xoonya 3.1.0 → 3.1.1

package/scripts/verify_native_hybrid_design_gate.js

@@ -1,114 +1,114 @@
-"use strict";
-
-const assert = require("assert");
-const crypto = require("crypto");
-const sdk = require("..");
-
-function runNativeHybridVerification() {
-  const readiness = sdk.summarizexoonyaNativeHybridReadinessPack();
-  assert.strictEqual(readiness.status, "implemented", "hybrid readiness must be implemented");
-  assert.strictEqual(readiness.implemented_hybrid_suite_count >= 1, true, "hybrid readiness must expose implemented suites");
-  assert.strictEqual(
-    readiness.current_decision.includes("runtime_supported"),
-    true,
-    "hybrid readiness must describe runtime-supported suites"
-  );
-
-  const event = sdk.canonicalizeEvent({
-    version: "canonical-event-bundle/v1",
-    domain_id: "hybrid.live",
-    sequence: "1",
-    actor_id: "agent-hybrid",
-    adapter_source: "verify_native_hybrid_design_gate",
-    event_type: "native.hybrid.verify",
-    event_hash: "89".repeat(32)
-  });
-
-  const classical = crypto.generateKeyPairSync("ed25519");
-  const pq = crypto.generateKeyPairSync("ml-dsa-65");
-  const receipt = sdk.emitReceipt(event, {
-    agent_identity: "agent-hybrid-signing",
-    algorithm: "xoonya-native-hybrid-v1",
-    identity_ref: "did:xoonya:agent-hybrid-signing",
-    classical_signature_suite: "ed25519",
-    pq_signature_suite: "ml-dsa-65",
-    classical_public_key_pem: classical.publicKey.export({ type: "spki", format: "pem" }),
-    classical_private_key_pem: classical.privateKey.export({ type: "pkcs8", format: "pem" }),
-    pq_public_key_pem: pq.publicKey.export({ type: "spki", format: "pem" }),
-    pq_private_key_pem: pq.privateKey.export({ type: "pkcs8", format: "pem" })
-  });
-
-  const verification = sdk.verifyProofBundle(sdk.buildProofBundle({
-    ceb: event,
-    receipt
-  }));
-  assert.strictEqual(verification.valid, true, "hybrid method must verify");
-  assert.strictEqual(
-    verification.verification_state,
-    "verified_native_hybrid_signature",
-    "hybrid method verification state mismatch"
-  );
-
-  const downgradeEvent = sdk.canonicalizeEvent({
-    version: "canonical-event-bundle/v1",
-    domain_id: "hybrid.downgrade",
-    sequence: "1",
-    actor_id: "agent-hybrid",
-    adapter_source: "verify_native_hybrid_design_gate",
-    event_type: "native.hybrid.downgrade",
-    event_hash: "90".repeat(32)
-  });
-  const detachedReceipt = sdk.emitReceipt(downgradeEvent, {
-    agent_identity: "agent-hybrid-signing",
-    algorithm: "detached-assertion-v1",
-    signature: receipt.signature
-  });
-  const downgradeVerification = sdk.verifyProofBundle(sdk.buildProofBundle({
-    ceb: downgradeEvent,
-    receipt: detachedReceipt
-  }));
-  assert.strictEqual(downgradeVerification.valid, false, "hybrid-looking signature must not verify as detached");
-  assert.strictEqual(
-    downgradeVerification.reason,
-    "signature_method_mismatch",
-    "hybrid-looking external signature must fail as method mismatch"
-  );
-
-  return {
-    ok: true,
-    product: "xoonya",
-    category: "xoonya-native-hybrid-verification",
-    method: "xoonya-native-hybrid-v1",
-    readiness_status: readiness.status,
-    implemented_hybrid_suites: readiness.implemented_hybrid_suites,
-    verification_state: verification.verification_state,
-    downgrade_reject_reason: downgradeVerification.reason,
-    boundary: "registered_runtime_supported_vector_covered_hybrid_suites_may_be_claimed"
-  };
-}
-
-function main() {
-  const json = process.argv.includes("--json");
-  const summary = runNativeHybridVerification();
-  if (json) {
-    process.stdout.write(`${JSON.stringify(summary, null, 2)}\n`);
-    return;
-  }
-  process.stdout.write(
-    [
-      "xoonya verify:native-hybrid-gate passed",
-      `method: ${summary.method}`,
-      `readiness: ${summary.readiness_status}`,
-      `verification state: ${summary.verification_state}`,
