xoonya 3.0.1 → 3.1.1

package/scripts/verify_forgery_resistance.js

@@ -0,0 +1,281 @@
+"use strict";
+
+// Forgery-resistance checks for the xoonya proof engine.
+//
+// This script talks to proof_sdk.js directly (no HTTP server) and pins down:
+//   (a) key substitution: a proof signed by key B that claims key A's identity
+//       self-verifies WITHOUT a trust root (known limitation, documented here)
+//       and is rejected WITH a trust root pinned to key A;
+//   (b) external methods are structural-only and fail under strict mode;
+//   (c) the default digest method is digest-only and fails under strict mode;
+//   (d) hybrid ed25519+ml-dsa-65: tampered PQ signature is rejected, and a
+//       wrong pinned PQ ref yields native_hybrid_public_key_not_trusted;
+//   (e) results are deterministic across repeated runs for the same inputs.
+
+const assert = require("assert");
+const crypto = require("crypto");
+const sdk = require("../proof_sdk.js");
+
+function canonicalize(value) {
+  if (Array.isArray(value)) {
+    return `[${value.map((item) => canonicalize(item)).join(",")}]`;
+  }
+  if (value && typeof value === "object") {
+    const keys = Object.keys(value).sort();
+    return `{${keys.map((key) => `${JSON.stringify(key)}:${canonicalize(value[key])}`).join(",")}}`;
+  }
+  return JSON.stringify(value);
+}
+
+function pem(key, type) {
+  return key.export({ type, format: "pem" });
+}
+
+function tamperBase64url(value) {
+  const last = value.slice(-1);
+  return `${value.slice(0, -1)}${last === "A" ? "B" : "A"}`;
+}
+
+const event = {
+  version: "canonical-event-bundle/v1",
+  domain_id: "forgery.resistance",
+  sequence: "1",
+  actor_id: "alice",
+  adapter_source: "verify_forgery_resistance",
+  event_type: "proof.forgery.probe",
+  event_hash: "cd".repeat(32)
+};
+const ALICE_IDENTITY_REF = "did:xoonya:alice";
+
+function signedReceiptFor(keyPair) {
+  return sdk.emitReceipt(event, {
+    agent_identity: "alice",
+    algorithm: "xoonya-native-signed-v1",
+    identity_ref: ALICE_IDENTITY_REF,
+    signature_suite: "ed25519",
+    private_key_pem: pem(keyPair.privateKey, "pkcs8"),
+    public_key_pem: pem(keyPair.publicKey, "spki")
+  });
+}
+
+function bundleFor(receipt) {
+  return sdk.buildProofBundle({ ceb: event, receipt });
+}
+
+function checkKeySubstitution() {
+  const keyA = crypto.generateKeyPairSync("ed25519");
+  const keyB = crypto.generateKeyPairSync("ed25519");
+  const receiptA = signedReceiptFor(keyA);
+  const receiptB = signedReceiptFor(keyB);
+  const refA = receiptA.native_proof.public_key_ref;
+  const refB = receiptB.native_proof.public_key_ref;
+  assert.notStrictEqual(refA, refB, "distinct keys must produce distinct public_key_ref values");
+  assert.strictEqual(receiptB.native_proof.identity_ref, ALICE_IDENTITY_REF, "key B proof claims alice's identity_ref");
+
+  // Known limitation: without a verifier-supplied trust root, public_key_ref is only
+  // self-bound to the carried key material, so key B can claim alice's identity.
