xoonya 3.0.1 → 3.1.1

package/lib/authority_binding_lifecycle_contract.js

@@ -0,0 +1,182 @@
+"use strict";
+
+const packageJson = require("../package.json");
+
+function buildAuthorityBindingLifecycleContractPack() {
+  return {
+    ok: true,
+    product: packageJson.name,
+    category: "naxytra-authority-binding-lifecycle-contract",
+    pack_version: "naxytra-authority-binding-lifecycle-contract-v1",
+    doctrine: "xoonya_reviews_binding_lifecycle_state_without_claiming_universal_external_identity_authority_or_custody_truth",
+    model_state: "core_now",
+    core_claim: "binding lifecycle state is the proof-linked record for identity bindings authority bindings spend credentials and delegated signing",
+    binding_kinds: [
+      {
+        binding_kind: "identity_binding",
+        description: "binds a subject to an identity posture"
+      },
+      {
+        binding_kind: "authority_binding",
+        description: "binds a subject to an authority posture"
+      },
+      {
+        binding_kind: "spend_credential",
+        description: "binds a subject to a spend credential or delegated spend posture"
+      },
+      {
+        binding_kind: "delegation_grant",
+        description: "records a delegated capability grant"
+      },
+      {
+        binding_kind: "delegation_revocation",
+        description: "records that a delegation has been revoked"
+      },
+      {
+        binding_kind: "key_binding",
+        description: "binds a subject to a key or public-key reference"
+      }
+    ],
+    lifecycle_states: [
+      { state: "active", description: "usable and currently in force" },
+      { state: "rotated", description: "superseded by a successor binding" },
+      { state: "revoked", description: "disabled before natural expiry" },
+      { state: "expired", description: "no longer valid because the validity window ended" },
+      { state: "suspended", description: "temporarily unusable pending review" }
+    ],
+    canonical_objects: [
+      {
+        object_id: "binding_lifecycle_record",
+        role: "versioned_lineage_preserving_state_record_for_a_binding_or_credential",
+        required_fields: [
+          "version",
+          "binding_id",
+          "binding_kind",
+          "subject_id",
+          "status",
+          "issued_by",
+          "issued_at_iso"
+        ],
+        recommended_fields: [
+          "expires_at_iso",
+          "rotated_from_binding_id",
+          "replaced_by_binding_id",
+          "revoked_at_iso",
+          "revoke_reason",
+          "scope",
+          "key_ref",
+          "signature_suite",
+          "proof_ref",
+          "anchor_ref"
+        ],
+        optional_fields: [
+          "delegation_ref",
+          "controller_id",
+          "previous_binding_id",
+          "metadata"
+        ],
+        primary_surfaces: [
+          "/v1/phases/phase-4/identity-registry/proof",
+          "/v1/phases/phase-4/identity-registry/proof/summary",
+          "/v1/phases/phase-4/attestation/proof",
+          "/v1/proof-center/trust-portability",
+          "/v1/proof-center/trust-portability/summary"
+        ]
+      }
+    ],
+    transition_rules: [
+      "issue_creates_a_new_active_binding",
+      "renew_extends_expiry_without_breaking_lineage",
+      "rotate_creates_a_successor_binding_and_preserves_predecessor_lineage",
+      "revoke_disables_the_binding_and_preserves_auditability",
+      "expire_marks_the_binding_inactive_when_the_validity_window_ends",
+      "narrow_scope_must_not_silently_broaden_access"
+    ],
+    delegated_signing_rules: [
+      "delegated_signing_must_be_explicit",
+      "delegated_signing_must_be_scope_bounded",
+      "delegated_signing_must_be_time_bounded_unless_a_product_decision_says_otherwise",
+      "delegated_signing_must_preserve_subject_and_issuer_lineage",
+      "delegated_signing_must_not_become_hidden_shared_secret_magic"
+    ],
+    lineage_model: [
+      {
+        layer_id: "binding_review",
+        order_index: 1,
+        objects: ["binding_lifecycle_record"],
+        invariants: [
+          "issuance_is_explicit",
