xoonya 2.7.0 → 2.8.0

package/reference/rust/Cargo.toml

@@ -0,0 +1,11 @@
+[package]
+name = "xoonya-native-rust"
+version = "0.0.0-candidate"
+edition = "2021"
+license = "Apache-2.0"
+publish = false
+
+[lib]
+name = "xnya_reference"
+path = "src/lib.rs"
+

package/reference/rust/README.md

@@ -0,0 +1,28 @@
+# XNYA Rust Candidate Scaffold
+
+This directory is a source-only candidate scaffold for a future independent
+Rust XNYA reference implementation.
+
+It is not a full XNYA-compatible reference implementation yet. The JavaScript
+package remains the canonical implementation, and the Python candidate remains
+the only verified non-JavaScript scaffold today.
+
+Current scope:
+
+- fixed-size `XNYA` atom constants
+- v1/v2 atom byte-length checks
+- record-type checks
+- deterministic atom parser error codes
+
+Not claimed yet:
+
+- SHA-256 or RIPEMD-160 verification parity
+- XNYP payload-profile parity
+- canonical-event or proof-bundle parity
+- signature-suite validation
+- adversarial vector parity
+- `XNYA-compatible` conformance mark eligibility
+
+Future promotion requires a real Rust toolchain check that compiles the crate
+and passes every required positive and adversarial vector set independently.
+

package/reference/rust/src/lib.rs

@@ -0,0 +1,87 @@
+//! Source-only Rust candidate scaffold for XNYA atom parsing.
+//!
+//! This crate is intentionally not promoted as an independent XNYA-compatible
+//! reference. It gives future Rust work a stable parser/error-code starting
+//! point while vector parity, hashing, payload, proof-bundle, and signature
+//! validation remain gated.
+
+pub const XNYA_MAGIC: [u8; 4] = *b"XNYA";
+pub const VERSION_V1: u8 = 0x01;
+pub const VERSION_V2: u8 = 0x02;
+pub const ATOM_V1_LEN: usize = 58;
+pub const ATOM_V2_LEN: usize = 70;
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum XnyaError {
+    AtomBadMagic,
+    AtomUnsupportedLength,
+    AtomUnsupportedRecordType,
+    AtomVersionLengthMismatch,
+}
+
+impl XnyaError {
+    pub fn code(&self) -> &'static str {
+        match self {
+            XnyaError::AtomBadMagic => "atom_bad_magic",
+            XnyaError::AtomUnsupportedLength => "atom_unsupported_length",
+            XnyaError::AtomUnsupportedRecordType => "atom_unsupported_record_type",
+            XnyaError::AtomVersionLengthMismatch => "atom_version_length_mismatch",
+        }
+    }
+}
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct ParsedAtom<'a> {
+    pub version: u8,
+    pub record_type: u8,
+    pub identity_commitment: &'a [u8],
+    pub payload_hash_sha256: &'a [u8],
+}
+
+pub fn parse_atom(bytes: &[u8]) -> Result<ParsedAtom<'_>, XnyaError> {
+    if bytes.len() != ATOM_V1_LEN && bytes.len() != ATOM_V2_LEN {
+        return Err(XnyaError::AtomUnsupportedLength);
+    }
+    if bytes[0..4] != XNYA_MAGIC {
+        return Err(XnyaError::AtomBadMagic);
+    }
+    let version = bytes[4];
+    let record_type = bytes[5];
+    if !matches!(record_type, 0x01 | 0x02 | 0x03) {
+        return Err(XnyaError::AtomUnsupportedRecordType);
+    }
+    let identity_len = match version {
+        VERSION_V1 if bytes.len() == ATOM_V1_LEN => 20,
+        VERSION_V2 if bytes.len() == ATOM_V2_LEN => 32,
+        VERSION_V1 | VERSION_V2 => return Err(XnyaError::AtomVersionLengthMismatch),
+        _ => return Err(XnyaError::AtomVersionLengthMismatch),
+    };
+    let identity_start = 6;
+    let identity_end = identity_start + identity_len;
+    let payload_end = identity_end + 32;
+    Ok(ParsedAtom {
+        version,
+        record_type,
+        identity_commitment: &bytes[identity_start..identity_end],
+        payload_hash_sha256: &bytes[identity_end..payload_end],
+    })
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn rejects_bad_length() {
+        assert_eq!(parse_atom(&[]).unwrap_err().code(), "atom_unsupported_length");
+    }
+
+    #[test]
+    fn rejects_bad_magic() {
+        let mut atom = [0u8; ATOM_V1_LEN];
+        atom[4] = VERSION_V1;
+        atom[5] = 0x01;
+        assert_eq!(parse_atom(&atom).unwrap_err().code(), "atom_bad_magic");
+    }
+}
+

