xoonya 2.5.0 → 2.7.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (31) hide show
  1. package/README.md +119 -7
  2. package/RELEASE_NOTES.md +29 -7
  3. package/SERVICE_CONTRACT.md +22 -0
  4. package/START_HERE.md +12 -0
  5. package/XOONYA_NATIVE_ATOM_SPEC.md +184 -0
  6. package/XOONYA_NATIVE_PROOF_FORMAT.md +502 -0
  7. package/XOONYA_NATIVE_STANDARD_GOVERNANCE.md +116 -0
  8. package/bin/xoonya-first-run.js +184 -0
  9. package/bin/xoonya.js +31 -5
  10. package/lib/release_history.js +29 -0
  11. package/package.json +11 -15
  12. package/proof_sdk.js +2391 -44
  13. package/scripts/registry_cli.js +157 -0
  14. package/scripts/verify_all.js +558 -0
  15. package/scripts/verify_examples.js +19 -0
  16. package/scripts/verify_integrations.js +170 -0
  17. package/scripts/verify_release_candidate.js +87 -0
  18. package/scripts/verify_service.js +2825 -0
  19. package/scripts/verify_tooling.js +1228 -0
  20. package/scripts/verify_vectors.js +164 -0
  21. package/server.js +125 -2
  22. package/vectors/adversarial-vectors.json +373 -2
  23. package/vectors/conformance-vectors.json +342 -1
  24. package/vectors/native-atom-vectors.json +101 -0
  25. package/vectors/native-payload-profile-vectors.json +50 -0
  26. package/OPERATIONS_RUNBOOK.md +0 -50
  27. package/OPERATOR_START_HERE.md +0 -67
  28. package/PROGRAM_COMPLETE_RELEASE.md +0 -52
  29. package/PROGRAM_STATUS.md +0 -57
  30. package/PUBLISH_PLAN.md +0 -14
  31. package/RELEASE_CHECKLIST.md +0 -16
package/vectors/adversarial-vectors.json CHANGED
@@ -48,7 +48,7 @@
48
48
  "domain_id": "vectors.demo",
49
49
  "sequence": "42",
50
50
  "event_commitment": "b4b46b678b96cba7bdfd1a51776c6b5e343eefd6fc84ec2825e86a57d4f59c7c",
51
- "algorithm": "none",
51
+ "algorithm": "detached-assertion-v1",
52
52
  "signature": ""
53
53
  }
54
54
  },
@@ -75,11 +75,382 @@
75
75
  "domain_id": "vectors.demo",
76
76
  "sequence": "42",
77
77
  "event_commitment": "efefefefefefefefefefefefefefefefefefefefefefefefefefefefefefefef",
78
- "algorithm": "none",
78
+ "algorithm": "detached-assertion-v1",
79
79
  "signature": "sig-demo-001"
80
80
  }
81
81
  },
82
82
  "expected_reason": "event_commitment_mismatch"
83
+ },
84
+ {
85
+ "id": "reject-ambiguous-none-method",
86
+ "kind": "verify_bundle_reason",
87
+ "bundle": {
88
+ "version": "proof-bundle/v1",
89
+ "ceb": {
90
+ "version": "canonical-event-bundle/v1",
91
+ "domain_id": "vectors.demo",
92
+ "sequence": "42",
93
+ "actor_id": "agent-demo",
94
+ "adapter_source": "vector-suite",
95
+ "event_type": "demo.event",
96
+ "event_hash": "1212121212121212121212121212121212121212121212121212121212121212",
97
+ "parent_refs": [
98
+ "parent-a",
99
+ "parent-b"
100
+ ],
101
+ "capability_refs": [
102
+ "proof",
103
+ "demo"
104
+ ],
105
+ "semantic_slots": {
106
+ "alpha": "a",
107
+ "beta": "b"
108
+ }
109
+ },
110
+ "receipt": {
111
+ "version": "receipt/v1",
112
+ "receipt_id": "21e215294241a765326c085e8fdc2b258ca2dd8af19ea2994de2bf796a3a7c4b",
113
+ "agent_identity": "agent-demo-signing",
114
+ "domain_id": "vectors.demo",
115
+ "sequence": "42",
116
+ "event_commitment": "b4b46b678b96cba7bdfd1a51776c6b5e343eefd6fc84ec2825e86a57d4f59c7c",
117
+ "algorithm": "none",
118
+ "signature": "sig-demo-001"
119
+ }
120
+ },
121
+ "expected_reason": "verification_method_none"
122
+ },
123
+ {