+          "binding_ids_are_versioned_and_auditable"
+        ]
+      },
+      {
+        layer_id: "binding_portability",
+        order_index: 2,
+        objects: ["binding_lifecycle_record"],
+        invariants: [
+          "predecessor_and_successor_linkage_is_preserved",
+          "revocation_history_remains_visible"
+        ]
+      },
+      {
+        layer_id: "proof_followthrough",
+        order_index: 3,
+        objects: ["binding_lifecycle_record"],
+        invariants: [
+          "binding_lineage_can_be_carried_into_proof_without_becoming_proof_truth_itself",
+          "optional_proof_and_anchor_refs_do_not_change_base_binding_meaning"
+        ]
+      }
+    ],
+    invariants: [
+      "binding_state_changes_are_explicit_and_versioned",
+      "rotation_preserves_lineage",
+      "revocation_preserves_auditability",
+      "delegated_signing_remains_bounded",
+      "binding_lifecycle_is_a_proof_followthrough_concept_not_a_general_web_token_story"
+    ],
+    linked_surfaces: {
+      identity_binding_proof_ref: "/v1/phases/phase-4/identity-registry/proof",
+      identity_binding_proof_summary_ref: "/v1/phases/phase-4/identity-registry/proof/summary",
+      attestation_proof_ref: "/v1/phases/phase-4/attestation/proof",
+      trust_portability_ref: "/v1/proof-center/trust-portability",
+      trust_portability_summary_ref: "/v1/proof-center/trust-portability/summary"
+    },
+    claim_boundary: "claim_the_xoonya_binding_lifecycle_followthrough_only_without_claiming_universal_external_identity_authority_or_custody_truth"
+  };
+}
+
+function summarizeAuthorityBindingLifecycleContractPack() {
+  const pack = buildAuthorityBindingLifecycleContractPack();
+  return {
+    ok: true,
+    product: pack.product,
+    category: pack.category,
+    summary_version: "naxytra-authority-binding-lifecycle-contract-summary-v1",
+    pack_version: pack.pack_version,
+    model_state: pack.model_state,
+    binding_kind_count: pack.binding_kinds.length,
+    lifecycle_state_count: pack.lifecycle_states.length,
+    canonical_object_count: pack.canonical_objects.length,
+    transition_rule_count: pack.transition_rules.length,
+    delegated_signing_rule_count: pack.delegated_signing_rules.length,
+    linked_surfaces: pack.linked_surfaces
+  };
+}
+
+function getAuthorityBindingKindDetail(bindingKind) {
+  const normalized = String(bindingKind || "").trim().toLowerCase();
+  return (buildAuthorityBindingLifecycleContractPack().binding_kinds || []).find((entry) => entry.binding_kind === normalized) || null;
+}
+
+function getAuthorityLifecycleStateDetail(state) {
+  const normalized = String(state || "").trim().toLowerCase();
+  return (buildAuthorityBindingLifecycleContractPack().lifecycle_states || []).find((entry) => entry.state === normalized) || null;
+}
+
+module.exports = {
+  buildAuthorityBindingLifecycleContractPack,
+  summarizeAuthorityBindingLifecycleContractPack,
+  getAuthorityBindingKindDetail,
+  getAuthorityLifecycleStateDetail
+};

package/lib/crypto_agility_matrix.js

@@ -0,0 +1,125 @@
+"use strict";
+
+const packageJson = require("../package.json");
+
+function buildCryptoAgilityMatrixPack() {
+  return {
+    ok: true,
+    product: packageJson.name,
+    category: "naxytra-crypto-agility-matrix",
+    pack_version: "naxytra-crypto-agility-matrix-v1",
+    doctrine: "xoonya_verifies_crypto_agility_boundaries_without_claiming_unverified_future_algorithms_as_current_proof_truth",
+    model_state: "core_now",
+    core_claim: "the proof stack must be explicit about which algorithms are core today, supported today, future lane, blocked, or never core",
+    lane_classes: [
+      {
+        lane_class: "core_today",
+        description: "verified and claimable today",
+        items: [
+          "sha256_domain_separated_commitments",
+          "ed25519",
+          "secp256k1",
+          "p256",
+          "native_anchor_binding",
+          "line_rate_transport_frame"
+        ]
+      },
+      {
+        lane_class: "supported_today",
+        description: "supported as interop or external verification lanes today",