-      `downgrade reject: ${summary.downgrade_reject_reason}`
-    ].join("\n") + "\n"
-  );
-}
-
-if (require.main === module) {
-  main();
-}
-
-module.exports = {
-  runNativeHybridVerification
-};
+"use strict";
+
+const assert = require("assert");
+const crypto = require("crypto");
+const sdk = require("..");
+
+function runNativeHybridVerification() {
+  const readiness = sdk.summarizexoonyaNativeHybridReadinessPack();
+  assert.strictEqual(readiness.status, "implemented", "hybrid readiness must be implemented");
+  assert.strictEqual(readiness.implemented_hybrid_suite_count >= 1, true, "hybrid readiness must expose implemented suites");
+  assert.strictEqual(
+    readiness.current_decision.includes("runtime_supported"),
+    true,
+    "hybrid readiness must describe runtime-supported suites"
+  );
+
+  const event = sdk.canonicalizeEvent({
+    version: "canonical-event-bundle/v1",
+    domain_id: "hybrid.live",
+    sequence: "1",
+    actor_id: "agent-hybrid",
+    adapter_source: "verify_native_hybrid_design_gate",
+    event_type: "native.hybrid.verify",
+    event_hash: "89".repeat(32)
+  });
+
+  const classical = crypto.generateKeyPairSync("ed25519");
+  const pq = crypto.generateKeyPairSync("ml-dsa-65");
+  const receipt = sdk.emitReceipt(event, {
+    agent_identity: "agent-hybrid-signing",
+    algorithm: "xoonya-native-hybrid-v1",
+    identity_ref: "did:xoonya:agent-hybrid-signing",
+    classical_signature_suite: "ed25519",
+    pq_signature_suite: "ml-dsa-65",
+    classical_public_key_pem: classical.publicKey.export({ type: "spki", format: "pem" }),
+    classical_private_key_pem: classical.privateKey.export({ type: "pkcs8", format: "pem" }),
+    pq_public_key_pem: pq.publicKey.export({ type: "spki", format: "pem" }),
+    pq_private_key_pem: pq.privateKey.export({ type: "pkcs8", format: "pem" })
+  });
+
+  const verification = sdk.verifyProofBundle(sdk.buildProofBundle({
+    ceb: event,
+    receipt
+  }));
+  assert.strictEqual(verification.valid, true, "hybrid method must verify");
+  assert.strictEqual(
+    verification.verification_state,
+    "verified_native_hybrid_signature",
+    "hybrid method verification state mismatch"
+  );
+
+  const downgradeEvent = sdk.canonicalizeEvent({
+    version: "canonical-event-bundle/v1",
+    domain_id: "hybrid.downgrade",
+    sequence: "1",
+    actor_id: "agent-hybrid",
+    adapter_source: "verify_native_hybrid_design_gate",
+    event_type: "native.hybrid.downgrade",
+    event_hash: "90".repeat(32)
+  });
+  const detachedReceipt = sdk.emitReceipt(downgradeEvent, {
+    agent_identity: "agent-hybrid-signing",
+    algorithm: "detached-assertion-v1",
+    signature: receipt.signature
+  });
+  const downgradeVerification = sdk.verifyProofBundle(sdk.buildProofBundle({
+    ceb: downgradeEvent,
+    receipt: detachedReceipt
+  }));
+  assert.strictEqual(downgradeVerification.valid, false, "hybrid-looking signature must not verify as detached");
+  assert.strictEqual(
+    downgradeVerification.reason,
+    "signature_method_mismatch",
+    "hybrid-looking external signature must fail as method mismatch"
+  );
+
+  return {
+    ok: true,
+    product: "xoonya",
+    category: "xoonya-native-hybrid-verification",
+    method: "xoonya-native-hybrid-v1",
+    readiness_status: readiness.status,
+    implemented_hybrid_suites: readiness.implemented_hybrid_suites,
+    verification_state: verification.verification_state,
+    downgrade_reject_reason: downgradeVerification.reason,
+    boundary: "registered_runtime_supported_vector_covered_hybrid_suites_may_be_claimed"
+  };
+}
+
+function main() {
+  const json = process.argv.includes("--json");
+  const summary = runNativeHybridVerification();
+  if (json) {
+    process.stdout.write(`${JSON.stringify(summary, null, 2)}\n`);
+    return;
+  }
+  process.stdout.write(
+    [
+      "xoonya verify:native-hybrid-gate passed",
+      `method: ${summary.method}`,
+      `readiness: ${summary.readiness_status}`,