+  const substitutionWithoutRoot = sdk.verifyProofBundle(bundleFor(receiptB));
+  assert.strictEqual(substitutionWithoutRoot.valid, true, "key substitution self-verifies without a trust root (documented limitation)");
+  assert.strictEqual(substitutionWithoutRoot.verification_class, "cryptographic", "native signed class must be cryptographic");
+  assert.strictEqual(substitutionWithoutRoot.cryptographically_verified, true, "native signed proof must report cryptographic verification");
+  assert.strictEqual(substitutionWithoutRoot.trust_root_applied, false, "trust_root_applied must be false without a trust root");
+  assert.strictEqual(substitutionWithoutRoot.public_key_ref, refB, "verify result must surface the signing key ref so callers can pin it");
+
+  const trustRoot = { trusted_public_key_refs: { [ALICE_IDENTITY_REF]: refA } };
+  const substitutionWithRoot = sdk.verifyProofBundle(bundleFor(receiptB), trustRoot);
+  assert.strictEqual(substitutionWithRoot.valid, false, "key substitution must be rejected with a pinned trust root");
+  assert.strictEqual(substitutionWithRoot.reason, "native_public_key_not_trusted", "key substitution rejection reason mismatch");
+  assert.strictEqual(substitutionWithRoot.trust_root_applied, true, "trust_root_applied must be true with a trust root");
+  assert.strictEqual(substitutionWithRoot.cryptographically_verified, false, "rejected result must not claim cryptographic verification");
+
+  const genuineWithRoot = sdk.verifyProofBundle(bundleFor(receiptA), trustRoot);
+  assert.strictEqual(genuineWithRoot.valid, true, "genuine key A proof must verify with trust root pinned to key A");
+  assert.strictEqual(genuineWithRoot.trust_root_applied, true, "genuine trust_root_applied mismatch");
+
+  const genuineArrayRoot = sdk.verifyProofBundle(bundleFor(receiptA), { trusted_public_key_refs: { [ALICE_IDENTITY_REF]: [refB, refA] } });
+  assert.strictEqual(genuineArrayRoot.valid, true, "array-valued trust root must accept any listed ref");
+
+  const expectedRefRoot = sdk.verifyProofBundle(bundleFor(receiptB), { expected_public_key_ref: refA });
+  assert.strictEqual(expectedRefRoot.reason, "native_public_key_not_trusted", "expected_public_key_ref must reject key B");
+  assert.strictEqual(sdk.verifyProofBundle(bundleFor(receiptA), { expected_public_key_ref: refA }).valid, true, "expected_public_key_ref must accept key A");
+
+  const unknownIdentityRoot = sdk.verifyProofBundle(bundleFor(receiptA), { trusted_public_key_refs: { "did:xoonya:bob": refA } });
+  assert.strictEqual(unknownIdentityRoot.reason, "native_public_key_not_trusted", "identity absent from trust root must fail closed");
+
+  const hybridOnlyRoot = sdk.verifyProofBundle(bundleFor(receiptA), { expected_pq_public_key_ref: "ml-dsa-65-spki-sha256:" + "00".repeat(32) });
+  assert.strictEqual(hybridOnlyRoot.reason, "native_public_key_not_trusted", "a PQ-only pin against a classical-only proof must fail closed");
+
+  const strictGenuine = sdk.verifyProofBundle(bundleFor(receiptA), { ...trustRoot, strict: true });
+  assert.strictEqual(strictGenuine.valid, true, "cryptographic class must pass strict mode");
+  return { refA, refB };
+}
+
+function checkExternalStructural() {
+  const methods = ["jwt-assertion-v1", "did-vc-v1", "sd-jwt-vc-v1", "signed-envelope-v1", "partner-proof-envelope-v1", "detached-assertion-v1"];
+  for (const methodId of methods) {
+    const receipt = sdk.emitReceipt(event, {
+      agent_identity: "alice",
+      algorithm: methodId,
+      signature: `garbage-signature-${crypto.randomBytes(8).toString("hex")}`
+    });
+    const relaxed = sdk.verifyProofBundle(bundleFor(receipt));
+    assert.strictEqual(relaxed.valid, true, `${methodId} garbage signature is accepted structurally by default`);
+    assert.strictEqual(relaxed.verification_class, "structural", `${methodId} class must be structural`);
+    assert.strictEqual(relaxed.cryptographically_verified, false, `${methodId} must not claim cryptographic verification`);
+    const strict = sdk.verifyProofBundle(bundleFor(receipt), { strict: true });
+    assert.strictEqual(strict.valid, false, `${methodId} must fail under strict verification`);
+    assert.strictEqual(strict.reason, "external_verification_required", `${methodId} strict rejection reason mismatch`);
+    assert.strictEqual(strict.verification_class, "structural", `${methodId} strict class mismatch`);
+  }
+}
+
+function checkDigestDefault() {
+  const receipt = sdk.emitReceipt(event, { agent_identity: "alice" });
+  assert.strictEqual(receipt.algorithm, "xoonya-native-sha256-v1", "default receipt method mismatch");
+  const relaxed = sdk.verifyProofBundle(bundleFor(receipt));
+  assert.strictEqual(relaxed.valid, true, "digest bundle verifies by default");
+  assert.strictEqual(relaxed.verification_class, "digest", "digest class mismatch");
+  assert.strictEqual(relaxed.cryptographically_verified, false, "digest must not claim cryptographic verification");
+
+  // Anyone can forge a digest receipt for any identity: there is no key involved.