+        items: [
+          "jwt",
+          "jws",
+          "jwk",
+          "did",
+          "vc",
+          "sd_jwt_vc",
+          "webauthn_cose_when_verifier_present"
+        ]
+      },
+      {
+        lane_class: "future_lane",
+        description: "explicit future cryptographic direction, not claimable as the current core",
+        items: [
+          "ml_dsa",
+          "slh_dsa",
+          "xoonya_native_hybrid_v1",
+          "xoonya_native_atom_v2"
+        ]
+      },
+      {
+        lane_class: "blocked_until_vectors",
+        description: "not claimable until validators and vectors exist",
+        items: [
+          "webauthn_cose",
+          "dilithium",
+          "falcon",
+          "sphincs_plus"
+        ]
+      },
+      {
+        lane_class: "never_core",
+        description: "must never become implicit or silent core behavior",
+        items: [
+          "silent_algorithm_negotiation",
+          "implicit_downgrade",
+          "unversioned_signature_assumptions",
+          "hidden_verifier_boundaries"
+        ]
+      }
+    ],
+    signature_suites: [
+      { suite_id: "ed25519", state: "core_today" },
+      { suite_id: "secp256k1", state: "core_today" },
+      { suite_id: "p256", state: "core_today" },
+      { suite_id: "webauthn-cose", state: "blocked_until_vectors" },
+      { suite_id: "dilithium", state: "blocked_until_vectors" },
+      { suite_id: "falcon", state: "blocked_until_vectors" },
+      { suite_id: "sphincs-plus", state: "blocked_until_vectors" },
+      { suite_id: "ml-dsa", state: "future_lane" },
+      { suite_id: "slh-dsa", state: "future_lane" }
+    ],
+    proof_envelope_rules: [
+      "signature_suite_must_be_explicit",
+      "unsupported_suites_must_not_be_claimed_as_verified",
+      "native_proof_methods_remain_optional",
+      "envelopes_must_not_redefine_receipt_validity",
+      "envelope_claims_must_stay_bounded_to_verified_behavior"
+    ],
+    linked_surfaces: {
+      native_standard_ref: "/v1/proof-center/native-standard",
+      native_standard_summary_ref: "/v1/proof-center/native-standard/summary",
+      native_atom_spec_ref: "/v1/proof-center/native-atom-spec",
+      native_payload_profile_ref: "/v1/proof-center/native-payload-profile",
+      native_anchor_profile_ref: "/v1/proof-center/native-anchor-profile"
+    },
+    claim_boundary: "claim_the_crypto_agility_policy_for_xoonya_only_without_claiming_unverified_future_algorithms_as_current_core_truth"
+  };
+}
+
+function summarizeCryptoAgilityMatrixPack() {
+  const pack = buildCryptoAgilityMatrixPack();
+  return {
+    ok: true,
+    product: pack.product,
+    category: pack.category,
+    summary_version: "naxytra-crypto-agility-matrix-summary-v1",
+    pack_version: pack.pack_version,
+    model_state: pack.model_state,
+    lane_class_count: pack.lane_classes.length,
+    signature_suite_count: pack.signature_suites.length,
+    rule_count: pack.proof_envelope_rules.length,
+    linked_surfaces: pack.linked_surfaces
+  };
+}
+
+function getCryptoAgilitySuiteDetail(suiteId) {
+  const normalized = String(suiteId || "").trim().toLowerCase();
+  return (buildCryptoAgilityMatrixPack().signature_suites || []).find((entry) => entry.suite_id === normalized) || null;
+}
+
+module.exports = {
+  buildCryptoAgilityMatrixPack,
+  summarizeCryptoAgilityMatrixPack,
+  getCryptoAgilitySuiteDetail
+};

package/lib/machine_identity_registry_contract.js

@@ -0,0 +1,199 @@
+"use strict";
+
+const packageJson = require("../package.json");
+
+function buildMachineIdentityRegistryContractPack() {
+  return {
+    ok: true,
+    product: packageJson.name,
+    category: "naxytra-machine-identity-registry-contract",
+    pack_version: "naxytra-machine-identity-registry-contract-v1",
+    doctrine: "xoonya_reviews_machine_identity_state_as_proof_linked_followthrough_without_claiming_identity_session_or_custody_truth",
+    model_state: "core_now",
+    core_claim: "the machine identity registry is the proof-linked state machine for subject, key, delegation, attestation, and revocation followthrough",
+    canonical_objects: [
+      {