124
+ "id": "reject-unsupported-proof-method",
125
+ "kind": "verify_bundle_reason",
126
+ "bundle": {
127
+ "version": "proof-bundle/v1",
128
+ "ceb": {
129
+ "version": "canonical-event-bundle/v1",
130
+ "domain_id": "vectors.demo",
131
+ "sequence": "42",
132
+ "actor_id": "agent-demo",
133
+ "adapter_source": "vector-suite",
134
+ "event_type": "demo.event",
135
+ "event_hash": "1212121212121212121212121212121212121212121212121212121212121212",
136
+ "parent_refs": [
137
+ "parent-a",
138
+ "parent-b"
139
+ ],
140
+ "capability_refs": [
141
+ "proof",
142
+ "demo"
143
+ ],
144
+ "semantic_slots": {
145
+ "alpha": "a",
146
+ "beta": "b"
147
+ }
148
+ },
149
+ "receipt": {
150
+ "version": "receipt/v1",
151
+ "receipt_id": "21e215294241a765326c085e8fdc2b258ca2dd8af19ea2994de2bf796a3a7c4b",
152
+ "agent_identity": "agent-demo-signing",
153
+ "domain_id": "vectors.demo",
154
+ "sequence": "42",
155
+ "event_commitment": "b4b46b678b96cba7bdfd1a51776c6b5e343eefd6fc84ec2825e86a57d4f59c7c",
156
+ "algorithm": "jwt-vc-demo",
157
+ "signature": "sig-demo-001"
158
+ }
159
+ },
160
+ "expected_reason": "verification_method_unsupported"
161
+ },
162
+ {
163
+ "id": "reject-replayed-receipt-sequence",
164
+ "kind": "verify_bundle_reason",
165
+ "bundle": {
166
+ "version": "proof-bundle/v1",
167
+ "ceb": {
168
+ "version": "canonical-event-bundle/v1",
169
+ "domain_id": "vectors.native",
170
+ "sequence": "8",
171
+ "actor_id": "agent-native",
172
+ "adapter_source": "vector-suite",
173
+ "event_type": "native.event",
174
+ "event_hash": "3434343434343434343434343434343434343434343434343434343434343434"
175
+ },
176
+ "receipt": {
177
+ "version": "receipt/v1",
178
+ "receipt_id": "7c4930d56110f0b9623f79025c7be4789e0c0a6155b2645b243ce4c126f53e96",
179
+ "agent_identity": "agent-native-signing",
180
+ "domain_id": "vectors.native",
181
+ "sequence": "7",
182
+ "event_commitment": "7361278f20b4d6c6f305ebfb490989b0faa3928823954d1852a7d7e78d92d8cd",
183
+ "algorithm": "xoonya-native-sha256-v1",
184
+ "signature": "xoonya-native-sha256-v1:572af7d74cd00b96e54352b113036b9b4473bcef799bd69606ecf40eee86f165"
185
+ }
186
+ },
187
+ "expected_reason": "receipt_sequence_mismatch"
188
+ },
189
+ {
190
+ "id": "reject-native-signature-tamper",
191
+ "kind": "verify_bundle_reason",
192
+ "bundle": {
193
+ "version": "proof-bundle/v1",
194
+ "ceb": {
195
+ "version": "canonical-event-bundle/v1",
196
+ "domain_id": "vectors.native",
197
+ "sequence": "7",
198
+ "actor_id": "agent-native",
199
+ "adapter_source": "vector-suite",
200
+ "event_type": "native.event",
201
+ "event_hash": "3434343434343434343434343434343434343434343434343434343434343434"
202
+ },
203
+ "receipt": {
204
+ "version": "receipt/v1",
205
+ "receipt_id": "7c4930d56110f0b9623f79025c7be4789e0c0a6155b2645b243ce4c126f53e96",
206
+ "agent_identity": "agent-native-signing",
207
+ "domain_id": "vectors.native",
208
+ "sequence": "7",
209
+ "event_commitment": "7361278f20b4d6c6f305ebfb490989b0faa3928823954d1852a7d7e78d92d8cd",
210
+ "algorithm": "xoonya-native-sha256-v1",
211
+ "signature": "xoonya-native-sha256-v1:572af7d74cd00b96e54352b113036b9b4473bcef799bd69606ecf40eee86f160"
212
+ }
213
+ },
214
+ "expected_reason": "signature_native_mismatch"
215
+ },
216
+ {
217
+ "id": "reject-native-method-downgrade",
218
+ "kind": "verify_bundle_reason",