+  const forged = sdk.emitReceipt(event, { agent_identity: "alice" });
+  assert.strictEqual(forged.signature, receipt.signature, "digest receipts are reproducible by anyone who knows the event");
+
+  const strict = sdk.verifyProofBundle(bundleFor(receipt), { strict: true });
+  assert.strictEqual(strict.valid, false, "digest bundle must fail under strict verification");
+  assert.strictEqual(strict.reason, "digest_only_not_cryptographically_verified", "strict digest reason mismatch");
+
+  const previous = process.env.XOONYA_STRICT_VERIFY;
+  process.env.XOONYA_STRICT_VERIFY = "1";
+  try {
+    const envStrict = sdk.verifyProofBundle(bundleFor(receipt));
+    assert.strictEqual(envStrict.valid, false, "XOONYA_STRICT_VERIFY=1 must enable strict mode globally");
+    assert.strictEqual(envStrict.strict, true, "env strict flag must echo in the result");
+  } finally {
+    if (previous === undefined) delete process.env.XOONYA_STRICT_VERIFY;
+    else process.env.XOONYA_STRICT_VERIFY = previous;
+  }
+}
+
+function checkHybrid() {
+  const classical = crypto.generateKeyPairSync("ed25519");
+  const pq = crypto.generateKeyPairSync("ml-dsa-65");
+  const receipt = sdk.emitReceipt(event, {
+    agent_identity: "alice",
+    algorithm: "xoonya-native-hybrid-v1",
+    identity_ref: ALICE_IDENTITY_REF,
+    classical_signature_suite: "ed25519",
+    pq_signature_suite: "ml-dsa-65",
+    classical_public_key_pem: pem(classical.publicKey, "spki"),
+    classical_private_key_pem: pem(classical.privateKey, "pkcs8"),
+    pq_public_key_pem: pem(pq.publicKey, "spki"),
+    pq_private_key_pem: pem(pq.privateKey, "pkcs8")
+  });
+  const bundle = bundleFor(receipt);
+  const genuine = sdk.verifyProofBundle(bundle);
+  assert.strictEqual(genuine.valid, true, "hybrid bundle must verify");
+  assert.strictEqual(genuine.verification_class, "cryptographic", "hybrid class must be cryptographic");
+  assert.strictEqual(genuine.cryptographically_verified, true, "hybrid must report cryptographic verification");
+  assert.strictEqual(genuine.classical_public_key_ref, receipt.native_proof.classical_public_key_ref, "hybrid classical ref surfaced");
+  assert.strictEqual(genuine.pq_public_key_ref, receipt.native_proof.pq_public_key_ref, "hybrid pq ref surfaced");
+
+  const tamperedPqSignature = tamperBase64url(receipt.native_proof.proof_material.pq_signature);
+  const tamperedReceipt = {
+    ...receipt,
+    native_proof: {
+      ...receipt.native_proof,
+      proof_material: { ...receipt.native_proof.proof_material, pq_signature: tamperedPqSignature }
+    },
+    signature: `xoonya-native-hybrid-v1:${receipt.native_proof.hybrid_suite}:${receipt.native_proof.proof_material.classical_signature}.${tamperedPqSignature}`
+  };
+  const tampered = sdk.verifyProofBundle(bundleFor(tamperedReceipt));
+  assert.strictEqual(tampered.valid, false, "tampered PQ signature must be rejected");
+  assert.strictEqual(tampered.reason, "native_hybrid_pq_signature_invalid", "tampered PQ signature reason mismatch");
+  assert.strictEqual(tampered.cryptographically_verified, false, "tampered hybrid must not claim cryptographic verification");
+
+  const wrongPqRef = `ml-dsa-65-spki-sha256:${"11".repeat(32)}`;
+  const wrongPqPinned = sdk.verifyProofBundle(bundle, {
+    trusted_public_key_refs: { [ALICE_IDENTITY_REF]: { classical: genuine.classical_public_key_ref, pq: wrongPqRef } }
+  });
+  assert.strictEqual(wrongPqPinned.valid, false, "wrong pinned PQ ref must be rejected");
+  assert.strictEqual(wrongPqPinned.reason, "native_hybrid_public_key_not_trusted", "wrong PQ pin reason mismatch");
+  assert.strictEqual(wrongPqPinned.trust_root_applied, true, "hybrid trust_root_applied mismatch");
+
+  const wrongExpectedPq = sdk.verifyProofBundle(bundle, { expected_pq_public_key_ref: wrongPqRef });
