xoonya 3.0.1 → 3.1.1

package/proof_sdk.js

@@ -154,20 +154,29 @@ const NATIVE_SIGNATURE_SUITES = Object.freeze({
   dilithium: Object.freeze({
     id: "dilithium",
     maturity: "planned_pqc",
+    status: "deprecated_placeholder",
+    deprecated_alias_of: "ml-dsa-65",
     public_key_format: "suite_defined",
-    verification_posture: "registry_declared_not_yet_verified"
+    verification_posture: "registry_declared_not_yet_verified",
+    description: "Legacy pre-standard placeholder name. Use the implemented FIPS 204 suite `ml-dsa-65` instead; this entry never verifies."
   }),
   falcon: Object.freeze({
     id: "falcon",
     maturity: "planned_pqc",
+    status: "deprecated_placeholder",
+    deprecated_alias_of: null,
     public_key_format: "suite_defined",
-    verification_posture: "registry_declared_not_yet_verified"
+    verification_posture: "registry_declared_not_yet_verified",
+    description: "Legacy pre-standard placeholder name (FN-DSA is not yet registered). This entry never verifies."
   }),
   "sphincs-plus": Object.freeze({
     id: "sphincs-plus",
     maturity: "planned_pqc",
+    status: "deprecated_placeholder",
+    deprecated_alias_of: "slh-dsa-sha2-128f",
     public_key_format: "suite_defined",
-    verification_posture: "registry_declared_not_yet_verified"
+    verification_posture: "registry_declared_not_yet_verified",
+    description: "Legacy pre-standard placeholder name. Use the implemented FIPS 205 suite `slh-dsa-sha2-128f` instead; this entry never verifies."
   }),
   "ml-dsa-65": Object.freeze({
     id: "ml-dsa-65",
@@ -208,17 +217,23 @@ const XOONYA_NATIVE_IDENTITY_TYPES = Object.freeze({
   "05": Object.freeze({
     prefix: "05",
     id: "dilithium-public-key",
-    canonical_material: "suite-defined-pqc-public-key-bytes"
+    canonical_material: "suite-defined-pqc-public-key-bytes",
+    status: "legacy_placeholder",
+    description: "Legacy placeholder prefix reserved before FIPS 204 finalization; the implemented PQ suite is `ml-dsa-65`. No verifier binds this prefix to a live suite."
   }),
   "06": Object.freeze({
     prefix: "06",
     id: "falcon-public-key",
-    canonical_material: "suite-defined-pqc-public-key-bytes"
+    canonical_material: "suite-defined-pqc-public-key-bytes",
+    status: "legacy_placeholder",
+    description: "Legacy placeholder prefix reserved before FN-DSA standardization. No verifier binds this prefix to a live suite."
   }),
   "07": Object.freeze({
     prefix: "07",
     id: "sphincs-plus-public-key",
-    canonical_material: "suite-defined-pqc-public-key-bytes"
+    canonical_material: "suite-defined-pqc-public-key-bytes",
+    status: "legacy_placeholder",
+    description: "Legacy placeholder prefix reserved before FIPS 205 finalization; the implemented PQ suite is `slh-dsa-sha2-128f`. No verifier binds this prefix to a live suite."
   })
 });
 const EXTERNAL_PROOF_IMPORT_METHODS = Object.freeze([
@@ -229,6 +244,53 @@ const EXTERNAL_PROOF_IMPORT_METHODS = Object.freeze([
   SIGNED_ENVELOPE_METHOD,
   PARTNER_PROOF_ENVELOPE_METHOD
 ]);
+const VERIFICATION_CLASS_CRYPTOGRAPHIC = "cryptographic";
+const VERIFICATION_CLASS_DIGEST = "digest";
+const VERIFICATION_CLASS_STRUCTURAL = "structural";
+const VERIFICATION_CLASS_ANCHORED_BINDING = "anchored_binding";
+const PROOF_VERIFICATION_CLASSES = Object.freeze({
+  [VERIFICATION_CLASS_CRYPTOGRAPHIC]: Object.freeze({
+    id: VERIFICATION_CLASS_CRYPTOGRAPHIC,
+    cryptographically_verified: true,
+    strict_mode_accepted: true,
+    methods: Object.freeze([XOONYA_NATIVE_SIGNED_METHOD, XOONYA_NATIVE_HYBRID_METHOD]),
+    description: "A native classical and/or PQ signature was checked against the public key carried in the proof. Identity binding still requires a verifier-supplied trust root."
+  }),
+  [VERIFICATION_CLASS_DIGEST]: Object.freeze({
+    id: VERIFICATION_CLASS_DIGEST,
+    cryptographically_verified: false,
+    strict_mode_accepted: false,
+    methods: Object.freeze([XOONYA_NATIVE_SHA256_METHOD, LEGACY_OPRETURN_METHOD]),
+    description: "Only an unkeyed deterministic digest was recomputed. Anyone can produce a valid digest; this proves integrity and replayability, not authorship."
+  }),
+  [VERIFICATION_CLASS_ANCHORED_BINDING]: Object.freeze({
+    id: VERIFICATION_CLASS_ANCHORED_BINDING,
+    cryptographically_verified: false,
+    strict_mode_accepted: false,
+    methods: Object.freeze([XOONYA_NATIVE_ANCHORED_METHOD]),
+    description: "An unkeyed digest binding to declared anchor refs was recomputed. External anchor truth and authorship are not verified by xoonya."
+  }),
+  [VERIFICATION_CLASS_STRUCTURAL]: Object.freeze({
+    id: VERIFICATION_CLASS_STRUCTURAL,
+    cryptographically_verified: false,
+    strict_mode_accepted: false,
+    methods: Object.freeze(EXTERNAL_PROOF_IMPORT_METHODS.slice()),
+    description: "The envelope shape, method registration, and canonical receipt binding were checked. The external signature itself must be verified by the external verifier stack."
+  })
+});
+const STRICT_DIGEST_ONLY_REASON = "digest_only_not_cryptographically_verified";
+const STRICT_EXTERNAL_VERIFICATION_REASON = "external_verification_required";
+const NATIVE_PUBLIC_KEY_NOT_TRUSTED_REASON = "native_public_key_not_trusted";
+const NATIVE_HYBRID_PUBLIC_KEY_NOT_TRUSTED_REASON = "native_hybrid_public_key_not_trusted";
+const PROOF_VERIFICATION_STRICT_REJECTION_CODES = Object.freeze([
+  STRICT_DIGEST_ONLY_REASON,
+  STRICT_EXTERNAL_VERIFICATION_REASON
+]);
+const PROOF_VERIFICATION_TRUST_ROOT_REJECTION_CODES = Object.freeze([
+  NATIVE_PUBLIC_KEY_NOT_TRUSTED_REASON,
+  NATIVE_HYBRID_PUBLIC_KEY_NOT_TRUSTED_REASON
+]);
+const STRICT_VERIFY_ENV = "XOONYA_STRICT_VERIFY";
 