package/scripts/verify_all.js

@@ -251,6 +251,15 @@ function verifyProofBundleConformance() {
   ensure(unsupportedVerification.valid === false, "unknown proof method must not verify");
   ensure(unsupportedVerification.reason === "verification_method_unsupported", "unknown proof method reason mismatch");
 
+  const hybridAttemptReceipt = {
+    ...nativeReceipt,
+    algorithm: "xoonya-native-hybrid-v1",
+    signature: "xoonya-native-hybrid-v1:design-gated-placeholder"
+  };
+  const hybridAttemptVerification = sdk.verifyProofBundle(sdk.buildProofBundle({ ceb: event, receipt: hybridAttemptReceipt }));
+  ensure(hybridAttemptVerification.valid === false, "native hybrid method must stay design gated");
+  ensure(hybridAttemptVerification.reason === "native_hybrid_design_gated", "native hybrid design gate reason mismatch");
+
   const tamperedNativeReceipt = {
     ...nativeReceipt,
     signature: nativeReceipt.signature.replace(/.$/, "0")
@@ -345,6 +354,18 @@ function verifyProofBundleConformance() {
   });
   ensure(externalImportReviewSummary.ok === true, "external import review summary should pass");
   ensure(externalImportReviewSummary.method === "did-vc-v1", "external import review method mismatch");
+  const externalImportGate = sdk.validateExternalProofImportEvidence({
+    method: "did-vc-v1",
+    external_proof: {
+      proof: "demo"
+    },
+    claim_external_issuer_truth: true
+  });
+  ensure(externalImportGate.import_allowed === false, "external import truth claim should require external verifier");
+  ensure(
+    externalImportGate.rejection_codes.includes("external_issuer_truth_claim_requires_external_verifier"),
+    "external import truth rejection code mismatch"
+  );
 