+  assert.strictEqual(wrongExpectedPq.reason, "native_hybrid_public_key_not_trusted", "expected_pq_public_key_ref mismatch must be rejected");
+
+  const rightPinned = sdk.verifyProofBundle(bundle, {
+    trusted_public_key_refs: { [ALICE_IDENTITY_REF]: { classical: genuine.classical_public_key_ref, pq: genuine.pq_public_key_ref } },
+    strict: true
+  });
+  assert.strictEqual(rightPinned.valid, true, "correctly pinned hybrid must verify under strict mode");
+
+  const classicalOnlyPin = sdk.verifyProofBundle(bundle, { trusted_public_key_refs: { [ALICE_IDENTITY_REF]: genuine.classical_public_key_ref } });
+  assert.strictEqual(classicalOnlyPin.valid, true, "string-valued trust root pins the classical lane of a hybrid proof");
+
+  const otherClassical = crypto.generateKeyPairSync("ed25519");
+  const otherClassicalRef = sdk.emitReceipt(event, {
+    agent_identity: "alice",
+    algorithm: "xoonya-native-signed-v1",
+    identity_ref: ALICE_IDENTITY_REF,
+    signature_suite: "ed25519",
+    private_key_pem: pem(otherClassical.privateKey, "pkcs8"),
+    public_key_pem: pem(otherClassical.publicKey, "spki")
+  }).native_proof.public_key_ref;
+  const wrongClassicalPin = sdk.verifyProofBundle(bundle, { trusted_public_key_refs: { [ALICE_IDENTITY_REF]: otherClassicalRef } });
+  assert.strictEqual(wrongClassicalPin.reason, "native_hybrid_public_key_not_trusted", "wrong classical pin on hybrid must be rejected");
+  return bundle;
+}
+
+function checkDeterminism(hybridBundle, refs) {
+  const keyA = crypto.generateKeyPairSync("ed25519");
+  const signedBundle = bundleFor(signedReceiptFor(keyA));
+  const digestBundle = bundleFor(sdk.emitReceipt(event, { agent_identity: "alice" }));
+  const externalBundle = bundleFor(sdk.emitReceipt(event, { agent_identity: "alice", algorithm: "jwt-assertion-v1", signature: "garbage" }));
+  const cases = [
+    [signedBundle, {}],
+    [signedBundle, { strict: true }],
+    [signedBundle, { trusted_public_key_refs: { [ALICE_IDENTITY_REF]: refs.refA } }],
+    [digestBundle, {}],
+    [digestBundle, { strict: true }],
+    [externalBundle, { strict: true }],
+    [hybridBundle, {}],
+    [hybridBundle, { expected_pq_public_key_ref: "nope" }]
+  ];
+  for (const [bundle, options] of cases) {
+    const first = canonicalize(sdk.verifyProofBundle(bundle, options));
+    const second = canonicalize(sdk.verifyProofBundle(bundle, options));
+    assert.strictEqual(first, second, `verification result must be deterministic for options ${JSON.stringify(options)}`);
+  }
+}
+
+function main() {
+  const classes = sdk.listProofVerificationClasses().map((entry) => entry.id).sort();
+  assert.deepStrictEqual(classes, ["anchored_binding", "cryptographic", "digest", "structural"], "verification class registry mismatch");
+  assert.deepStrictEqual(
+    sdk.PROOF_VERIFICATION_STRICT_REJECTION_CODES.slice(),
+    ["digest_only_not_cryptographically_verified", "external_verification_required"],
+    "strict rejection code registry mismatch"
+  );
+  assert.deepStrictEqual(
+    sdk.PROOF_VERIFICATION_TRUST_ROOT_REJECTION_CODES.slice(),
+    ["native_public_key_not_trusted", "native_hybrid_public_key_not_trusted"],
+    "trust root rejection code registry mismatch"
+  );
+
+  const refs = checkKeySubstitution();
+  checkExternalStructural();
+  checkDigestDefault();
+  const hybridBundle = checkHybrid();
+  checkDeterminism(hybridBundle, refs);
+
+  console.log("xoonya verify:forgery-resistance passed");
+  console.log("key substitution without trust root: accepted (documented limitation; pin with trusted_public_key_refs)");
+  console.log("key substitution with trust root: native_public_key_not_trusted");
+  console.log("external methods under strict: external_verification_required");