+      `verification state: ${summary.verification_state}`,
+      `downgrade reject: ${summary.downgrade_reject_reason}`
+    ].join("\n") + "\n"
+  );
+}
+
+if (require.main === module) {
+  main();
+}
+
+module.exports = {
+  runNativeHybridVerification
+};

package/scripts/verify_reference_promotion_gate.js

@@ -1,74 +1,74 @@
-"use strict";
-
-const assert = require("assert");
-const {
-  buildxoonyaNativeReferenceImplementationPack,
-  summarizexoonyaNativeReferenceImplementationPack,
-  validatexoonyaNativeReferencePromotionEvidence
-} = require("../proof_sdk");
-
-function buildValidPromotionEvidence(pack, language = "python") {
-  return {
-    language,
-    candidate_repository_ref: `xoonya-native-${language}@candidate`,
-    vector_sets_passed: pack.required_vector_sets.slice(),
-    deterministic_error_code_parity_ref: `xnya.reference.error_codes.${language}.2026-04-22`,
-    independent_parser_ref: `xnya.reference.parser.${language}.2026-04-22`,
-    signature_crypto_parity_ref: `xnya.reference.crypto.${language}.2026-04-22`,
-    round_trip_ref: `xnya.reference.round_trip.${language}.2026-04-22`,
-    conformance_mark_review_ref: `xnya.reference.conformance_mark.${language}.2026-04-22`,
-    forbidden_claim_review_ref: `xnya.reference.claim_boundary.${language}.2026-04-22`,
-    wraps_javascript_runtime: false
-  };
-}
-
-function assertRejected(pack, evidence, expectedCode) {
-  const validation = validatexoonyaNativeReferencePromotionEvidence(pack, evidence);
-  assert.strictEqual(validation.promotion_allowed, false, `expected ${expectedCode} to block reference promotion`);
-  assert.strictEqual(
-    validation.rejection_codes.includes(expectedCode),
-    true,
-    `missing deterministic rejection code ${expectedCode}`
-  );
-  return validation;
-}
-
-function main() {
-  const pack = buildxoonyaNativeReferenceImplementationPack();
-  const summary = summarizexoonyaNativeReferenceImplementationPack();
-  const validPythonEvidence = buildValidPromotionEvidence(pack, "python");
-  const validPythonPromotion = validatexoonyaNativeReferencePromotionEvidence(pack, validPythonEvidence);
-
-  assert.strictEqual(pack.category, "xoonya-native-reference-implementation-pack", "native reference pack category mismatch");
-  assert.strictEqual(summary.category, "xoonya-native-reference-implementation-summary", "native reference summary category mismatch");
-  assert.strictEqual(pack.implemented_reference_implementations.length, 1, "only JavaScript should be implemented today");
-  assert.strictEqual(pack.deterministic_rejection_codes.length >= 11, true, "reference promotion rejection codes missing");
-  assert.strictEqual(summary.deterministic_rejection_code_count, pack.deterministic_rejection_codes.length, "summary rejection code count mismatch");
-  assert.strictEqual(validPythonPromotion.promotion_allowed, true, "complete Python promotion evidence should pass validation");
-  assert.deepStrictEqual(validPythonPromotion.rejection_codes, [], "complete Python evidence should not carry rejection codes");
-
-  assertRejected(pack, buildValidPromotionEvidence(pack, "javascript"), "reference_language_not_registered");
-  assertRejected(pack, { ...validPythonEvidence, candidate_repository_ref: null }, "candidate_repository_missing");
-  assertRejected(pack, { ...validPythonEvidence, vector_sets_passed: pack.required_vector_sets.slice(0, 1) }, "required_vector_set_missing");
-  assertRejected(pack, { ...validPythonEvidence, deterministic_error_code_parity_ref: null }, "deterministic_error_code_parity_missing");
-  assertRejected(pack, { ...validPythonEvidence, independent_parser_ref: null }, "independent_parser_evidence_missing");
-  assertRejected(pack, { ...validPythonEvidence, signature_crypto_parity_ref: null }, "signature_crypto_parity_missing");
-  assertRejected(pack, { ...validPythonEvidence, round_trip_ref: null }, "round_trip_evidence_missing");