   let hashMismatchRejected = false;
   try {
@@ -514,6 +535,10 @@ function main() {
   ensure(typeof sdk.summarizeXoonyaNativeHybridReadinessPack === "function", "missing summarizeXoonyaNativeHybridReadinessPack");
   ensure(typeof sdk.buildXoonyaNativeStandardizationPack === "function", "missing buildXoonyaNativeStandardizationPack");
   ensure(typeof sdk.summarizeXoonyaNativeStandardizationPack === "function", "missing summarizeXoonyaNativeStandardizationPack");
+  ensure(typeof sdk.buildXoonyaNativeConformanceMarkPack === "function", "missing buildXoonyaNativeConformanceMarkPack");
+  ensure(typeof sdk.summarizeXoonyaNativeConformanceMarkPack === "function", "missing summarizeXoonyaNativeConformanceMarkPack");
+  ensure(typeof sdk.buildXoonyaNativeReferenceImplementationPack === "function", "missing buildXoonyaNativeReferenceImplementationPack");
+  ensure(typeof sdk.summarizeXoonyaNativeReferenceImplementationPack === "function", "missing summarizeXoonyaNativeReferenceImplementationPack");
   ensure(typeof sdk.buildXoonyaNativePayloadProfilePack === "function", "missing buildXoonyaNativePayloadProfilePack");
   ensure(typeof sdk.summarizeXoonyaNativePayloadProfilePack === "function", "missing summarizeXoonyaNativePayloadProfilePack");
   ensure(typeof sdk.buildXoonyaNativeLineRateFramePack === "function", "missing buildXoonyaNativeLineRateFramePack");
@@ -548,6 +573,16 @@ function main() {
   const standardization = sdk.summarizeXoonyaNativeStandardizationPack();
   ensure(standardization.canonical_magic === "XNYA", "native standardization magic mismatch");
   ensure(standardization.conformance_forbidden_condition_count >= 4, "native standardization forbidden conditions missing");
+  const conformanceMark = sdk.summarizeXoonyaNativeConformanceMarkPack();
+  ensure(conformanceMark.mark === "XNYA-compatible", "native conformance mark mismatch");
+  ensure(conformanceMark.forbidden_claim_count >= 3, "native conformance mark forbidden claims missing");
+  ensure(conformanceMark.implemented_signature_suites.includes("secp256k1"), "native conformance mark secp256k1 suite missing");
+  const referenceImplementations = sdk.summarizeXoonyaNativeReferenceImplementationPack();
+  ensure(referenceImplementations.status === "js_reference_implemented_independent_references_planned", "native reference implementation status mismatch");
+  ensure(referenceImplementations.implemented_reference_count === 1, "native reference implementation count mismatch");
+  ensure(referenceImplementations.planned_reference_count >= 2, "native planned reference implementation count mismatch");
+  ensure(referenceImplementations.verified_candidate_scaffold_count >= 1, "native verified candidate scaffold missing");
+  ensure(referenceImplementations.deterministic_rejection_code_count >= 11, "native reference promotion rejection codes missing");
   verifyCanonicalEventConformance();
   verifyProofBundleConformance();
   verifyNativeAtomConformance();

