ],
@@ -3336,7 +3667,6 @@ function buildxoonyaNativeReferenceImplementationPack() {
       wraps_javascript_runtime: false
     },
     explicit_non_claims: [
-      "no_pq_or_hybrid_runtime_validation_claim",
       "no_live_external_provider_claim",
       "no_identity_auth_custody_transport_or_settlement_claim",
       "no_python_or_rust_full_reference_claim_until_signature_suite_crypto_full_vector_parity_and_round_trip",
@@ -3513,7 +3843,8 @@ function buildxoonyaNativeConformanceMarkPack() {
           "registered_native_methods_verify",
           "algorithm_none_is_rejected",
           "signature_suite_is_declared_and_registered",
-          "anchor_binding_is_verified_without_external_finality_overclaim"
+          "anchor_binding_is_verified_without_external_finality_overclaim",
+          "registered_native_hybrid_suites_verify_when_runtime_support_is_present"
         ]
       },
       {
@@ -3529,7 +3860,7 @@ function buildxoonyaNativeConformanceMarkPack() {
       {
         claim: "pqc_or_hybrid_verified",
         required_extra_evidence: [
-          "non_experimental_runtime_validator",
+          "runtime_supported_registered_native_hybrid_suite",
           "suite_specific_public_key_rules",
           "positive_conformance_vectors",
           "adversarial_downgrade_vectors",
@@ -3568,7 +3899,7 @@ function buildxoonyaNativeConformanceMarkPack() {
     },
     mark_usage_rules: [
       "do_not_change_magic_layout_or_fixed_sizes_and_keep_the_mark",
-      "do_not_claim_pqc_hybrid_or_live_external_truth_without_extra_evidence",
+      "do_not_claim_unregistered_or_runtime_unsupported_pqc_hybrid_or_live_external_truth_without_extra_evidence",
       "do_not_accept_algorithm_none_as_production_proof",
       "do_not_remove_adversarial_failures_from_compatibility_evidence",
       "do_not_use_the_mark_for_identity_auth_custody_transport_or_settlement_claims"
@@ -5904,6 +6235,7 @@ module.exports = {
   getxoonyaNativeIdentityType,
   buildNativeReceiptSignature,
   buildNativeSignedReceiptProof,
+  buildNativeHybridReceiptProof,
   buildNativeAnchoredReceiptProof,
   buildProofBundle,
   verifyProofBundle,

package/reference/python/verify_vectors.py

@@ -111,6 +111,18 @@ def verify_proof_vectors() -> tuple[int, int, int, int]:
         canonical_event = canonicalize_event(event)
         assert_equal(hash_event(canonical_event), expected["event_commitment"], f"{vector['id']} event commitment")
         options = dict(vector.get("receipt_options", {}))
+        if expected["receipt"].get("algorithm") == "xoonya-native-hybrid-v1":
+            assert_equal(expected["receipt"]["native_proof"]["method"], "xoonya-native-hybrid-v1", f"{vector['id']} native hybrid method")
+            bundle = {
+                "version": expected["proof_bundle_version"],
+                "ceb": canonical_event,
+                "receipt": expected["receipt"],
+            }
+            verification = verify_proof_bundle(bundle)
+            assert_equal(verification["valid"], False, f"{vector['id']} python hybrid boundary")
+            assert_equal(verification["reason"], "native_hybrid_runtime_unavailable_in_python_candidate", f"{vector['id']} python hybrid reason")
+            positive_count += 1
+            continue
         if expected["receipt"].get("algorithm") == "xoonya-native-signed-v1":
             assert_equal(expected["receipt"]["native_proof"]["method"], "xoonya-native-signed-v1", f"{vector['id']} native signed method")
             assert_equal(expected["receipt"]["native_proof"]["signature_suite"], options.get("signature_suite"), f"{vector['id']} native signed suite")
@@ -164,6 +176,8 @@ def verify_proof_vectors() -> tuple[int, int, int, int]:
             continue
         result = verify_proof_bundle(vector["bundle"])
         expected_reason = vector["expected_reason"]
+        if vector["bundle"].get("receipt", {}).get("algorithm") == "xoonya-native-hybrid-v1":
+            expected_reason = "native_hybrid_runtime_unavailable_in_python_candidate"
         if expected_reason == "native_signature_invalid" and not ed25519_available:
             expected_reason = "native_signature_crypto_dependency_missing"
         assert_equal(result["valid"], False, f"{vector['id']} adversarial should fail")

package/reference/python/xnya_reference.py

@@ -755,7 +755,7 @@ def verify_proof_bundle(bundle: dict[str, Any]) -> dict[str, Any]:
         if algorithm == "none":
             return {"valid": False, "reason": "verification_method_none"}
         if algorithm == XOONYA_NATIVE_HYBRID_METHOD:
-            return {"valid": False, "reason": "native_hybrid_design_gated"}
+            return {"valid": False, "reason": "native_hybrid_runtime_unavailable_in_python_candidate"}
         if algorithm == LEGACY_OPRETURN_METHOD:
             legacy_receipt = (receipt.get("compatibility") or {}).get("legacy_receipt")
             if not isinstance(legacy_receipt, dict):

package/scripts/verify_all.js

@@ -251,14 +251,22 @@ function verifyProofBundleConformance() {
   ensure(unsupportedVerification.valid === false, "unknown proof method must not verify");
   ensure(unsupportedVerification.reason === "verification_method_unsupported", "unknown proof method reason mismatch");
 