+  console.log("digest method under strict: digest_only_not_cryptographically_verified");
+  console.log("hybrid tampered pq signature: native_hybrid_pq_signature_invalid");
+  console.log("hybrid wrong pq pin: native_hybrid_public_key_not_trusted");
+}
+
+main();

package/scripts/verify_service.js

@@ -1,4 +1,5 @@
 const assert = require('assert');
+const http = require('http');
 const { createServer } = require('../server.js');
 const sdk = require('../index.js');
 
@@ -1495,6 +1496,103 @@ async function main() {
     });
     assert.strictEqual(proofBundleVerify.status, 200, 'proof bundle verify route failed');
     assert.strictEqual(proofBundleVerify.json.valid, true, 'proof bundle verify payload invalid');
+    assert.strictEqual(proofBundleVerify.json.verification_class, 'digest', 'legacy proof bundle verify class mismatch');
+    assert.strictEqual(proofBundleVerify.json.cryptographically_verified, false, 'legacy proof bundle must not claim cryptographic verification');
+    assert.strictEqual(proofBundleVerify.json.strict, false, 'proof bundle verify strict flag default mismatch');
+    assert.strictEqual(proofBundleVerify.json.trust_root_applied, false, 'proof bundle verify trust root flag default mismatch');
+
+    const digestReceipt = sdk.emitReceipt(canonicalEvent, { agent_identity: 'service-digest-agent' });
+    const digestBundle = sdk.buildProofBundle({ ceb: canonicalEvent, receipt: digestReceipt });
+    const digestVerifyDefault = await postJson(baseUrl, '/v1/proof-bundles/verify', { bundle: digestBundle });
+    assert.strictEqual(digestVerifyDefault.status, 200, 'digest proof bundle verify route failed');
+    assert.strictEqual(digestVerifyDefault.json.valid, true, 'digest proof bundle must verify in default mode');
+    assert.strictEqual(digestVerifyDefault.json.verification_class, 'digest', 'digest proof bundle class mismatch');
+    const digestVerifyStrict = await postJson(baseUrl, '/v1/proof-bundles/verify', {
+      bundle: digestBundle,
+      options: { strict: true },
+    });
+    assert.strictEqual(digestVerifyStrict.status, 200, 'strict digest proof bundle verify route failed');
+    assert.strictEqual(digestVerifyStrict.json.valid, false, 'digest proof bundle must fail under strict verification');
+    assert.strictEqual(digestVerifyStrict.json.reason, 'digest_only_not_cryptographically_verified', 'strict digest rejection reason mismatch');
+    assert.strictEqual(digestVerifyStrict.json.strict, true, 'strict flag must echo in verify result');
+    assert.strictEqual(digestVerifyStrict.json.cryptographically_verified, false, 'strict digest result must not claim cryptographic verification');
+
+    const optionsResponse = await fetch(`${baseUrl}/v1/proof-bundles/verify`, { method: 'OPTIONS' });
+    assert.strictEqual(optionsResponse.status, 204, 'OPTIONS must return 204');
+    assert.strictEqual(/POST/.test(optionsResponse.headers.get('allow') || ''), true, 'OPTIONS must advertise POST in allow header');
+    const headResponse = await fetch(`${baseUrl}/health`, { method: 'HEAD' });
+    assert.strictEqual(headResponse.status, 200, 'HEAD on a known GET route must return 200');
+    assert.strictEqual((await headResponse.text()).length, 0, 'HEAD response must not carry a body');
+    assert.strictEqual(headResponse.headers.get('x-content-type-options'), 'nosniff', 'nosniff header missing');
+    assert.strictEqual(digestVerifyStrict.status, 200, 'post response status mismatch');
+    const postHeadersResponse = await fetch(`${baseUrl}/v1/proof-bundles/verify`, {
+      method: 'POST',
+      headers: { 'content-type': 'application/json' },
+      body: JSON.stringify({ bundle: digestBundle }),
+    });