 function sha256Hex(buf) {
   return crypto.createHash("sha256").update(buf).digest("hex");
@@ -874,7 +936,19 @@ function buildNativeHybridProofMaterial(receipt, canonicalEvent, proofDescriptor
   };
 }
 
+const NATIVE_HYBRID_RUNTIME_SUPPORT_CACHE = new Map();
+
 function runtimeSupportsNativeHybridSuite(hybridSuiteId) {
+  const cacheKey = normalizeString(hybridSuiteId);
+  if (NATIVE_HYBRID_RUNTIME_SUPPORT_CACHE.has(cacheKey)) {
+    return NATIVE_HYBRID_RUNTIME_SUPPORT_CACHE.get(cacheKey);
+  }
+  const supported = probeNativeHybridRuntimeSupport(cacheKey);
+  NATIVE_HYBRID_RUNTIME_SUPPORT_CACHE.set(cacheKey, supported);
+  return supported;
+}
+
+function probeNativeHybridRuntimeSupport(hybridSuiteId) {
   try {
     const hybridSuite = parseNativeHybridSuite(hybridSuiteId);
     const classicalPair = hybridSuite.classical_suite.id === "secp256k1"
@@ -1053,7 +1127,162 @@ function buildNativeAnchoredReceiptProof(receipt, canonicalEvent, options = {})
   };
 }
 