-  const hybridAttemptReceipt = {
-    ...nativeReceipt,
+  const hybridClassical = crypto.generateKeyPairSync("ed25519");
+  const hybridPq = crypto.generateKeyPairSync("ml-dsa-65");
+  const hybridReceipt = sdk.emitReceipt(event, {
+    agent_identity: "native-hybrid-agent",
     algorithm: "xoonya-native-hybrid-v1",
-    signature: "xoonya-native-hybrid-v1:design-gated-placeholder"
-  };
-  const hybridAttemptVerification = sdk.verifyProofBundle(sdk.buildProofBundle({ ceb: event, receipt: hybridAttemptReceipt }));
-  ensure(hybridAttemptVerification.valid === false, "native hybrid method must stay design gated");
-  ensure(hybridAttemptVerification.reason === "native_hybrid_design_gated", "native hybrid design gate reason mismatch");
+    identity_ref: "did:xoonya:native-hybrid-agent",
+    classical_signature_suite: "ed25519",
+    pq_signature_suite: "ml-dsa-65",
+    classical_public_key_pem: hybridClassical.publicKey.export({ type: "spki", format: "pem" }),
+    classical_private_key_pem: hybridClassical.privateKey.export({ type: "pkcs8", format: "pem" }),
+    pq_public_key_pem: hybridPq.publicKey.export({ type: "spki", format: "pem" }),
+    pq_private_key_pem: hybridPq.privateKey.export({ type: "pkcs8", format: "pem" })
+  });
+  const hybridVerification = sdk.verifyProofBundle(sdk.buildProofBundle({ ceb: event, receipt: hybridReceipt }));
+  ensure(hybridVerification.valid === true, "native hybrid method must verify");
+  ensure(hybridVerification.verification_state === "verified_native_hybrid_signature", "native hybrid verification state mismatch");
 
   const tamperedNativeReceipt = {
     ...nativeReceipt,
@@ -526,6 +534,7 @@ function main() {
   ensure(typeof sdk.verifyxoonyaNativeAtom === "function", "missing verifyxoonyaNativeAtom");
   ensure(typeof sdk.buildNativeReceiptSignature === "function", "missing buildNativeReceiptSignature");
   ensure(typeof sdk.buildNativeSignedReceiptProof === "function", "missing buildNativeSignedReceiptProof");
+  ensure(typeof sdk.buildNativeHybridReceiptProof === "function", "missing buildNativeHybridReceiptProof");
   ensure(typeof sdk.buildNativeAnchoredReceiptProof === "function", "missing buildNativeAnchoredReceiptProof");
   ensure(typeof sdk.buildxoonyaNativeAnchorProfile === "function", "missing buildxoonyaNativeAnchorProfile");
   ensure(typeof sdk.summarizexoonyaNativeAnchorProfile === "function", "missing summarizexoonyaNativeAnchorProfile");
@@ -567,9 +576,10 @@ function main() {
   ensure(fs.existsSync(path.resolve(__dirname, "..", "integrations", "registration-record.schema.json")), "missing integration registration schema");
   ensure(fs.existsSync(path.resolve(__dirname, "..", "integrations", "registry-snapshot.schema.json")), "missing integration registry snapshot schema");
   const hybridReadiness = sdk.summarizexoonyaNativeHybridReadinessPack();
-  ensure(hybridReadiness.status === "design_gated", "native hybrid readiness must stay design gated");
+  ensure(hybridReadiness.status === "implemented", "native hybrid readiness must be implemented");
   ensure(hybridReadiness.implemented_classical_suites.includes("secp256k1"), "native hybrid readiness secp256k1 suite missing");
   ensure(hybridReadiness.implemented_classical_suites.includes("p256"), "native hybrid readiness p256 suite missing");
+  ensure(hybridReadiness.implemented_hybrid_suites.includes("ed25519+ml-dsa-65"), "native hybrid readiness ml-dsa suite missing");
   const standardization = sdk.summarizexoonyaNativeStandardizationPack();
   ensure(standardization.canonical_magic === "XNYA", "native standardization magic mismatch");
   ensure(standardization.conformance_forbidden_condition_count >= 4, "native standardization forbidden conditions missing");