xoonya 3.1.0 → 3.1.2

package/scripts/verify_forgery_resistance.js

@@ -0,0 +1,281 @@
+"use strict";
+
+// Forgery-resistance checks for the xoonya proof engine.
+//
+// This script talks to proof_sdk.js directly (no HTTP server) and pins down:
+//   (a) key substitution: a proof signed by key B that claims key A's identity
+//       self-verifies WITHOUT a trust root (known limitation, documented here)
+//       and is rejected WITH a trust root pinned to key A;
+//   (b) external methods are structural-only and fail under strict mode;
+//   (c) the default digest method is digest-only and fails under strict mode;
+//   (d) hybrid ed25519+ml-dsa-65: tampered PQ signature is rejected, and a
+//       wrong pinned PQ ref yields native_hybrid_public_key_not_trusted;
+//   (e) results are deterministic across repeated runs for the same inputs.
+
+const assert = require("assert");
+const crypto = require("crypto");
+const sdk = require("../proof_sdk.js");
+
+function canonicalize(value) {
+  if (Array.isArray(value)) {
+    return `[${value.map((item) => canonicalize(item)).join(",")}]`;
+  }
+  if (value && typeof value === "object") {
+    const keys = Object.keys(value).sort();
+    return `{${keys.map((key) => `${JSON.stringify(key)}:${canonicalize(value[key])}`).join(",")}}`;
+  }
+  return JSON.stringify(value);
+}
+
+function pem(key, type) {
+  return key.export({ type, format: "pem" });
+}
+
+function tamperBase64url(value) {
+  const last = value.slice(-1);
+  return `${value.slice(0, -1)}${last === "A" ? "B" : "A"}`;
+}
+
+const event = {
+  version: "canonical-event-bundle/v1",
+  domain_id: "forgery.resistance",
+  sequence: "1",
+  actor_id: "alice",
+  adapter_source: "verify_forgery_resistance",
+  event_type: "proof.forgery.probe",
+  event_hash: "cd".repeat(32)
+};
+const ALICE_IDENTITY_REF = "did:xoonya:alice";
+
+function signedReceiptFor(keyPair) {
+  return sdk.emitReceipt(event, {
+    agent_identity: "alice",
+    algorithm: "xoonya-native-signed-v1",
+    identity_ref: ALICE_IDENTITY_REF,
+    signature_suite: "ed25519",
+    private_key_pem: pem(keyPair.privateKey, "pkcs8"),
+    public_key_pem: pem(keyPair.publicKey, "spki")
+  });
+}
+
+function bundleFor(receipt) {
+  return sdk.buildProofBundle({ ceb: event, receipt });
+}
+
+function checkKeySubstitution() {
+  const keyA = crypto.generateKeyPairSync("ed25519");
+  const keyB = crypto.generateKeyPairSync("ed25519");
+  const receiptA = signedReceiptFor(keyA);
+  const receiptB = signedReceiptFor(keyB);
+  const refA = receiptA.native_proof.public_key_ref;
+  const refB = receiptB.native_proof.public_key_ref;
+  assert.notStrictEqual(refA, refB, "distinct keys must produce distinct public_key_ref values");
+  assert.strictEqual(receiptB.native_proof.identity_ref, ALICE_IDENTITY_REF, "key B proof claims alice's identity_ref");
+
+  // Known limitation: without a verifier-supplied trust root, public_key_ref is only
+  // self-bound to the carried key material, so key B can claim alice's identity.