+        object_id: "machine_identity_record",
+        role: "versioned_commitment_backed_registry_record_for_a_machine_subject",
+        required_fields: [
+          "version",
+          "registry_record_id",
+          "registry_scope",
+          "subject_kind",
+          "subject_id",
+          "record_type",
+          "status",
+          "issuer_id",
+          "issued_at_ns",
+          "commitment_hash"
+        ],
+        recommended_fields: [
+          "updated_at_ns",
+          "public_key_ref",
+          "delegation_ref",
+          "revocation_ref",
+          "proof_ref",
+          "anchor_ref"
+        ],
+        optional_fields: [
+          "controller_id",
+          "parent_record_id",
+          "previous_record_id",
+          "subject_ref",
+          "trust_state",
+          "metadata"
+        ],
+        primary_surfaces: [
+          "/v1/phases/phase-4/identity-registry/proof",
+          "/v1/phases/phase-4/identity-registry/proof/summary",
+          "/v1/phases/phase-4/attestation/proof",
+          "/v1/proof-center/trust-portability",
+          "/v1/proof-center/trust-portability/summary"
+        ]
+      }
+    ],
+    subject_kinds: [
+      {
+        subject_kind: "agent",
+        description: "a software agent or operator-facing autonomous identity"
+      },
+      {
+        subject_kind: "service",
+        description: "a runtime service or machine-facing backend identity"
+      },
+      {
+        subject_kind: "device",
+        description: "a physical or embedded device identity"
+      },
+      {
+        subject_kind: "key",
+        description: "a bound public-key or credential identity"
+      },
+      {
+        subject_kind: "delegation",
+        description: "a delegated authority or capability identity"
+      },
+      {
+        subject_kind: "attestation",
+        description: "an attestation-linked identity or evidence binding"
+      }
+    ],
+    record_types: [
+      {
+        record_type: "identity_attestation",
+        description: "binds a subject to an attested identity state"
+      },
+      {
+        record_type: "registry_link",
+        description: "binds a subject into a registry scope or registry graph"
+      },
+      {
+        record_type: "key_binding",
+        description: "binds a subject to one or more active key references"
+      },
+      {
+        record_type: "delegation_grant",
+        description: "records that authority or capability has been delegated"
+      },
+      {
+        record_type: "delegation_revocation",
+        description: "records that a delegation has been revoked or retired"
+      },
+      {
+        record_type: "trust_state_update",
+        description: "records a trust, access, or permission-state update"
+      },
+      {
+        record_type: "device_registration",
+        description: "records a device subject into the registry"
+      },
+      {
+        record_type: "service_registration",
+        description: "records a service subject into the registry"
+      },
+      {
+        record_type: "agent_registration",
+        description: "records an agent subject into the registry"
+      }
+    ],
+    lineage_model: [
+      {
+        layer_id: "subject_review",
+        order_index: 1,
+        objects: ["machine_identity_record"],
+        invariants: [
+          "the_registry_subject_is_reviewable_in_proof_form",
+          "the_registry_record_is_commitment_backed_and_versioned"
+        ]
+      },
+      {
+        layer_id: "trust_portability",
+        order_index: 2,
+        objects: ["machine_identity_record"],
+        invariants: [
+          "keys_delegations_and_attestations_can_be_reviewed_across_bounded_lanes",
+          "revocation_and_status_changes_remain_explicit"
+        ]
+      },
+      {
+        layer_id: "proof_followthrough",
+        order_index: 3,
+        objects: ["machine_identity_record"],
+        invariants: [
+          "the_registry_record_can_be_carried_into_proof_without_becoming_a_new_identity_standard",
+          "anchor_and_proof_refs_are_followthrough_layers_not_identity_truth_itself"