-function verifyNativeSignedReceiptProof(receipt, ceb) {
+function strictVerifyEnabledByEnvironment() {
+  const raw = normalizeString(process.env[STRICT_VERIFY_ENV]).toLowerCase();
+  return raw === "1" || raw === "true";
+}
+
+function resolveProofVerificationOptions(options) {
+  const source = options && typeof options === "object" && !Array.isArray(options) ? options : {};
+  const trustedPublicKeyRefs = source.trusted_public_key_refs &&
+    typeof source.trusted_public_key_refs === "object" &&
+    !Array.isArray(source.trusted_public_key_refs)
+    ? source.trusted_public_key_refs
+    : null;
+  const expectedPublicKeyRef = normalizeString(source.expected_public_key_ref);
+  const expectedClassicalPublicKeyRef = normalizeString(source.expected_classical_public_key_ref);
+  const expectedPqPublicKeyRef = normalizeString(source.expected_pq_public_key_ref);
+  const expectedHybridPublicKeyRef = normalizeString(source.expected_hybrid_public_key_ref);
+  return {
+    __resolved_verification_options: true,
+    strict: source.strict === true || strictVerifyEnabledByEnvironment(),
+    trust_root_applied: Boolean(
+      trustedPublicKeyRefs ||
+      expectedPublicKeyRef ||
+      expectedClassicalPublicKeyRef ||
+      expectedPqPublicKeyRef ||
+      expectedHybridPublicKeyRef
+    ),
+    expected_public_key_ref: expectedPublicKeyRef,
+    expected_classical_public_key_ref: expectedClassicalPublicKeyRef,
+    expected_pq_public_key_ref: expectedPqPublicKeyRef,
+    expected_hybrid_public_key_ref: expectedHybridPublicKeyRef,
+    trusted_public_key_refs: trustedPublicKeyRefs
+  };
+}
+
+function normalizeTrustedPublicKeyRefList(value) {
+  if (value == null) return [];
+  const list = Array.isArray(value) ? value : [value];
+  return list.map((entry) => normalizeString(entry)).filter(Boolean);
+}
+
+function lookupTrustedPublicKeyEntry(trustedPublicKeyRefs, identityRef, agentIdentity) {
+  if (!trustedPublicKeyRefs) return undefined;
+  for (const candidate of [normalizeString(identityRef), normalizeString(agentIdentity)]) {
+    if (candidate && Object.prototype.hasOwnProperty.call(trustedPublicKeyRefs, candidate)) {
+      return trustedPublicKeyRefs[candidate];
+    }
+  }
+  return undefined;
+}
+
+function trustedPublicKeyRefsForLane(entry, lane) {
+  if (entry == null) return { declared: false, refs: [] };
+  if (typeof entry === "string" || Array.isArray(entry)) {
+    return lane === "classical"
+      ? { declared: true, refs: normalizeTrustedPublicKeyRefList(entry) }
+      : { declared: false, refs: [] };
+  }
+  if (typeof entry !== "object") return { declared: false, refs: [] };
+  const laneValue = lane === "classical"
+    ? (entry.classical != null ? entry.classical : (entry.classical_public_key_ref != null ? entry.classical_public_key_ref : entry.public_key_ref))
+    : lane === "pq"
+      ? (entry.pq != null ? entry.pq : entry.pq_public_key_ref)
+      : (entry.hybrid != null ? entry.hybrid : entry.hybrid_public_key_ref);
+  if (laneValue == null) return { declared: false, refs: [] };
+  return { declared: true, refs: normalizeTrustedPublicKeyRefList(laneValue) };
+}
+
+function nativeSignedPublicKeyTrusted(verification, publicKeyRef, identityRef, agentIdentity) {
+  if (!verification || !verification.trust_root_applied) return true;
+  let constrained = false;
+  if (verification.expected_public_key_ref) {
+    constrained = true;
+    if (publicKeyRef !== verification.expected_public_key_ref) return false;
+  }
+  if (verification.expected_classical_public_key_ref) {
+    constrained = true;
+    if (publicKeyRef !== verification.expected_classical_public_key_ref) return false;
+  }
+  if (verification.trusted_public_key_refs) {
+    constrained = true;
+    const entry = lookupTrustedPublicKeyEntry(verification.trusted_public_key_refs, identityRef, agentIdentity);
+    const lane = trustedPublicKeyRefsForLane(entry, "classical");
+    if (!lane.declared || !lane.refs.includes(publicKeyRef)) return false;
+  }
+  return constrained;
+}
+
+function nativeHybridPublicKeyTrusted(verification, refs, identityRef, agentIdentity) {
+  if (!verification || !verification.trust_root_applied) return true;
+  let constrained = false;
+  if (verification.expected_public_key_ref) {
+    constrained = true;
+    if (refs.classical !== verification.expected_public_key_ref && refs.hybrid !== verification.expected_public_key_ref) return false;
+  }
+  if (verification.expected_classical_public_key_ref) {
+    constrained = true;
+    if (refs.classical !== verification.expected_classical_public_key_ref) return false;
+  }
+  if (verification.expected_pq_public_key_ref) {
+    constrained = true;
+    if (refs.pq !== verification.expected_pq_public_key_ref) return false;
+  }
+  if (verification.expected_hybrid_public_key_ref) {
+    constrained = true;
+    if (refs.hybrid !== verification.expected_hybrid_public_key_ref) return false;
+  }
+  if (verification.trusted_public_key_refs) {
+    const entry = lookupTrustedPublicKeyEntry(verification.trusted_public_key_refs, identityRef, agentIdentity);
+    const classicalLane = trustedPublicKeyRefsForLane(entry, "classical");
+    const pqLane = trustedPublicKeyRefsForLane(entry, "pq");
+    const hybridLane = trustedPublicKeyRefsForLane(entry, "hybrid");
+    if (!classicalLane.declared && !pqLane.declared && !hybridLane.declared) return false;
+    if (classicalLane.declared && !classicalLane.refs.includes(refs.classical) && !classicalLane.refs.includes(refs.hybrid)) return false;
+    if (pqLane.declared && !pqLane.refs.includes(refs.pq)) return false;
+    if (hybridLane.declared && !hybridLane.refs.includes(refs.hybrid)) return false;
+    constrained = true;
+  }
+  return constrained;
+}
+
+function verificationClassForMethod(algorithm) {
+  const normalized = normalizeString(algorithm);
+  for (const entry of Object.values(PROOF_VERIFICATION_CLASSES)) {
+    if (entry.methods.includes(normalized)) return entry.id;
+  }
+  return null;
+}
+
+function listProofVerificationClasses() {
+  return Object.values(PROOF_VERIFICATION_CLASSES).map((entry) => ({ ...entry, methods: entry.methods.slice() }));
+}
+
+function finalizeProofMethodVerification(result, algorithm, verification) {
+  const verificationClass = verificationClassForMethod(algorithm);
+  const classEntry = verificationClass ? PROOF_VERIFICATION_CLASSES[verificationClass] : null;
+  const decorated = {
+    ...result,
+    verification_class: verificationClass,
+    cryptographically_verified: result.valid === true && Boolean(classEntry && classEntry.cryptographically_verified),
+    strict: verification.strict === true,
+    trust_root_applied: verification.trust_root_applied === true
+  };
+  if (decorated.valid === true && decorated.strict && classEntry && !classEntry.strict_mode_accepted) {
+    return {
+      ...decorated,
+      valid: false,
+      reason: verificationClass === VERIFICATION_CLASS_STRUCTURAL
+        ? STRICT_EXTERNAL_VERIFICATION_REASON
+        : STRICT_DIGEST_ONLY_REASON,
+      cryptographically_verified: false
+    };
+  }
+  return decorated;
+}
+
+function verifyNativeSignedReceiptProof(receipt, ceb, verification = null) {
   try {
     const proof = receipt.native_proof;
     if (!proof || typeof proof !== "object" || Array.isArray(proof)) {
@@ -1115,17 +1344,21 @@ function verifyNativeSignedReceiptProof(receipt, ceb) {
     if (!verified) {
       return { valid: false, reason: "native_signature_invalid" };
     }
+    if (!nativeSignedPublicKeyTrusted(verification, expectedPublicKeyRef, identityRef, receipt.agent_identity)) {
+      return { valid: false, reason: NATIVE_PUBLIC_KEY_NOT_TRUSTED_REASON, public_key_ref: expectedPublicKeyRef };
+    }
     return {
       valid: true,
       verification_state: "verified_native_signature",
-      signature_suite: suite.id
+      signature_suite: suite.id,
+      public_key_ref: expectedPublicKeyRef
     };
   } catch (error) {
     return { valid: false, reason: error.message };
   }
 }
 