+  const substitutionWithoutRoot = sdk.verifyProofBundle(bundleFor(receiptB));
+  assert.strictEqual(substitutionWithoutRoot.valid, true, "key substitution self-verifies without a trust root (documented limitation)");
+  assert.strictEqual(substitutionWithoutRoot.verification_class, "cryptographic", "native signed class must be cryptographic");
+  assert.strictEqual(substitutionWithoutRoot.cryptographically_verified, true, "native signed proof must report cryptographic verification");
+  assert.strictEqual(substitutionWithoutRoot.trust_root_applied, false, "trust_root_applied must be false without a trust root");
+  assert.strictEqual(substitutionWithoutRoot.public_key_ref, refB, "verify result must surface the signing key ref so callers can pin it");
+
+  const trustRoot = { trusted_public_key_refs: { [ALICE_IDENTITY_REF]: refA } };
+  const substitutionWithRoot = sdk.verifyProofBundle(bundleFor(receiptB), trustRoot);
+  assert.strictEqual(substitutionWithRoot.valid, false, "key substitution must be rejected with a pinned trust root");
+  assert.strictEqual(substitutionWithRoot.reason, "native_public_key_not_trusted", "key substitution rejection reason mismatch");
+  assert.strictEqual(substitutionWithRoot.trust_root_applied, true, "trust_root_applied must be true with a trust root");
+  assert.strictEqual(substitutionWithRoot.cryptographically_verified, false, "rejected result must not claim cryptographic verification");
+
+  const genuineWithRoot = sdk.verifyProofBundle(bundleFor(receiptA), trustRoot);
+  assert.strictEqual(genuineWithRoot.valid, true, "genuine key A proof must verify with trust root pinned to key A");
+  assert.strictEqual(genuineWithRoot.trust_root_applied, true, "genuine trust_root_applied mismatch");
+
+  const genuineArrayRoot = sdk.verifyProofBundle(bundleFor(receiptA), { trusted_public_key_refs: { [ALICE_IDENTITY_REF]: [refB, refA] } });
+  assert.strictEqual(genuineArrayRoot.valid, true, "array-valued trust root must accept any listed ref");
+
+  const expectedRefRoot = sdk.verifyProofBundle(bundleFor(receiptB), { expected_public_key_ref: refA });
+  assert.strictEqual(expectedRefRoot.reason, "native_public_key_not_trusted", "expected_public_key_ref must reject key B");
+  assert.strictEqual(sdk.verifyProofBundle(bundleFor(receiptA), { expected_public_key_ref: refA }).valid, true, "expected_public_key_ref must accept key A");
+
+  const unknownIdentityRoot = sdk.verifyProofBundle(bundleFor(receiptA), { trusted_public_key_refs: { "did:xoonya:bob": refA } });
+  assert.strictEqual(unknownIdentityRoot.reason, "native_public_key_not_trusted", "identity absent from trust root must fail closed");
+
+  const hybridOnlyRoot = sdk.verifyProofBundle(bundleFor(receiptA), { expected_pq_public_key_ref: "ml-dsa-65-spki-sha256:" + "00".repeat(32) });
+  assert.strictEqual(hybridOnlyRoot.reason, "native_public_key_not_trusted", "a PQ-only pin against a classical-only proof must fail closed");
+
+  const strictGenuine = sdk.verifyProofBundle(bundleFor(receiptA), { ...trustRoot, strict: true });
+  assert.strictEqual(strictGenuine.valid, true, "cryptographic class must pass strict mode");
+  return { refA, refB };
+}
+
+function checkExternalStructural() {
+  const methods = ["jwt-assertion-v1", "did-vc-v1", "sd-jwt-vc-v1", "signed-envelope-v1", "partner-proof-envelope-v1", "detached-assertion-v1"];
+  for (const methodId of methods) {
+    const receipt = sdk.emitReceipt(event, {
+      agent_identity: "alice",
+      algorithm: methodId,
+      signature: `garbage-signature-${crypto.randomBytes(8).toString("hex")}`
+    });
+    const relaxed = sdk.verifyProofBundle(bundleFor(receipt));
+    assert.strictEqual(relaxed.valid, true, `${methodId} garbage signature is accepted structurally by default`);
+    assert.strictEqual(relaxed.verification_class, "structural", `${methodId} class must be structural`);
+    assert.strictEqual(relaxed.cryptographically_verified, false, `${methodId} must not claim cryptographic verification`);
+    const strict = sdk.verifyProofBundle(bundleFor(receipt), { strict: true });
+    assert.strictEqual(strict.valid, false, `${methodId} must fail under strict verification`);
+    assert.strictEqual(strict.reason, "external_verification_required", `${methodId} strict rejection reason mismatch`);
+    assert.strictEqual(strict.verification_class, "structural", `${methodId} strict class mismatch`);
+  }
+}
+
+function checkDigestDefault() {
+  const receipt = sdk.emitReceipt(event, { agent_identity: "alice" });
+  assert.strictEqual(receipt.algorithm, "xoonya-native-sha256-v1", "default receipt method mismatch");
+  const relaxed = sdk.verifyProofBundle(bundleFor(receipt));
+  assert.strictEqual(relaxed.valid, true, "digest bundle verifies by default");
+  assert.strictEqual(relaxed.verification_class, "digest", "digest class mismatch");
+  assert.strictEqual(relaxed.cryptographically_verified, false, "digest must not claim cryptographic verification");
+
+  // Anyone can forge a digest receipt for any identity: there is no key involved.