219
+ "bundle": {
220
+ "version": "proof-bundle/v1",
221
+ "ceb": {
222
+ "version": "canonical-event-bundle/v1",
223
+ "domain_id": "vectors.native",
224
+ "sequence": "7",
225
+ "actor_id": "agent-native",
226
+ "adapter_source": "vector-suite",
227
+ "event_type": "native.event",
228
+ "event_hash": "3434343434343434343434343434343434343434343434343434343434343434"
229
+ },
230
+ "receipt": {
231
+ "version": "receipt/v1",
232
+ "receipt_id": "7c4930d56110f0b9623f79025c7be4789e0c0a6155b2645b243ce4c126f53e96",
233
+ "agent_identity": "agent-native-signing",
234
+ "domain_id": "vectors.native",
235
+ "sequence": "7",
236
+ "event_commitment": "7361278f20b4d6c6f305ebfb490989b0faa3928823954d1852a7d7e78d92d8cd",
237
+ "algorithm": "detached-assertion-v1",
238
+ "signature": "xoonya-native-sha256-v1:572af7d74cd00b96e54352b113036b9b4473bcef799bd69606ecf40eee86f165"
239
+ }
240
+ },
241
+ "expected_reason": "signature_method_mismatch"
242
+ },
243
+ {
244
+ "id": "reject-native-signed-signature-tamper",
245
+ "kind": "verify_bundle_reason",
246
+ "bundle": {
247
+ "version": "proof-bundle/v1",
248
+ "ceb": {
249
+ "version": "canonical-event-bundle/v1",
250
+ "domain_id": "vectors.native.signed",
251
+ "sequence": "9",
252
+ "actor_id": "agent-native-signed",
253
+ "adapter_source": "vector-suite",
254
+ "event_type": "native.signed.event",
255
+ "event_hash": "4545454545454545454545454545454545454545454545454545454545454545"
256
+ },
257
+ "receipt": {
258
+ "version": "receipt/v1",
259
+ "receipt_id": "18e77f9ba51b74da7e1fab9a25c35f560e2e9441d54c9d47b0b2f18a366c5e38",
260
+ "agent_identity": "agent-native-signed-key",
261
+ "domain_id": "vectors.native.signed",
262
+ "sequence": "9",
263
+ "event_commitment": "3218fa3b29f4e4927b275c99d831d1ce472bc5d40e255ce93076eb551725ecd8",
264
+ "algorithm": "xoonya-native-signed-v1",
265
+ "native_proof": {
266
+ "method": "xoonya-native-signed-v1",
267
+ "signature_suite": "ed25519",
268
+ "identity_ref": "did:xoonya:agent-native-signed-key",
269
+ "public_key_ref": "ed25519-spki-sha256:e5b324c6836ecf00f1b9b322055e5044d2ddeac857b15f7039cdd69a14025197",
270
+ "public_key_material": {
271
+ "format": "spki-pem",
272
+ "value": "-----BEGIN PUBLIC KEY-----\nMCowBQYDK2VwAyEArnC5ARNJQFbPtc6pMrFUz2p043Nbds48Dz66+i1R5gk=\n-----END PUBLIC KEY-----\n"
273
+ },
274
+ "proof_material": {
275
+ "signing_material_sha256": "71476b0e9a1e77ddc592d0035f735bfaa74bd253ad985ed95f5038e023de6b99",
276
+ "signature": "1n_CkDbWKlVSgwh8XMJn7yHG6U35jIfYViHa43BJ-KV_IvfJGDQkDOkJ0bqJVxliw_d1WqraOHwSIDGrUtdMCA"
277
+ }
278
+ },
279
+ "signature": "xoonya-native-signed-v1:ed25519:1n_CkDbWKlVSgwh8XMJn7yHG6U35jIfYViHa43BJ-KV_IvfJGDQkDOkJ0bqJVxliw_d1WqraOHwSIDGrUtdMCA"
280
+ }
281
+ },
282
+ "expected_reason": "native_signature_invalid"
283
+ },
284
+ {
285
+ "id": "reject-native-signed-public-key-ref-mismatch",
286
+ "kind": "verify_bundle_reason",
287
+ "bundle": {
288
+ "version": "proof-bundle/v1",
289
+ "ceb": {
290
+ "version": "canonical-event-bundle/v1",
291
+ "domain_id": "vectors.native.signed",
292
+ "sequence": "9",
293
+ "actor_id": "agent-native-signed",
294
+ "adapter_source": "vector-suite",
295
+ "event_type": "native.signed.event",
296
+ "event_hash": "4545454545454545454545454545454545454545454545454545454545454545"
297
+ },
298
+ "receipt": {
299