package/scripts/verify_external_proof_import_gate.js

@@ -0,0 +1,84 @@
+"use strict";
+
+const assert = require("assert");
+const {
+  buildExternalProofImportAdapterPack,
+  validateExternalProofImportEvidence
+} = require("../proof_sdk");
+
+function validImport() {
+  return {
+    method: "jwt-assertion-v1",
+    import_ref: "external-import-gate-demo",
+    issuer_ref: "did:example:issuer",
+    subject_ref: "txn:xytara:demo",
+    external_proof: "eyJhbGciOiJFZERTQSJ9.eyJzdWIiOiJ0eG4teHl0YXJhLWRlbW8ifQ.signature",
+    evidence_refs: ["memory://external/import-gate-demo"]
+  };
+}
+
+function assertRejected(input, expectedCode) {
+  const validation = validateExternalProofImportEvidence(input);
+  assert.strictEqual(validation.import_allowed, false, `expected ${expectedCode} to block external proof import`);
+  assert.strictEqual(
+    validation.rejection_codes.includes(expectedCode),
+    true,
+    `missing deterministic rejection code ${expectedCode}`
+  );
+  return validation;
+}
+
+function main() {
+  const pack = buildExternalProofImportAdapterPack();
+  const validValidation = validateExternalProofImportEvidence(validImport());
+
+  assert.strictEqual(pack.category, "xoonya-external-proof-import-adapter", "external import adapter category mismatch");
+  assert.strictEqual(pack.deterministic_rejection_codes.length >= 11, true, "external import rejection code count missing");
+  assert.strictEqual(validValidation.import_allowed, true, "valid structural external import should pass");
+  assert.deepStrictEqual(validValidation.rejection_codes, [], "valid structural external import should not carry rejection codes");
+
+  assertRejected({ ...validImport(), method: "" }, "verification_method_required");
+  assertRejected({ ...validImport(), method: "unknown-method-v1" }, "verification_method_unsupported");
+  assertRejected({ ...validImport(), method: "xoonya-native-sha256-v1" }, "verification_method_not_external_importable");
+  assertRejected({ method: "jwt-assertion-v1" }, "external_proof_material_required");
+  assertRejected({ ...validImport(), external_proof: "   " }, "external_proof_material_empty");
+  assertRejected({ ...validImport(), declared_hash_sha256: "00".repeat(32) }, "external_proof_hash_mismatch");
+  assertRejected({ ...validImport(), claim_external_issuer_truth: true }, "external_issuer_truth_claim_requires_external_verifier");
+  assertRejected({ ...validImport(), claim_external_signature_truth: true }, "external_signature_truth_claim_requires_external_verifier");
+  assertRejected({ ...validImport(), claim_external_revocation_status: true }, "external_revocation_status_claim_requires_external_verifier");
+  assertRejected({ ...validImport(), method: "did-vc-v1", claim_did_resolution_truth: true }, "did_resolution_truth_claim_requires_external_verifier");
+  assertRejected({ ...validImport(), external_verifier_api_key: "sk_live_accidental_secret" }, "secret_material_forbidden");
+
+  const externallyVerified = validateExternalProofImportEvidence({
+    ...validImport(),
+    method: "did-vc-v1",
+    external_proof: {
+      "@context": ["https://www.w3.org/ns/credentials/v2"],
+      type: ["VerifiableCredential"],
+      issuer: "did:example:issuer",
+      credentialSubject: { id: "did:example:agent" }
+    },
+    claim_external_issuer_truth: true,
+    claim_external_signature_truth: true,
+    claim_external_revocation_status: true,
+    claim_did_resolution_truth: true,
+    external_issuer_verifier_ref: "external.verifier.issuer.did-vc.2026-04-22",
+    external_signature_verifier_ref: "external.verifier.signature.did-vc.2026-04-22",
+    external_revocation_verifier_ref: "external.verifier.revocation.did-vc.2026-04-22",
+    did_resolution_verifier_ref: "external.verifier.did_resolution.did-vc.2026-04-22"
+  });
+  assert.strictEqual(externallyVerified.import_allowed, true, "external verifier-backed truth claims should pass structural validation");
+
+  const output = {
+    ok: true,
+    product: "xoonya",
+    category: "xoonya-external-proof-import-gate-verification",
+    status: "external_import_binds_evidence_without_claiming_external_truth_unless_external_verifier_refs_exist",
+    deterministic_rejection_code_count: pack.deterministic_rejection_codes.length,
+    adversarial_case_count: 11,
+    boundary: "xoonya_imports_external_evidence_but_external_issuer_signature_revocation_and_did_truth_stay_with_external_verifiers"
+  };
+  process.stdout.write(`${JSON.stringify(output, null, 2)}\n`);
+}
+
+main();