+    assert.strictEqual(postHeadersResponse.headers.get('cache-control'), 'no-store', 'POST responses must be no-store');
+    await postHeadersResponse.text();
+    const badEncodingResponse = await fetch(`${baseUrl}/v1/integrations/%E0%A4%A`);
+    assert.strictEqual(badEncodingResponse.status, 400, 'invalid percent-encoding must return 400');
+    assert.strictEqual((await badEncodingResponse.json()).reason, 'invalid_path_encoding', 'invalid path encoding reason mismatch');
+    const oversizedResponse = await new Promise((resolve, reject) => {
+      const request = http.request(
+        {
+          host: '127.0.0.1',
+          port: address.port,
+          method: 'POST',
+          path: '/v1/proof-bundles/verify',
+          headers: { 'content-type': 'application/json', 'content-length': String(2 * 1024 * 1024) },
+        },
+        (response) => {
+          let raw = '';
+          response.setEncoding('utf8');
+          response.on('data', (chunk) => { raw += chunk; });
+          response.on('end', () => {
+            request.destroy();
+            resolve({ status: response.statusCode, json: JSON.parse(raw) });
+          });
+        }
+      );
+      request.on('error', reject);
+      request.flushHeaders();
+    });
+    assert.strictEqual(oversizedResponse.status, 400, 'oversized declared content-length must be rejected before the body is read');
+    assert.strictEqual(oversizedResponse.json.reason, 'request body too large', 'oversized body reason mismatch');
+
+    const previousPrivateKeyPolicy = process.env.XOONYA_ACCEPT_PRIVATE_KEY_MATERIAL;
+    process.env.XOONYA_ACCEPT_PRIVATE_KEY_MATERIAL = 'false';
+    try {
+      const privateKeyEmit = await postJson(baseUrl, '/v1/receipts/emit', {
+        event: canonicalEvent,
+        options: {
+          algorithm: 'xoonya-native-signed-v1',
+          signature_suite: 'ed25519',
+          private_key_pem: '-----BEGIN PRIVATE KEY-----\nMC4CAQAwBQYDK2VwBCIEIOPZUHPWLt9QpTQ3ub3+RyJXNZrJYHxfDJEcUZhrXIz7\n-----END PRIVATE KEY-----\n',
+          public_key_pem: '-----BEGIN PUBLIC KEY-----\nMCowBQYDK2VwAyEArnC5ARNJQFbPtc6pMrFUz2p043Nbds48Dz66+i1R5gk=\n-----END PUBLIC KEY-----\n',
+        },
+      });
+      assert.strictEqual(privateKeyEmit.status, 400, 'private key material must be rejected when policy disallows it');
+      assert.strictEqual(privateKeyEmit.json.reason, 'private_key_material_not_accepted', 'private key rejection reason mismatch');
+      assert.strictEqual(privateKeyEmit.json.field, 'options.private_key_pem', 'private key rejection field mismatch');
+      const privateKeyBuild = await postJson(baseUrl, '/v1/proof-bundles/build', {
+        ceb: canonicalEvent,
+        receipt_options: { classical_private_key_pem: 'x', pq_private_key_pem: 'y' },
+      });
+      assert.strictEqual(privateKeyBuild.status, 400, 'build route must reject private key material when policy disallows it');
+      assert.strictEqual(privateKeyBuild.json.reason, 'private_key_material_not_accepted', 'build private key rejection reason mismatch');
+      const noKeyEmit = await postJson(baseUrl, '/v1/receipts/emit', {
+        event: canonicalEvent,
+        options: { legacy_identity_material_hex: identityMaterialHex },
+      });
+      assert.strictEqual(noKeyEmit.status, 200, 'emit without private key material must still succeed under restrictive policy');
+    } finally {
+      if (previousPrivateKeyPolicy === undefined) {
+        delete process.env.XOONYA_ACCEPT_PRIVATE_KEY_MATERIAL;
+      } else {
+        process.env.XOONYA_ACCEPT_PRIVATE_KEY_MATERIAL = previousPrivateKeyPolicy;
+      }
+    }
     const defaultProofLoopRun = await postJson(baseUrl, '/v1/proof-center/default-loops/run', {
       loop_ref: 'default.proof.bundle.loop',
       event: canonicalEvent,