+        ]
+      }
+    ],
+    invariants: [
+      "commitment_hash_is_derived_from_the_canonical_registry_record",
+      "registry_record_id_is_stable_and_replay_safe",
+      "status_changes_are_explicit_and_versioned",
+      "optional_proof_anchor_and_revocation_refs_do_not_change_base_registry_record_meaning",
+      "machine_identity_is_a_shared_control_plane_substrate_not_a_generic_web_claim_container"
+    ],
+    linked_surfaces: {
+      identity_registry_proof_ref: "/v1/phases/phase-4/identity-registry/proof",
+      identity_registry_proof_summary_ref: "/v1/phases/phase-4/identity-registry/proof/summary",
+      attestation_proof_ref: "/v1/phases/phase-4/attestation/proof",
+      trust_portability_ref: "/v1/proof-center/trust-portability",
+      trust_portability_summary_ref: "/v1/proof-center/trust-portability/summary"
+    },
+    claim_boundary: "claim_the_machine_identity_registry_proof_followthrough_only_without_claiming_universal_external_identity_session_or_custody_truth"
+  };
+}
+
+function summarizeMachineIdentityRegistryContractPack() {
+  const pack = buildMachineIdentityRegistryContractPack();
+  return {
+    ok: true,
+    product: pack.product,
+    category: pack.category,
+    summary_version: "naxytra-machine-identity-registry-contract-summary-v1",
+    pack_version: pack.pack_version,
+    model_state: pack.model_state,
+    subject_kind_count: pack.subject_kinds.length,
+    record_type_count: pack.record_types.length,
+    canonical_object_count: pack.canonical_objects.length,
+    layer_count: pack.lineage_model.length,
+    invariant_count: pack.invariants.length,
+    linked_surfaces: pack.linked_surfaces
+  };
+}
+
+function getMachineIdentitySubjectKindDetail(subjectKind) {
+  const normalized = String(subjectKind || "").trim().toLowerCase();
+  return (buildMachineIdentityRegistryContractPack().subject_kinds || []).find((entry) => entry.subject_kind === normalized) || null;
+}
+
+function getMachineIdentityRecordTypeDetail(recordType) {
+  const normalized = String(recordType || "").trim().toLowerCase();
+  return (buildMachineIdentityRegistryContractPack().record_types || []).find((entry) => entry.record_type === normalized) || null;
+}
+
+module.exports = {
+  buildMachineIdentityRegistryContractPack,
+  summarizeMachineIdentityRegistryContractPack,
+  getMachineIdentitySubjectKindDetail,
+  getMachineIdentityRecordTypeDetail
+};

package/lib/offline_verifiability_recovery_contract.js

@@ -0,0 +1,155 @@
+"use strict";
+
+const packageJson = require("../package.json");
+
+function buildOfflineVerifiabilityRecoveryContractPack() {
+  return {
+    ok: true,
+    product: packageJson.name,
+    category: "naxytra-offline-verifiability-recovery-contract",
+    pack_version: "naxytra-offline-verifiability-recovery-contract-v1",
+    doctrine: "xoonya_keeps_evidence_verifiable_and_recoverable_when_live_provider_paths_are_unavailable",
+    model_state: "core_now",
+    core_claim: "offline mode remains a bounded operational mode with explicit verification restore and evidence lineage rules",
+    offline_states: [
+      { state: "online", description: "normal live operation" },
+      { state: "degraded", description: "limited live capability but still operational" },
+      { state: "offline_verify_only", description: "local evidence verification without live provider dependence" },
+      { state: "restore_pending", description: "durable data is being restored or validated" },
+      { state: "restored", description: "state has been restored and revalidated" }
+    ],
+    verifiable_offline_inputs: [
+      "operational_receipts",
+      "proof_bundles",
+      "registry_records",
+      "identity_or_authority_bindings",
+      "release_and_provenance_artifacts",
+      "checksum_or_hash_manifests"
+    ],
+    recovery_inputs: [
+      "receipts",
+      "proof_bundles",
+      "registry_snapshots",
+      "operator_notes_where_required",
+      "release_evidence",
+      "backup_manifests"
+    ],
+    recovery_rules: [
+      "backups_must_be_versioned",
+      "restore_targets_must_be_explicit",