-function verifyNativeHybridReceiptProof(receipt, ceb) {
+function verifyNativeHybridReceiptProof(receipt, ceb, verification = null) {
   try {
     const proof = receipt.native_proof;
     if (!proof || typeof proof !== "object" || Array.isArray(proof)) {
@@ -1210,10 +1443,27 @@ function verifyNativeHybridReceiptProof(receipt, ceb) {
     if (!crypto.verify(nativeSigningHashForSuite(hybridSuite.pq_suite), signingBytes, pqPublicKey, pqSignatureBytes)) {
       return { valid: false, reason: "native_hybrid_pq_signature_invalid" };
     }
+    const publicKeyRefs = {
+      classical: expectedClassicalPublicKeyRef,
+      pq: expectedPqPublicKeyRef,
+      hybrid: expectedHybridPublicKeyRef
+    };
+    if (!nativeHybridPublicKeyTrusted(verification, publicKeyRefs, identityRef, receipt.agent_identity)) {
+      return {
+        valid: false,
+        reason: NATIVE_HYBRID_PUBLIC_KEY_NOT_TRUSTED_REASON,
+        public_key_ref: expectedHybridPublicKeyRef,
+        classical_public_key_ref: expectedClassicalPublicKeyRef,
+        pq_public_key_ref: expectedPqPublicKeyRef
+      };
+    }
     return {
       valid: true,
       verification_state: "verified_native_hybrid_signature",
-      signature_suite: hybridSuite.id
+      signature_suite: hybridSuite.id,
+      public_key_ref: expectedHybridPublicKeyRef,
+      classical_public_key_ref: expectedClassicalPublicKeyRef,
+      pq_public_key_ref: expectedPqPublicKeyRef
     };
   } catch (error) {
     return { valid: false, reason: error.message };
@@ -1355,8 +1605,19 @@ function emitReceipt(event, options = {}) {
   };
 }
 