package/scripts/verify_native_hybrid_design_gate.js

@@ -0,0 +1,108 @@
+"use strict";
+
+const assert = require("assert");
+const sdk = require("..");
+
+function buildHybridAttemptBundle() {
+  const event = sdk.canonicalizeEvent({
+    version: "canonical-event-bundle/v1",
+    domain_id: "hybrid.gate",
+    sequence: "1",
+    actor_id: "agent-hybrid",
+    adapter_source: "verify_native_hybrid_design_gate",
+    event_type: "native.hybrid.attempt",
+    event_hash: "89".repeat(32)
+  });
+  const receipt = sdk.emitReceipt(event, {
+    agent_identity: "agent-hybrid-signing",
+    algorithm: "xoonya-native-sha256-v1"
+  });
+  return sdk.buildProofBundle({
+    ceb: event,
+    receipt: {
+      ...receipt,
+      algorithm: "xoonya-native-hybrid-v1",
+      signature: "xoonya-native-hybrid-v1:design-gated-placeholder"
+    }
+  });
+}
+
+function runNativeHybridDesignGateVerification() {
+  const readiness = sdk.summarizeXoonyaNativeHybridReadinessPack();
+  assert.strictEqual(readiness.status, "design_gated", "hybrid readiness must stay design gated");
+  assert.strictEqual(
+    readiness.current_decision.includes("do_not_claim_pqc"),
+    true,
+    "hybrid readiness must forbid premature PQ claims"
+  );
+
+  const verification = sdk.verifyProofBundle(buildHybridAttemptBundle());
+  assert.strictEqual(verification.valid, false, "hybrid method must not verify before validators exist");
+  assert.strictEqual(
+    verification.reason,
+    "native_hybrid_design_gated",
+    "hybrid method must fail with deterministic design-gate reason"
+  );
+
+  const downgradeEvent = sdk.canonicalizeEvent({
+    version: "canonical-event-bundle/v1",
+    domain_id: "hybrid.downgrade",
+    sequence: "1",
+    actor_id: "agent-hybrid",
+    adapter_source: "verify_native_hybrid_design_gate",
+    event_type: "native.hybrid.downgrade",
+    event_hash: "90".repeat(32)
+  });
+  const detachedReceipt = sdk.emitReceipt(downgradeEvent, {
+    agent_identity: "agent-hybrid-signing",
+    algorithm: "detached-assertion-v1",
+    signature: "xoonya-native-hybrid-v1:attempted-downgrade"
+  });
+  const downgradeVerification = sdk.verifyProofBundle(sdk.buildProofBundle({
+    ceb: downgradeEvent,
+    receipt: detachedReceipt
+  }));
+  assert.strictEqual(downgradeVerification.valid, false, "hybrid-looking signature must not verify as detached");
+  assert.strictEqual(
+    downgradeVerification.reason,
+    "signature_method_mismatch",
+    "hybrid-looking external signature must fail as method mismatch"
+  );
+
+  return {
+    ok: true,
+    product: "xoonya",
+    category: "xoonya-native-hybrid-design-gate-verification",
+    method: "xoonya-native-hybrid-v1",
+    readiness_status: readiness.status,
+    deterministic_reject_reason: verification.reason,
+    downgrade_reject_reason: downgradeVerification.reason,
+    boundary: "pq_or_hybrid_verification_is_not_claimed_until_real_validators_vectors_and_error_codes_exist"
+  };
+}
+
+function main() {
+  const json = process.argv.includes("--json");
+  const summary = runNativeHybridDesignGateVerification();
+  if (json) {
+    process.stdout.write(`${JSON.stringify(summary, null, 2)}\n`);
+    return;
+  }
+  process.stdout.write(
+    [
+      "xoonya verify:native-hybrid-gate passed",
+      `method: ${summary.method}`,
+      `readiness: ${summary.readiness_status}`,
+      `deterministic reject: ${summary.deterministic_reject_reason}`,
+      `downgrade reject: ${summary.downgrade_reject_reason}`
+    ].join("\n") + "\n"
+  );
+}
+
+if (require.main === module) {
+  main();
+}
+
+module.exports = {
+  runNativeHybridDesignGateVerification
+};