+      "restore_actions_must_be_replayable_or_at_least_auditable",
+      "restored_state_must_preserve_evidence_lineage",
+      "restore_procedures_must_not_silently_rewrite_the_canonical_record"
+    ],
+    offline_verification_rules: [
+      "local_verification_must_not_depend_on_live_provider_truth_for_the_base_evidence_record",
+      "imported_evidence_must_keep_its_source_boundary_explicit",
+      "cryptographic_checks_must_be_deterministic",
+      "if_an_external_claim_cannot_be_verified_locally_that_limitation_must_be_recorded"
+    ],
+    canonical_objects: [
+      {
+        object_id: "offline_verification_record",
+        role: "local_verification_or_restore_state_record",
+        required_fields: [
+          "version",
+          "state",
+          "record_id",
+          "created_at_iso",
+          "actor_id",
+          "evidence_refs"
+        ],
+        recommended_fields: [
+          "backup_ref",
+          "restore_ref",
+          "proof_ref",
+          "registry_snapshot_ref",
+          "hash_manifest_ref"
+        ],
+        optional_fields: [
+          "limitation_notes",
+          "metadata"
+        ],
+        primary_surfaces: [
+          "/v1/proof-truth",
+          "/v1/proof-truth/summary",
+          "/v1/provenance",
+          "/v1/provenance/summary",
+          "/v1/security-reliability-drills"
+        ]
+      }
+    ],
+    lineage_model: [
+      {
+        layer_id: "offline_verification",
+        order_index: 1,
+        objects: ["offline_verification_record"],
+        invariants: [
+          "local_verification_can_run_without_live_provider_truth",
+          "evidence_boundary_remains_explicit"
+        ]
+      },
+      {
+        layer_id: "restore_and_replay",
+        order_index: 2,
+        objects: ["offline_verification_record"],
+        invariants: [
+          "restores_preserve_lineage",
+          "restore_state_is_auditable"
+        ]
+      },
+      {
+        layer_id: "post_restore_followthrough",
+        order_index: 3,
+        objects: ["offline_verification_record"],
+        invariants: [
+          "restored_state_can_rejoin_live_operation_after_revalidation",
+          "offline_verification_does_not_redefine_core_truth"
+        ]
+      }
+    ],
+    invariants: [
+      "offline_mode_is_bounded",
+      "restore_events_are_evidence_events",
+      "local_verification_does_not_require_live_provider_truth_for_base_evidence",
+      "restore_procedures_preserve_lineage",
+      "offline_verification_is_a_proof_followthrough_mode_not_a_new_proof_standard"
+    ],
+    linked_surfaces: {
+      proof_truth_ref: "/v1/proof-truth",
+      proof_truth_summary_ref: "/v1/proof-truth/summary",
+      provenance_ref: "/v1/provenance",
+      security_reliability_drills_ref: "/v1/security-reliability-drills",
+      release_verification_receipt_ref: "/v1/release-verification-receipt"
+    },
+    claim_boundary: "claim_the_offline_verification_and_recovery_followthrough_only_without_claiming_live_provider_truth_or_universal_availability"
+  };
+}
+
+function summarizeOfflineVerifiabilityRecoveryContractPack() {
+  const pack = buildOfflineVerifiabilityRecoveryContractPack();
+  return {
+    ok: true,
+    product: pack.product,
+    category: pack.category,
+    summary_version: "naxytra-offline-verifiability-recovery-contract-summary-v1",
+    pack_version: pack.pack_version,
+    model_state: pack.model_state,
+    offline_state_count: pack.offline_states.length,
+    offline_input_count: pack.verifiable_offline_inputs.length,
+    recovery_input_count: pack.recovery_inputs.length,
+    rule_count: pack.recovery_rules.length,
+    linked_surfaces: pack.linked_surfaces
+  };
+}
+
+function getOfflineStateDetail(state) {
+  const normalized = String(state || "").trim().toLowerCase();
+  return (buildOfflineVerifiabilityRecoveryContractPack().offline_states || []).find((entry) => entry.state === normalized) || null;
+}
+
+module.exports = {
+  buildOfflineVerifiabilityRecoveryContractPack,
+  summarizeOfflineVerifiabilityRecoveryContractPack,
+  getOfflineStateDetail
+};