+  const forged = sdk.emitReceipt(event, { agent_identity: "alice" });
+  assert.strictEqual(forged.signature, receipt.signature, "digest receipts are reproducible by anyone who knows the event");
+
+  const strict = sdk.verifyProofBundle(bundleFor(receipt), { strict: true });
+  assert.strictEqual(strict.valid, false, "digest bundle must fail under strict verification");
+  assert.strictEqual(strict.reason, "digest_only_not_cryptographically_verified", "strict digest reason mismatch");
+
+  const previous = process.env.XOONYA_STRICT_VERIFY;
+  process.env.XOONYA_STRICT_VERIFY = "1";
+  try {
+    const envStrict = sdk.verifyProofBundle(bundleFor(receipt));
+    assert.strictEqual(envStrict.valid, false, "XOONYA_STRICT_VERIFY=1 must enable strict mode globally");
+    assert.strictEqual(envStrict.strict, true, "env strict flag must echo in the result");
+  } finally {
+    if (previous === undefined) delete process.env.XOONYA_STRICT_VERIFY;
+    else process.env.XOONYA_STRICT_VERIFY = previous;
+  }
+}
+
+function checkHybrid() {
+  const classical = crypto.generateKeyPairSync("ed25519");
+  const pq = crypto.generateKeyPairSync("ml-dsa-65");
+  const receipt = sdk.emitReceipt(event, {
+    agent_identity: "alice",
+    algorithm: "xoonya-native-hybrid-v1",
+    identity_ref: ALICE_IDENTITY_REF,
+    classical_signature_suite: "ed25519",
+    pq_signature_suite: "ml-dsa-65",
+    classical_public_key_pem: pem(classical.publicKey, "spki"),
+    classical_private_key_pem: pem(classical.privateKey, "pkcs8"),
+    pq_public_key_pem: pem(pq.publicKey, "spki"),
+    pq_private_key_pem: pem(pq.privateKey, "pkcs8")
+  });
+  const bundle = bundleFor(receipt);
+  const genuine = sdk.verifyProofBundle(bundle);
+  assert.strictEqual(genuine.valid, true, "hybrid bundle must verify");
+  assert.strictEqual(genuine.verification_class, "cryptographic", "hybrid class must be cryptographic");
+  assert.strictEqual(genuine.cryptographically_verified, true, "hybrid must report cryptographic verification");
+  assert.strictEqual(genuine.classical_public_key_ref, receipt.native_proof.classical_public_key_ref, "hybrid classical ref surfaced");
+  assert.strictEqual(genuine.pq_public_key_ref, receipt.native_proof.pq_public_key_ref, "hybrid pq ref surfaced");
+
+  const tamperedPqSignature = tamperBase64url(receipt.native_proof.proof_material.pq_signature);
+  const tamperedReceipt = {
+    ...receipt,
+    native_proof: {
+      ...receipt.native_proof,
+      proof_material: { ...receipt.native_proof.proof_material, pq_signature: tamperedPqSignature }
+    },
+    signature: `xoonya-native-hybrid-v1:${receipt.native_proof.hybrid_suite}:${receipt.native_proof.proof_material.classical_signature}.${tamperedPqSignature}`
+  };
+  const tampered = sdk.verifyProofBundle(bundleFor(tamperedReceipt));
+  assert.strictEqual(tampered.valid, false, "tampered PQ signature must be rejected");
+  assert.strictEqual(tampered.reason, "native_hybrid_pq_signature_invalid", "tampered PQ signature reason mismatch");
+  assert.strictEqual(tampered.cryptographically_verified, false, "tampered hybrid must not claim cryptographic verification");