package/scripts/verify_reference_promotion_gate.js

@@ -0,0 +1,74 @@
+"use strict";
+
+const assert = require("assert");
+const {
+  buildXoonyaNativeReferenceImplementationPack,
+  summarizeXoonyaNativeReferenceImplementationPack,
+  validateXoonyaNativeReferencePromotionEvidence
+} = require("../proof_sdk");
+
+function buildValidPromotionEvidence(pack, language = "python") {
+  return {
+    language,
+    candidate_repository_ref: `xoonya-native-${language}@candidate`,
+    vector_sets_passed: pack.required_vector_sets.slice(),
+    deterministic_error_code_parity_ref: `xnya.reference.error_codes.${language}.2026-04-22`,
+    independent_parser_ref: `xnya.reference.parser.${language}.2026-04-22`,
+    signature_crypto_parity_ref: `xnya.reference.crypto.${language}.2026-04-22`,
+    round_trip_ref: `xnya.reference.round_trip.${language}.2026-04-22`,
+    conformance_mark_review_ref: `xnya.reference.conformance_mark.${language}.2026-04-22`,
+    forbidden_claim_review_ref: `xnya.reference.claim_boundary.${language}.2026-04-22`,
+    wraps_javascript_runtime: false
+  };
+}
+
+function assertRejected(pack, evidence, expectedCode) {
+  const validation = validateXoonyaNativeReferencePromotionEvidence(pack, evidence);
+  assert.strictEqual(validation.promotion_allowed, false, `expected ${expectedCode} to block reference promotion`);
+  assert.strictEqual(
+    validation.rejection_codes.includes(expectedCode),
+    true,
+    `missing deterministic rejection code ${expectedCode}`
+  );
+  return validation;
+}
+
+function main() {
+  const pack = buildXoonyaNativeReferenceImplementationPack();
+  const summary = summarizeXoonyaNativeReferenceImplementationPack();
+  const validPythonEvidence = buildValidPromotionEvidence(pack, "python");
+  const validPythonPromotion = validateXoonyaNativeReferencePromotionEvidence(pack, validPythonEvidence);
+
+  assert.strictEqual(pack.category, "xoonya-native-reference-implementation-pack", "native reference pack category mismatch");
+  assert.strictEqual(summary.category, "xoonya-native-reference-implementation-summary", "native reference summary category mismatch");
+  assert.strictEqual(pack.implemented_reference_implementations.length, 1, "only JavaScript should be implemented today");
+  assert.strictEqual(pack.deterministic_rejection_codes.length >= 11, true, "reference promotion rejection codes missing");
+  assert.strictEqual(summary.deterministic_rejection_code_count, pack.deterministic_rejection_codes.length, "summary rejection code count mismatch");
+  assert.strictEqual(validPythonPromotion.promotion_allowed, true, "complete Python promotion evidence should pass validation");
+  assert.deepStrictEqual(validPythonPromotion.rejection_codes, [], "complete Python evidence should not carry rejection codes");
+
+  assertRejected(pack, buildValidPromotionEvidence(pack, "javascript"), "reference_language_not_registered");
+  assertRejected(pack, { ...validPythonEvidence, candidate_repository_ref: null }, "candidate_repository_missing");
+  assertRejected(pack, { ...validPythonEvidence, vector_sets_passed: pack.required_vector_sets.slice(0, 1) }, "required_vector_set_missing");
+  assertRejected(pack, { ...validPythonEvidence, deterministic_error_code_parity_ref: null }, "deterministic_error_code_parity_missing");
+  assertRejected(pack, { ...validPythonEvidence, independent_parser_ref: null }, "independent_parser_evidence_missing");
+  assertRejected(pack, { ...validPythonEvidence, signature_crypto_parity_ref: null }, "signature_crypto_parity_missing");
+  assertRejected(pack, { ...validPythonEvidence, round_trip_ref: null }, "round_trip_evidence_missing");
+  assertRejected(pack, { ...validPythonEvidence, conformance_mark_review_ref: null }, "conformance_mark_review_missing");
+  assertRejected(pack, { ...validPythonEvidence, forbidden_claim_review_ref: null }, "forbidden_claim_review_missing");
+  assertRejected(pack, { ...validPythonEvidence, wraps_javascript_runtime: true }, "javascript_wrapper_forbidden");
+  assertRejected(pack, { ...validPythonEvidence, npm_token: "npm_accidental_secret" }, "secret_material_forbidden");
+
+  const output = {
+    ok: true,
+    product: "xoonya",
+    category: "xoonya-native-reference-promotion-gate-verification",
+    status: "reference_promotion_requires_independent_vector_crypto_round_trip_and_mark_evidence",
+    deterministic_rejection_code_count: pack.deterministic_rejection_codes.length,
+    adversarial_case_count: 11,
+    boundary: "python_and_rust_reference_claims_remain_gated_until_independent_promotion_evidence_is_complete"
+  };
+  process.stdout.write(`${JSON.stringify(output, null, 2)}\n`);
+}
+
+main();