+ "version": "receipt/v1",
300
+ "receipt_id": "18e77f9ba51b74da7e1fab9a25c35f560e2e9441d54c9d47b0b2f18a366c5e38",
301
+ "agent_identity": "agent-native-signed-key",
302
+ "domain_id": "vectors.native.signed",
303
+ "sequence": "9",
304
+ "event_commitment": "3218fa3b29f4e4927b275c99d831d1ce472bc5d40e255ce93076eb551725ecd8",
305
+ "algorithm": "xoonya-native-signed-v1",
306
+ "native_proof": {
307
+ "method": "xoonya-native-signed-v1",
308
+ "signature_suite": "ed25519",
309
+ "identity_ref": "did:xoonya:agent-native-signed-key",
310
+ "public_key_ref": "ed25519-spki-sha256:e5b324c6836ecf00f1b9b322055e5044d2ddeac857b15f7039cdd69a14025190",
311
+ "public_key_material": {
312
+ "format": "spki-pem",
313
+ "value": "-----BEGIN PUBLIC KEY-----\nMCowBQYDK2VwAyEArnC5ARNJQFbPtc6pMrFUz2p043Nbds48Dz66+i1R5gk=\n-----END PUBLIC KEY-----\n"
314
+ },
315
+ "proof_material": {
316
+ "signing_material_sha256": "71476b0e9a1e77ddc592d0035f735bfaa74bd253ad985ed95f5038e023de6b99",
317
+ "signature": "0n_CkDbWKlVSgwh8XMJn7yHG6U35jIfYViHa43BJ-KV_IvfJGDQkDOkJ0bqJVxliw_d1WqraOHwSIDGrUtdMCA"
318
+ }
319
+ },
320
+ "signature": "xoonya-native-signed-v1:ed25519:0n_CkDbWKlVSgwh8XMJn7yHG6U35jIfYViHa43BJ-KV_IvfJGDQkDOkJ0bqJVxliw_d1WqraOHwSIDGrUtdMCA"
321
+ }
322
+ },
323
+ "expected_reason": "native_public_key_ref_mismatch"
324
+ },
325
+ {
326
+ "id": "reject-native-anchored-bundle-missing",
327
+ "kind": "verify_bundle_reason",
328
+ "bundle": {
329
+ "version": "proof-bundle/v1",
330
+ "ceb": {
331
+ "version": "canonical-event-bundle/v1",
332
+ "domain_id": "vectors.native.anchored",
333
+ "sequence": "10",
334
+ "actor_id": "agent-native-anchored",
335
+ "adapter_source": "vector-suite",
336
+ "event_type": "native.anchored.event",
337
+ "event_hash": "6767676767676767676767676767676767676767676767676767676767676767"
338
+ },
339
+ "receipt": {
340
+ "version": "receipt/v1",
341
+ "receipt_id": "443b44df7814707f1fc4a910dbb33b93c7d15423308130b0ca42d5bdc093371b",
342
+ "agent_identity": "agent-native-anchored-signing",
343
+ "domain_id": "vectors.native.anchored",
344
+ "sequence": "10",
345
+ "event_commitment": "0371a4395e6635f600506dd045a91c3597561d8511a1690d304009358447ec9f",
346
+ "algorithm": "xoonya-native-anchored-v1",
347
+ "native_proof": {
348
+ "method": "xoonya-native-anchored-v1",
349
+ "base_method": "xoonya-native-sha256-v1",
350
+ "anchor_refs": [
351
+ {
352
+ "anchor_id": "anchor-bsv-finality-demo",
353
+ "anchor_kind": "finality_ref",
354
+ "anchor_ref": "bsv:mainnet:tx/9cd77fd24b884b281c819b3e48f6b15ed328b116939b082580924cabb4518d28",
355
+ "anchor_hash_sha256": "153ae82600b8eb1d14ca0a9b7bfac3e14f2237e734ec804628c1bf0e832e3a3f",
356
+ "network": "bsv-mainnet",
357
+ "finality_state": "finalized",
358
+ "provider_ref": "operator-finality-material"
359
+ }
360
+ ],
361
+ "proof_material": {
362
+ "anchor_root_sha256": "fccb0a98893181411c65f8b8176a169b188c06704fb0846ba43b88a5e2548e11",
363
+ "binding_material_sha256": "50ce853e5d2429cdf53d720df889349c398a4d4bffa71f7a0a74727ba802fd91"
364
+ }
365
+ },
366
+ "signature": "xoonya-native-anchored-v1:50ce853e5d2429cdf53d720df889349c398a4d4bffa71f7a0a74727ba802fd91"
367
+ }
368
+ },
369
+ "expected_reason": "native_anchor_bundle_missing"
370
+ },
371
+ {
372
+ "id": "reject-native-anchored-binding-tamper",
373
+ "kind": "verify_bundle_reason",