-  assertRejected(pack, { ...validPythonEvidence, conformance_mark_review_ref: null }, "conformance_mark_review_missing");
-  assertRejected(pack, { ...validPythonEvidence, forbidden_claim_review_ref: null }, "forbidden_claim_review_missing");
-  assertRejected(pack, { ...validPythonEvidence, wraps_javascript_runtime: true }, "javascript_wrapper_forbidden");
-  assertRejected(pack, { ...validPythonEvidence, npm_token: "npm_accidental_secret" }, "secret_material_forbidden");
-
-  const output = {
-    ok: true,
-    product: "xoonya",
-    category: "xoonya-native-reference-promotion-gate-verification",
-    status: "reference_promotion_requires_independent_vector_crypto_round_trip_and_mark_evidence",
-    deterministic_rejection_code_count: pack.deterministic_rejection_codes.length,
-    adversarial_case_count: 11,
-    boundary: "python_and_rust_reference_claims_remain_gated_until_independent_promotion_evidence_is_complete"
-  };
-  process.stdout.write(`${JSON.stringify(output, null, 2)}\n`);
-}
-
-main();
+"use strict";
+
+const assert = require("assert");
+const {
+  buildxoonyaNativeReferenceImplementationPack,
+  summarizexoonyaNativeReferenceImplementationPack,
+  validatexoonyaNativeReferencePromotionEvidence
+} = require("../proof_sdk");
+
+function buildValidPromotionEvidence(pack, language = "python") {
+  return {
+    language,
+    candidate_repository_ref: `xoonya-native-${language}@candidate`,
+    vector_sets_passed: pack.required_vector_sets.slice(),
+    deterministic_error_code_parity_ref: `xnya.reference.error_codes.${language}.2026-04-22`,
+    independent_parser_ref: `xnya.reference.parser.${language}.2026-04-22`,
+    signature_crypto_parity_ref: `xnya.reference.crypto.${language}.2026-04-22`,
+    round_trip_ref: `xnya.reference.round_trip.${language}.2026-04-22`,
+    conformance_mark_review_ref: `xnya.reference.conformance_mark.${language}.2026-04-22`,
+    forbidden_claim_review_ref: `xnya.reference.claim_boundary.${language}.2026-04-22`,
+    wraps_javascript_runtime: false
+  };
+}
+
+function assertRejected(pack, evidence, expectedCode) {
+  const validation = validatexoonyaNativeReferencePromotionEvidence(pack, evidence);
+  assert.strictEqual(validation.promotion_allowed, false, `expected ${expectedCode} to block reference promotion`);
+  assert.strictEqual(
+    validation.rejection_codes.includes(expectedCode),
+    true,
+    `missing deterministic rejection code ${expectedCode}`
+  );
+  return validation;
+}
+
+function main() {
+  const pack = buildxoonyaNativeReferenceImplementationPack();
+  const summary = summarizexoonyaNativeReferenceImplementationPack();
+  const validPythonEvidence = buildValidPromotionEvidence(pack, "python");
+  const validPythonPromotion = validatexoonyaNativeReferencePromotionEvidence(pack, validPythonEvidence);
+
+  assert.strictEqual(pack.category, "xoonya-native-reference-implementation-pack", "native reference pack category mismatch");
+  assert.strictEqual(summary.category, "xoonya-native-reference-implementation-summary", "native reference summary category mismatch");
+  assert.strictEqual(pack.implemented_reference_implementations.length, 1, "only JavaScript should be implemented today");
+  assert.strictEqual(pack.deterministic_rejection_codes.length >= 11, true, "reference promotion rejection codes missing");
+  assert.strictEqual(summary.deterministic_rejection_code_count, pack.deterministic_rejection_codes.length, "summary rejection code count mismatch");
+  assert.strictEqual(validPythonPromotion.promotion_allowed, true, "complete Python promotion evidence should pass validation");
+  assert.deepStrictEqual(validPythonPromotion.rejection_codes, [], "complete Python evidence should not carry rejection codes");
+
+  assertRejected(pack, buildValidPromotionEvidence(pack, "javascript"), "reference_language_not_registered");
+  assertRejected(pack, { ...validPythonEvidence, candidate_repository_ref: null }, "candidate_repository_missing");