package/scripts/verify_reference_python.js

@@ -0,0 +1,49 @@
+"use strict";
+
+const assert = require("assert");
+const path = require("path");
+const { spawnSync } = require("child_process");
+
+function runPython(command, args) {
+  return spawnSync(command, args, {
+    cwd: path.resolve(__dirname, ".."),
+    encoding: "utf8"
+  });
+}
+
+function main() {
+  const script = path.resolve(__dirname, "..", "reference", "python", "verify_vectors.py");
+  let result = runPython("python", [script]);
+  if (result.error && result.error.code === "ENOENT") {
+    result = runPython("py", ["-3", script]);
+  }
+  if (result.error) {
+    throw result.error;
+  }
+  if (result.status !== 0) {
+    process.stderr.write(result.stdout || "");
+    process.stderr.write(result.stderr || "");
+    throw new Error("Python XNYA reference vector verification failed");
+  }
+  const summary = JSON.parse(result.stdout);
+  assert.strictEqual(summary.ok, true, "Python XNYA reference summary did not pass");
+  assert.strictEqual(summary.category, "xnya-python-reference-vector-parity", "Python XNYA reference category mismatch");
+  assert.strictEqual(summary.atom_vector_count >= 4, true, "Python XNYA atom vectors missing");
+  assert.strictEqual(summary.atom_adversarial_count >= 9, true, "Python XNYA adversarial vectors missing");
+  assert.strictEqual(summary.payload_profile_vector_count, 1, "Python XNYP payload vector missing");
+  assert.strictEqual(summary.proof_bundle_vector_count >= 10, true, "Python proof bundle vectors missing");
+  assert.strictEqual(summary.proof_bundle_verified_vector_count >= 9, true, "Python proof bundle verified vectors missing");
+  assert.strictEqual(
+    summary.native_signed_crypto_gated_vector_count + summary.native_signed_crypto_verified_vector_count,
+    1,
+    "Python native signed crypto vector accounting mismatch"
+  );
+  assert.strictEqual(
+    summary.verified_signature_suite_count === 0 || summary.verified_signature_suite_count === 1,
+    true,
+    "Python verified signature suite count mismatch"
+  );
+  process.stdout.write("xoonya verify:reference-python passed\n");
+}
+
+main();

package/scripts/verify_reference_python_crypto.js

@@ -0,0 +1,87 @@
+"use strict";
+
+const assert = require("assert");
+const fs = require("fs");
+const os = require("os");
+const path = require("path");
+const { spawnSync } = require("child_process");
+
+const rootDir = path.resolve(__dirname, "..");
+
+function run(command, args, options = {}) {
+  return spawnSync(command, args, {
+    cwd: rootDir,
+    encoding: "utf8",
+    ...options
+  });
+}
+
+function findPython() {
+  const direct = run("python", ["--version"]);
+  if (!direct.error && direct.status === 0) {
+    return { command: "python", prefixArgs: [] };
+  }
+  const launcher = run("py", ["-3", "--version"]);
+  if (!launcher.error && launcher.status === 0) {
+    return { command: "py", prefixArgs: ["-3"] };
+  }
+  throw new Error("Python 3 is required for the XNYA Python crypto reference check");
+}
+
+function venvPythonPath(venvDir) {
+  return process.platform === "win32"
+    ? path.join(venvDir, "Scripts", "python.exe")
+    : path.join(venvDir, "bin", "python");
+}
+
+function assertOk(result, label) {
+  if (result.error) {
+    throw result.error;
+  }
+  if (result.status !== 0) {
+    process.stderr.write(result.stdout || "");
+    process.stderr.write(result.stderr || "");
+    throw new Error(`${label} failed`);
+  }
+}
+
+function main() {
+  const python = findPython();
+  const tempDir = fs.mkdtempSync(path.join(os.tmpdir(), "xoonya-python-crypto-"));
+  const keepVenv = process.env.XOONYA_KEEP_REFERENCE_PYTHON_CRYPTO_VENV === "1";
+  try {
+    const venvDir = path.join(tempDir, "venv");
+    assertOk(
+      run(python.command, [...python.prefixArgs, "-m", "venv", venvDir]),
+      "Python venv creation"
+    );
+    const venvPython = venvPythonPath(venvDir);
+    assertOk(
+      run(venvPython, [
+        "-m",
+        "pip",
+        "install",
+        "--disable-pip-version-check",
+        "-r",
+        path.join(rootDir, "reference", "python", "requirements-optional.txt")
+      ]),
+      "Python optional crypto dependency install"
+    );
+    const result = run(venvPython, [path.join(rootDir, "reference", "python", "verify_vectors.py")]);
+    assertOk(result, "Python crypto-enabled XNYA vector verification");
+    const summary = JSON.parse(result.stdout);
+    assert.strictEqual(summary.ok, true, "Python crypto-enabled XNYA summary did not pass");
+    assert.strictEqual(summary.native_signed_crypto_verified_vector_count, 1, "Python Ed25519 vector was not verified");
+    assert.strictEqual(summary.verified_signature_suite_count, 1, "Python verified signature suite count mismatch");
+    assert.strictEqual(summary.native_signature_crypto_dependency_missing_count, 0, "Python crypto dependency should be present in isolated venv");
+    process.stdout.write("xoonya verify:reference-python-crypto passed\n");
+  } finally {
+    if (!keepVenv) {
+      fs.rmSync(tempDir, { recursive: true, force: true });
+    } else {
+      process.stdout.write(`kept Python crypto venv at ${tempDir}\n`);
+    }
+  }
+}
+
+main();