-function verifyReceiptProofMethod(receipt, ceb, bundle) {
+function verifyReceiptProofMethod(receipt, ceb, bundle, options = {}) {
+  const verification = options && options.__resolved_verification_options === true
+    ? options
+    : resolveProofVerificationOptions(options);
   const algorithm = normalizeString(receipt.algorithm);
+  return finalizeProofMethodVerification(
+    verifyReceiptProofMethodInner(receipt, ceb, bundle, algorithm, verification),
+    algorithm,
+    verification
+  );
+}
+
+function verifyReceiptProofMethodInner(receipt, ceb, bundle, algorithm, verification) {
   if (!algorithm) {
     return { valid: false, reason: "verification_method_missing" };
   }
@@ -1364,9 +1625,9 @@ function verifyReceiptProofMethod(receipt, ceb, bundle) {
     return { valid: false, reason: "verification_method_none" };
   }
   if (algorithm === XOONYA_NATIVE_HYBRID_METHOD) {
-    const verification = verifyNativeHybridReceiptProof(receipt, ceb);
-    if (!verification.valid) {
-      return { valid: false, reason: verification.reason };
+    const hybridVerification = verifyNativeHybridReceiptProof(receipt, ceb, verification);
+    if (!hybridVerification.valid) {
+      return { valid: false, reason: hybridVerification.reason };
     }
     return {
       valid: true,
@@ -1376,8 +1637,11 @@ function verifyReceiptProofMethod(receipt, ceb, bundle) {
         verification_posture: "native_hybrid_signature_verified",
         description: "Verifies xoonya's native hybrid proof envelope with a classical and PQ signature bound to one deterministic signing material."
       },
-      verification_state: verification.verification_state,
-      signature_suite: verification.signature_suite
+      verification_state: hybridVerification.verification_state,
+      signature_suite: hybridVerification.signature_suite,
+      public_key_ref: hybridVerification.public_key_ref,
+      classical_public_key_ref: hybridVerification.classical_public_key_ref,
+      pq_public_key_ref: hybridVerification.pq_public_key_ref
     };
   }
 