+  assertRejected(pack, { ...validPythonEvidence, vector_sets_passed: pack.required_vector_sets.slice(0, 1) }, "required_vector_set_missing");
+  assertRejected(pack, { ...validPythonEvidence, deterministic_error_code_parity_ref: null }, "deterministic_error_code_parity_missing");
+  assertRejected(pack, { ...validPythonEvidence, independent_parser_ref: null }, "independent_parser_evidence_missing");
+  assertRejected(pack, { ...validPythonEvidence, signature_crypto_parity_ref: null }, "signature_crypto_parity_missing");
+  assertRejected(pack, { ...validPythonEvidence, round_trip_ref: null }, "round_trip_evidence_missing");
+  assertRejected(pack, { ...validPythonEvidence, conformance_mark_review_ref: null }, "conformance_mark_review_missing");
+  assertRejected(pack, { ...validPythonEvidence, forbidden_claim_review_ref: null }, "forbidden_claim_review_missing");
+  assertRejected(pack, { ...validPythonEvidence, wraps_javascript_runtime: true }, "javascript_wrapper_forbidden");
+  assertRejected(pack, { ...validPythonEvidence, npm_token: "npm_accidental_secret" }, "secret_material_forbidden");
+
+  const output = {
+    ok: true,
+    product: "xoonya",
+    category: "xoonya-native-reference-promotion-gate-verification",
+    status: "reference_promotion_requires_independent_vector_crypto_round_trip_and_mark_evidence",
+    deterministic_rejection_code_count: pack.deterministic_rejection_codes.length,
+    adversarial_case_count: 11,
+    boundary: "python_and_rust_reference_claims_remain_gated_until_independent_promotion_evidence_is_complete"
+  };
+  process.stdout.write(`${JSON.stringify(output, null, 2)}\n`);
+}
+
+main();

package/scripts/verify_reference_python.js

@@ -1,49 +1,49 @@
-"use strict";
-
-const assert = require("assert");
-const path = require("path");
-const { spawnSync } = require("child_process");
-
-function runPython(command, args) {
-  return spawnSync(command, args, {
-    cwd: path.resolve(__dirname, ".."),
-    encoding: "utf8"
-  });
-}
-
-function main() {
-  const script = path.resolve(__dirname, "..", "reference", "python", "verify_vectors.py");
-  let result = runPython("python", [script]);
-  if (result.error && result.error.code === "ENOENT") {
-    result = runPython("py", ["-3", script]);
-  }
-  if (result.error) {
-    throw result.error;
-  }
-  if (result.status !== 0) {
-    process.stderr.write(result.stdout || "");
-    process.stderr.write(result.stderr || "");
-    throw new Error("Python XNYA reference vector verification failed");
-  }
-  const summary = JSON.parse(result.stdout);
-  assert.strictEqual(summary.ok, true, "Python XNYA reference summary did not pass");
-  assert.strictEqual(summary.category, "xnya-python-reference-vector-parity", "Python XNYA reference category mismatch");
-  assert.strictEqual(summary.atom_vector_count >= 4, true, "Python XNYA atom vectors missing");
-  assert.strictEqual(summary.atom_adversarial_count >= 9, true, "Python XNYA adversarial vectors missing");
-  assert.strictEqual(summary.payload_profile_vector_count, 1, "Python XNYP payload vector missing");
-  assert.strictEqual(summary.proof_bundle_vector_count >= 10, true, "Python proof bundle vectors missing");
-  assert.strictEqual(summary.proof_bundle_verified_vector_count >= 9, true, "Python proof bundle verified vectors missing");
-  assert.strictEqual(
-    summary.native_signed_crypto_gated_vector_count + summary.native_signed_crypto_verified_vector_count,
-    1,
-    "Python native signed crypto vector accounting mismatch"
-  );
-  assert.strictEqual(
-    summary.verified_signature_suite_count === 0 || summary.verified_signature_suite_count === 1,
-    true,
-    "Python verified signature suite count mismatch"
-  );
-  process.stdout.write("xoonya verify:reference-python passed\n");
-}
-
-main();
+"use strict";
+
+const assert = require("assert");
+const path = require("path");
+const { spawnSync } = require("child_process");
+
+function runPython(command, args) {
+  return spawnSync(command, args, {