package/scripts/verify_reference_rust_scaffold.js

@@ -0,0 +1,50 @@
+"use strict";
+
+const assert = require("assert");
+const fs = require("fs");
+const path = require("path");
+
+const root = path.resolve(__dirname, "..");
+
+function read(relativePath) {
+  return fs.readFileSync(path.join(root, relativePath), "utf8");
+}
+
+function ensureContains(body, pattern, label) {
+  assert.strictEqual(body.includes(pattern), true, `${label} missing ${pattern}`);
+}
+
+function main() {
+  const readme = read("reference/rust/README.md");
+  const cargo = read("reference/rust/Cargo.toml");
+  const lib = read("reference/rust/src/lib.rs");
+
+  ensureContains(readme, "not a full XNYA-compatible reference implementation yet", "rust readme boundary");
+  ensureContains(readme, "Future promotion requires a real Rust toolchain check", "rust readme promotion gate");
+  ensureContains(cargo, "publish = false", "rust cargo publish boundary");
+  ensureContains(cargo, "name = \"xoonya-native-rust\"", "rust cargo name");
+  ensureContains(lib, "pub const XNYA_MAGIC: [u8; 4] = *b\"XNYA\";", "rust magic constant");
+  ensureContains(lib, "pub const ATOM_V1_LEN: usize = 58;", "rust atom v1 length");
+  ensureContains(lib, "pub const ATOM_V2_LEN: usize = 70;", "rust atom v2 length");
+  ensureContains(lib, "atom_bad_magic", "rust deterministic error code");
+  ensureContains(lib, "atom_unsupported_length", "rust deterministic error code");
+  ensureContains(lib, "atom_unsupported_record_type", "rust deterministic error code");
+  ensureContains(lib, "atom_version_length_mismatch", "rust deterministic error code");
+
+  const summary = {
+    ok: true,
+    product: "xoonya",
+    category: "xnya-rust-reference-scaffold-check",
+    status: "source_scaffold_packaged_not_vector_verified",
+    checked_files: [
+      "reference/rust/README.md",
+      "reference/rust/Cargo.toml",
+      "reference/rust/src/lib.rs"
+    ],
+    boundary: "rust_candidate_is_source_only_until_cargo_vector_parity_and_round_trip_checks_exist"
+  };
+  process.stdout.write(`${JSON.stringify(summary, null, 2)}\n`);
+}
+
+main();
+