@@ -1428,29 +1692,30 @@ function verifyReceiptProofMethod(receipt, ceb, bundle) {
   }
 
   if (algorithm === XOONYA_NATIVE_SIGNED_METHOD) {
-    const verification = verifyNativeSignedReceiptProof(receipt, ceb);
-    if (!verification.valid) {
-      return { valid: false, reason: verification.reason };
+    const signedVerification = verifyNativeSignedReceiptProof(receipt, ceb, verification);
+    if (!signedVerification.valid) {
+      return { valid: false, reason: signedVerification.reason };
     }
     return {
       valid: true,
       method,
-      verification_state: verification.verification_state,
-      signature_suite: verification.signature_suite
+      verification_state: signedVerification.verification_state,
+      signature_suite: signedVerification.signature_suite,
+      public_key_ref: signedVerification.public_key_ref
     };
   }
 
   if (algorithm === XOONYA_NATIVE_ANCHORED_METHOD) {
-    const verification = verifyNativeAnchoredReceiptProof(receipt, ceb, bundle);
-    if (!verification.valid) {
-      return { valid: false, reason: verification.reason };
+    const anchoredVerification = verifyNativeAnchoredReceiptProof(receipt, ceb, bundle);
+    if (!anchoredVerification.valid) {
+      return { valid: false, reason: anchoredVerification.reason };
     }
     return {
       valid: true,
       method,
-      verification_state: verification.verification_state,
-      anchor_count: verification.anchor_count,
-      anchor_root_sha256: verification.anchor_root_sha256
+      verification_state: anchoredVerification.verification_state,
+      anchor_count: anchoredVerification.anchor_count,
+      anchor_root_sha256: anchoredVerification.anchor_root_sha256
     };
   }
 
@@ -1503,7 +1768,22 @@ function buildProofBundle(input) {
   };
 }
 
-function verifyProofBundle(bundle) {
+function verifyProofBundle(bundle, options = {}) {
+  const verification = resolveProofVerificationOptions(options);
+  const result = verifyProofBundleInner(bundle, verification);
+  const algorithm = bundle && bundle.receipt && typeof bundle.receipt === "object" && !Array.isArray(bundle.receipt)
+    ? bundle.receipt.algorithm
+    : null;
+  return {
+    ...result,
+    cryptographically_verified: result.cryptographically_verified === true,
+    verification_class: result.verification_class !== undefined ? result.verification_class : verificationClassForMethod(algorithm),
+    strict: verification.strict,
+    trust_root_applied: verification.trust_root_applied
+  };
+}
+
+function verifyProofBundleInner(bundle, verification) {
   try {
     if (!bundle || typeof bundle !== "object" || Array.isArray(bundle)) {
       return { valid: false, reason: "bundle_not_object" };
@@ -1549,9 +1829,14 @@ function verifyProofBundle(bundle) {
       return { valid: false, reason: "signature_missing" };
     }
 
-    const methodVerification = verifyReceiptProofMethod(receipt, ceb, bundle);
+    const methodVerification = verifyReceiptProofMethod(receipt, ceb, bundle, verification);
     if (!methodVerification.valid) {
-      return { valid: false, reason: methodVerification.reason };
+      return {
+        valid: false,
+        reason: methodVerification.reason,
+        verification_class: methodVerification.verification_class,
+        cryptographically_verified: false
+      };
     }
 