+    cwd: path.resolve(__dirname, ".."),
+    encoding: "utf8"
+  });
+}
+
+function main() {
+  const script = path.resolve(__dirname, "..", "reference", "python", "verify_vectors.py");
+  let result = runPython("python", [script]);
+  if (result.error && result.error.code === "ENOENT") {
+    result = runPython("py", ["-3", script]);
+  }
+  if (result.error) {
+    throw result.error;
+  }
+  if (result.status !== 0) {
+    process.stderr.write(result.stdout || "");
+    process.stderr.write(result.stderr || "");
+    throw new Error("Python XNYA reference vector verification failed");
+  }
+  const summary = JSON.parse(result.stdout);
+  assert.strictEqual(summary.ok, true, "Python XNYA reference summary did not pass");
+  assert.strictEqual(summary.category, "xnya-python-reference-vector-parity", "Python XNYA reference category mismatch");
+  assert.strictEqual(summary.atom_vector_count >= 4, true, "Python XNYA atom vectors missing");
+  assert.strictEqual(summary.atom_adversarial_count >= 9, true, "Python XNYA adversarial vectors missing");
+  assert.strictEqual(summary.payload_profile_vector_count, 1, "Python XNYP payload vector missing");
+  assert.strictEqual(summary.proof_bundle_vector_count >= 10, true, "Python proof bundle vectors missing");
+  assert.strictEqual(summary.proof_bundle_verified_vector_count >= 9, true, "Python proof bundle verified vectors missing");
+  assert.strictEqual(
+    summary.native_signed_crypto_gated_vector_count + summary.native_signed_crypto_verified_vector_count,
+    1,
+    "Python native signed crypto vector accounting mismatch"
+  );
+  assert.strictEqual(
+    summary.verified_signature_suite_count === 0 || summary.verified_signature_suite_count === 1,
+    true,
+    "Python verified signature suite count mismatch"
+  );
+  process.stdout.write("xoonya verify:reference-python passed\n");
+}
+
+main();

package/scripts/verify_reference_python_crypto.js

@@ -1,87 +1,87 @@
-"use strict";
-
-const assert = require("assert");
-const fs = require("fs");
-const os = require("os");
-const path = require("path");
-const { spawnSync } = require("child_process");
-
-const rootDir = path.resolve(__dirname, "..");
-
-function run(command, args, options = {}) {
-  return spawnSync(command, args, {
-    cwd: rootDir,
-    encoding: "utf8",
-    ...options
-  });
-}
-
-function findPython() {
-  const direct = run("python", ["--version"]);
-  if (!direct.error && direct.status === 0) {
-    return { command: "python", prefixArgs: [] };
-  }
-  const launcher = run("py", ["-3", "--version"]);
-  if (!launcher.error && launcher.status === 0) {
-    return { command: "py", prefixArgs: ["-3"] };
-  }
-  throw new Error("Python 3 is required for the XNYA Python crypto reference check");
-}
-
-function venvPythonPath(venvDir) {
-  return process.platform === "win32"
-    ? path.join(venvDir, "Scripts", "python.exe")
-    : path.join(venvDir, "bin", "python");
-}
-
-function assertOk(result, label) {
-  if (result.error) {
-    throw result.error;
-  }
-  if (result.status !== 0) {
-    process.stderr.write(result.stdout || "");
-    process.stderr.write(result.stderr || "");
-    throw new Error(`${label} failed`);
-  }
-}
-
-function main() {
-  const python = findPython();
-  const tempDir = fs.mkdtempSync(path.join(os.tmpdir(), "xoonya-python-crypto-"));
-  const keepVenv = process.env.XOONYA_KEEP_REFERENCE_PYTHON_CRYPTO_VENV === "1";
-  try {
-    const venvDir = path.join(tempDir, "venv");
-    assertOk(
-      run(python.command, [...python.prefixArgs, "-m", "venv", venvDir]),
-      "Python venv creation"
-    );
-    const venvPython = venvPythonPath(venvDir);
-    assertOk(
-      run(venvPython, [
-        "-m",
-        "pip",
-        "install",
-        "--disable-pip-version-check",
-        "-r",
-        path.join(rootDir, "reference", "python", "requirements-optional.txt")
-      ]),
-      "Python optional crypto dependency install"
-    );