374
+ "bundle": {
375
+ "version": "proof-bundle/v1",
376
+ "ceb": {
377
+ "version": "canonical-event-bundle/v1",
378
+ "domain_id": "vectors.native.anchored",
379
+ "sequence": "10",
380
+ "actor_id": "agent-native-anchored",
381
+ "adapter_source": "vector-suite",
382
+ "event_type": "native.anchored.event",
383
+ "event_hash": "6767676767676767676767676767676767676767676767676767676767676767"
384
+ },
385
+ "receipt": {
386
+ "version": "receipt/v1",
387
+ "receipt_id": "443b44df7814707f1fc4a910dbb33b93c7d15423308130b0ca42d5bdc093371b",
388
+ "agent_identity": "agent-native-anchored-signing",
389
+ "domain_id": "vectors.native.anchored",
390
+ "sequence": "10",
391
+ "event_commitment": "0371a4395e6635f600506dd045a91c3597561d8511a1690d304009358447ec9f",
392
+ "algorithm": "xoonya-native-anchored-v1",
393
+ "native_proof": {
394
+ "method": "xoonya-native-anchored-v1",
395
+ "base_method": "xoonya-native-sha256-v1",
396
+ "anchor_refs": [
397
+ {
398
+ "anchor_id": "anchor-bsv-finality-demo",
399
+ "anchor_kind": "finality_ref",
400
+ "anchor_ref": "bsv:mainnet:tx/9cd77fd24b884b281c819b3e48f6b15ed328b116939b082580924cabb4518d28",
401
+ "anchor_hash_sha256": "153ae82600b8eb1d14ca0a9b7bfac3e14f2237e734ec804628c1bf0e832e3a3f",
402
+ "network": "bsv-mainnet",
403
+ "finality_state": "finalized",
404
+ "provider_ref": "operator-finality-material"
405
+ }
406
+ ],
407
+ "proof_material": {
408
+ "anchor_root_sha256": "fccb0a98893181411c65f8b8176a169b188c06704fb0846ba43b88a5e2548e11",
409
+ "binding_material_sha256": "00ce853e5d2429cdf53d720df889349c398a4d4bffa71f7a0a74727ba802fd91"
410
+ }
411
+ },
412
+ "signature": "xoonya-native-anchored-v1:50ce853e5d2429cdf53d720df889349c398a4d4bffa71f7a0a74727ba802fd91"
413
+ },
414
+ "anchors": [
415
+ {
416
+ "anchor_id": "anchor-bsv-finality-demo",
417
+ "anchor_kind": "finality_ref",
418
+ "anchor_ref": "bsv:mainnet:tx/9cd77fd24b884b281c819b3e48f6b15ed328b116939b082580924cabb4518d28",
419
+ "anchor_hash_sha256": "153ae82600b8eb1d14ca0a9b7bfac3e14f2237e734ec804628c1bf0e832e3a3f",
420
+ "network": "bsv-mainnet",
421
+ "finality_state": "finalized",
422
+ "provider_ref": "operator-finality-material"
423
+ }
424
+ ]
425
+ },
426
+ "expected_reason": "native_anchor_binding_hash_mismatch"
427
+ },
428
+ {
429
+ "id": "reject-receipt-id-mismatch",
430
+ "kind": "verify_bundle_reason",
431
+ "bundle": {
432
+ "version": "proof-bundle/v1",
433
+ "ceb": {
434
+ "version": "canonical-event-bundle/v1",
435
+ "domain_id": "vectors.native",
436
+ "sequence": "7",
437
+ "actor_id": "agent-native",
438
+ "adapter_source": "vector-suite",
439
+ "event_type": "native.event",
440
+ "event_hash": "3434343434343434343434343434343434343434343434343434343434343434"
441
+ },
442
+ "receipt": {
443
+ "version": "receipt/v1",
444
+ "receipt_id": "0000000000000000000000000000000000000000000000000000000000000000",
445
+ "agent_identity": "agent-native-signing",
446
+ "domain_id": "vectors.native",
447
+ "sequence": "7",
448
+ "event_commitment": "7361278f20b4d6c6f305ebfb490989b0faa3928823954d1852a7d7e78d92d8cd",
449
+ "algorithm": "xoonya-native-sha256-v1",
450
+ "signature": "xoonya-native-sha256-v1:572af7d74cd00b96e54352b113036b9b4473bcef799bd69606ecf40eee86f165"
451
+ }
452
+ },
453
+ "expected_reason": "receipt_id_mismatch"
83
454
  }
84
455
  ]
85
456
  }