     return {
@@ -1565,7 +1850,12 @@ function verifyProofBundle(bundle) {
       verification_state: methodVerification.verification_state,
       ...(methodVerification.anchor_count != null ? { anchor_count: methodVerification.anchor_count } : {}),
       ...(methodVerification.anchor_root_sha256 ? { anchor_root_sha256: methodVerification.anchor_root_sha256 } : {}),
-      ...(methodVerification.signature_suite ? { signature_suite: methodVerification.signature_suite } : {})
+      ...(methodVerification.signature_suite ? { signature_suite: methodVerification.signature_suite } : {}),
+      ...(methodVerification.public_key_ref ? { public_key_ref: methodVerification.public_key_ref } : {}),
+      ...(methodVerification.classical_public_key_ref ? { classical_public_key_ref: methodVerification.classical_public_key_ref } : {}),
+      ...(methodVerification.pq_public_key_ref ? { pq_public_key_ref: methodVerification.pq_public_key_ref } : {}),
+      verification_class: methodVerification.verification_class,
+      cryptographically_verified: methodVerification.cryptographically_verified === true
     };
   } catch (error) {
     return { valid: false, reason: error.message };
@@ -3207,6 +3497,9 @@ function buildxoonyaNativeHybridReadinessPack() {
       atom_rule: "XNYA_atom_remains_commitment_only",
       envelope_rule: "hybrid_or_pqc_material_lives_in_proof_envelope_or_profile",
       current_deterministic_reject_reason: runtimeSupportedHybridSuites.length > 0 ? null : "native_hybrid_runtime_validator_unavailable",
+      trust_root_reject_reason: NATIVE_HYBRID_PUBLIC_KEY_NOT_TRUSTED_REASON,
+      strict_mode_reject_reasons: PROOF_VERIFICATION_STRICT_REJECTION_CODES.slice(),
+      identity_binding_rule: "public_key_ref_is_self_bound_to_carried_key_material_identity_binding_requires_verifier_supplied_trust_root",
       downgrade_rule: "hybrid_receipts_must_not_verify_as_classical_native_signed_receipts",
       claim_rule: "claim_only_registered_runtime_supported_vector_covered_hybrid_suites"
     },
@@ -6228,6 +6521,9 @@ module.exports = {
   hashEvent,
   emitReceipt,
   listProofVerificationMethods,
+  listProofVerificationClasses,
+  PROOF_VERIFICATION_STRICT_REJECTION_CODES,
+  PROOF_VERIFICATION_TRUST_ROOT_REJECTION_CODES,
   getProofVerificationMethod,
   listNativeSignatureSuites,
   getNativeSignatureSuite,

package/scripts/verify_control_plane_contracts.js

@@ -0,0 +1,34 @@
+"use strict";
+
+const assert = require("assert");
+const {
+  summarizeAdapterCertificationContractPack,
+  summarizeTrustPortabilityBoundaryContractPack,
+  summarizeSignedAuditProvenanceContractPack
+} = require("../index.js");
+
+function main() {
+  const adapterCertification = summarizeAdapterCertificationContractPack();
+  const trustPortabilityBoundary = summarizeTrustPortabilityBoundaryContractPack();
+  const signedAuditProvenance = summarizeSignedAuditProvenanceContractPack();
+
+  assert.strictEqual(adapterCertification.ok, true, "adapter certification summary failed");
+  assert.strictEqual(adapterCertification.certification_state_count >= 5, true, "adapter certification state count mismatch");
+  assert.strictEqual(adapterCertification.certification_front_count >= 8, true, "adapter certification front count mismatch");
+  assert.strictEqual(adapterCertification.required_test_category_count >= 8, true, "adapter certification test category count mismatch");
+
+  assert.strictEqual(trustPortabilityBoundary.ok, true, "trust portability boundary summary failed");
+  assert.strictEqual(trustPortabilityBoundary.portable_axis_count >= 4, true, "trust portability axis count mismatch");
+  assert.strictEqual(trustPortabilityBoundary.non_claim_count >= 4, true, "trust portability non-claim count mismatch");
+  assert.strictEqual(trustPortabilityBoundary.evidence_requirement_count >= 5, true, "trust portability evidence requirement count mismatch");
+
+  assert.strictEqual(signedAuditProvenance.ok, true, "signed audit provenance summary failed");
+  assert.strictEqual(signedAuditProvenance.evidence_surface_count >= 6, true, "signed audit provenance surface count mismatch");
+  assert.strictEqual(signedAuditProvenance.required_field_count >= 7, true, "signed audit provenance required field count mismatch");
+  assert.strictEqual(signedAuditProvenance.export_rule_count >= 4, true, "signed audit provenance export rule count mismatch");
+
+  console.log("xoonya verify:control-plane-contracts passed");
+}
+
+main();
+