-    const result = run(venvPython, [path.join(rootDir, "reference", "python", "verify_vectors.py")]);
-    assertOk(result, "Python crypto-enabled XNYA vector verification");
-    const summary = JSON.parse(result.stdout);
-    assert.strictEqual(summary.ok, true, "Python crypto-enabled XNYA summary did not pass");
-    assert.strictEqual(summary.native_signed_crypto_verified_vector_count, 1, "Python Ed25519 vector was not verified");
-    assert.strictEqual(summary.verified_signature_suite_count, 1, "Python verified signature suite count mismatch");
-    assert.strictEqual(summary.native_signature_crypto_dependency_missing_count, 0, "Python crypto dependency should be present in isolated venv");
-    process.stdout.write("xoonya verify:reference-python-crypto passed\n");
-  } finally {
-    if (!keepVenv) {
-      fs.rmSync(tempDir, { recursive: true, force: true });
-    } else {
-      process.stdout.write(`kept Python crypto venv at ${tempDir}\n`);
-    }
-  }
-}
-
-main();
+"use strict";
+
+const assert = require("assert");
+const fs = require("fs");
+const os = require("os");
+const path = require("path");
+const { spawnSync } = require("child_process");
+
+const rootDir = path.resolve(__dirname, "..");
+
+function run(command, args, options = {}) {
+  return spawnSync(command, args, {
+    cwd: rootDir,
+    encoding: "utf8",
+    ...options
+  });
+}
+
+function findPython() {
+  const direct = run("python", ["--version"]);
+  if (!direct.error && direct.status === 0) {
+    return { command: "python", prefixArgs: [] };
+  }
+  const launcher = run("py", ["-3", "--version"]);
+  if (!launcher.error && launcher.status === 0) {
+    return { command: "py", prefixArgs: ["-3"] };
+  }
+  throw new Error("Python 3 is required for the XNYA Python crypto reference check");
+}
+
+function venvPythonPath(venvDir) {
+  return process.platform === "win32"
+    ? path.join(venvDir, "Scripts", "python.exe")
+    : path.join(venvDir, "bin", "python");
+}
+
+function assertOk(result, label) {
+  if (result.error) {
+    throw result.error;
+  }
+  if (result.status !== 0) {
+    process.stderr.write(result.stdout || "");
+    process.stderr.write(result.stderr || "");
+    throw new Error(`${label} failed`);
+  }
+}
+
+function main() {
+  const python = findPython();
+  const tempDir = fs.mkdtempSync(path.join(os.tmpdir(), "xoonya-python-crypto-"));
+  const keepVenv = process.env.XOONYA_KEEP_REFERENCE_PYTHON_CRYPTO_VENV === "1";
+  try {
+    const venvDir = path.join(tempDir, "venv");
+    assertOk(
+      run(python.command, [...python.prefixArgs, "-m", "venv", venvDir]),
+      "Python venv creation"
+    );
+    const venvPython = venvPythonPath(venvDir);
+    assertOk(
+      run(venvPython, [
+        "-m",
+        "pip",
+        "install",
+        "--disable-pip-version-check",
+        "-r",
+        path.join(rootDir, "reference", "python", "requirements-optional.txt")
+      ]),
+      "Python optional crypto dependency install"
+    );
+    const result = run(venvPython, [path.join(rootDir, "reference", "python", "verify_vectors.py")]);
+    assertOk(result, "Python crypto-enabled XNYA vector verification");
+    const summary = JSON.parse(result.stdout);
+    assert.strictEqual(summary.ok, true, "Python crypto-enabled XNYA summary did not pass");
+    assert.strictEqual(summary.native_signed_crypto_verified_vector_count, 1, "Python Ed25519 vector was not verified");
+    assert.strictEqual(summary.verified_signature_suite_count, 1, "Python verified signature suite count mismatch");
+    assert.strictEqual(summary.native_signature_crypto_dependency_missing_count, 0, "Python crypto dependency should be present in isolated venv");
+    process.stdout.write("xoonya verify:reference-python-crypto passed\n");
+  } finally {
+    if (!keepVenv) {
+      fs.rmSync(tempDir, { recursive: true, force: true });
+    } else {
+      process.stdout.write(`kept Python crypto venv at ${tempDir}\n`);
+    }
+  }
+}
+
+main();