package/scripts/verify_control_plane_routes.js

@@ -0,0 +1,70 @@
+"use strict";
+
+const assert = require("assert");
+const { createServer } = require("../server.js");
+
+async function getJson(baseUrl, route) {
+  const response = await fetch(`${baseUrl}${route}`);
+  return {
+    status: response.status,
+    json: await response.json()
+  };
+}
+
+async function main() {
+  const server = createServer();
+  await new Promise((resolve) => server.listen(0, "127.0.0.1", resolve));
+  const address = server.address();
+  const baseUrl = `http://127.0.0.1:${address.port}`;
+
+  try {
+    const adapterCertification = await getJson(baseUrl, "/v1/adapter-certification");
+    assert.strictEqual(adapterCertification.status, 200, "adapter certification route failed");
+    assert.strictEqual(adapterCertification.json.category, "naxytra-adapter-certification-contract", "adapter certification category mismatch");
+    assert.strictEqual(adapterCertification.json.certification_fronts.length >= 8, true, "adapter certification front count mismatch");
+
+    const adapterCertificationSummary = await getJson(baseUrl, "/v1/adapter-certification/summary");
+    assert.strictEqual(adapterCertificationSummary.status, 200, "adapter certification summary route failed");
+    assert.strictEqual(adapterCertificationSummary.json.certification_state_count >= 5, true, "adapter certification summary count mismatch");
+
+    const adapterCertificationDetail = await getJson(baseUrl, "/v1/adapter-certification/protocol_front");
+    assert.strictEqual(adapterCertificationDetail.status, 200, "adapter certification detail route failed");
+    assert.strictEqual(adapterCertificationDetail.json.front.front_id, "protocol_front", "adapter certification detail mismatch");
+
+    const trustBoundary = await getJson(baseUrl, "/v1/trust-portability-boundary");
+    assert.strictEqual(trustBoundary.status, 200, "trust portability boundary route failed");
+    assert.strictEqual(trustBoundary.json.category, "naxytra-trust-portability-boundary-contract", "trust portability boundary category mismatch");
+    assert.strictEqual(trustBoundary.json.portable_axes.length >= 4, true, "trust portability boundary axis count mismatch");
+
+    const trustBoundarySummary = await getJson(baseUrl, "/v1/trust-portability-boundary/summary");
+    assert.strictEqual(trustBoundarySummary.status, 200, "trust portability boundary summary route failed");
+    assert.strictEqual(trustBoundarySummary.json.portable_axis_count >= 4, true, "trust portability boundary summary count mismatch");
+
+    const trustBoundaryDetail = await getJson(baseUrl, "/v1/trust-portability-boundary/agent_identity_portability");
+    assert.strictEqual(trustBoundaryDetail.status, 200, "trust portability boundary detail route failed");
+    assert.strictEqual(trustBoundaryDetail.json.axis.axis_id, "agent_identity_portability", "trust portability boundary detail mismatch");
+
+    const signedAudit = await getJson(baseUrl, "/v1/signed-audit-provenance");
+    assert.strictEqual(signedAudit.status, 200, "signed audit provenance route failed");
+    assert.strictEqual(signedAudit.json.category, "naxytra-signed-audit-provenance-contract", "signed audit provenance category mismatch");
+    assert.strictEqual(signedAudit.json.evidence_surfaces.length >= 6, true, "signed audit provenance evidence surface count mismatch");
+
+    const signedAuditSummary = await getJson(baseUrl, "/v1/signed-audit-provenance/summary");
+    assert.strictEqual(signedAuditSummary.status, 200, "signed audit provenance summary route failed");
+    assert.strictEqual(signedAuditSummary.json.evidence_surface_count >= 6, true, "signed audit provenance summary count mismatch");
+
+    const signedAuditDetail = await getJson(baseUrl, "/v1/signed-audit-provenance/release_provenance");
+    assert.strictEqual(signedAuditDetail.status, 200, "signed audit provenance detail route failed");
+    assert.strictEqual(signedAuditDetail.json.surface.surface_id, "release_provenance", "signed audit provenance detail mismatch");
+  } finally {
+    await new Promise((resolve) => server.close(resolve));
+  }
+
+  console.log("xoonya verify:control-plane-routes passed");
+}
+
+main().catch((error) => {
+  console.error(error);
+  process.exit(1);
+});
+