+
+  const wrongPqRef = `ml-dsa-65-spki-sha256:${"11".repeat(32)}`;
+  const wrongPqPinned = sdk.verifyProofBundle(bundle, {
+    trusted_public_key_refs: { [ALICE_IDENTITY_REF]: { classical: genuine.classical_public_key_ref, pq: wrongPqRef } }
+  });
+  assert.strictEqual(wrongPqPinned.valid, false, "wrong pinned PQ ref must be rejected");
+  assert.strictEqual(wrongPqPinned.reason, "native_hybrid_public_key_not_trusted", "wrong PQ pin reason mismatch");
+  assert.strictEqual(wrongPqPinned.trust_root_applied, true, "hybrid trust_root_applied mismatch");
+
+  const wrongExpectedPq = sdk.verifyProofBundle(bundle, { expected_pq_public_key_ref: wrongPqRef });
+  assert.strictEqual(wrongExpectedPq.reason, "native_hybrid_public_key_not_trusted", "expected_pq_public_key_ref mismatch must be rejected");
+
+  const rightPinned = sdk.verifyProofBundle(bundle, {
+    trusted_public_key_refs: { [ALICE_IDENTITY_REF]: { classical: genuine.classical_public_key_ref, pq: genuine.pq_public_key_ref } },
+    strict: true
+  });
+  assert.strictEqual(rightPinned.valid, true, "correctly pinned hybrid must verify under strict mode");
+
+  const classicalOnlyPin = sdk.verifyProofBundle(bundle, { trusted_public_key_refs: { [ALICE_IDENTITY_REF]: genuine.classical_public_key_ref } });
+  assert.strictEqual(classicalOnlyPin.valid, true, "string-valued trust root pins the classical lane of a hybrid proof");
+
+  const otherClassical = crypto.generateKeyPairSync("ed25519");
+  const otherClassicalRef = sdk.emitReceipt(event, {
+    agent_identity: "alice",
+    algorithm: "xoonya-native-signed-v1",
+    identity_ref: ALICE_IDENTITY_REF,
+    signature_suite: "ed25519",
+    private_key_pem: pem(otherClassical.privateKey, "pkcs8"),
+    public_key_pem: pem(otherClassical.publicKey, "spki")
+  }).native_proof.public_key_ref;
+  const wrongClassicalPin = sdk.verifyProofBundle(bundle, { trusted_public_key_refs: { [ALICE_IDENTITY_REF]: otherClassicalRef } });
+  assert.strictEqual(wrongClassicalPin.reason, "native_hybrid_public_key_not_trusted", "wrong classical pin on hybrid must be rejected");
+  return bundle;
+}
+
+function checkDeterminism(hybridBundle, refs) {
+  const keyA = crypto.generateKeyPairSync("ed25519");
+  const signedBundle = bundleFor(signedReceiptFor(keyA));
+  const digestBundle = bundleFor(sdk.emitReceipt(event, { agent_identity: "alice" }));
+  const externalBundle = bundleFor(sdk.emitReceipt(event, { agent_identity: "alice", algorithm: "jwt-assertion-v1", signature: "garbage" }));
+  const cases = [
+    [signedBundle, {}],
+    [signedBundle, { strict: true }],
+    [signedBundle, { trusted_public_key_refs: { [ALICE_IDENTITY_REF]: refs.refA } }],
+    [digestBundle, {}],
+    [digestBundle, { strict: true }],
+    [externalBundle, { strict: true }],
+    [hybridBundle, {}],
+    [hybridBundle, { expected_pq_public_key_ref: "nope" }]
+  ];
+  for (const [bundle, options] of cases) {
+    const first = canonicalize(sdk.verifyProofBundle(bundle, options));
+    const second = canonicalize(sdk.verifyProofBundle(bundle, options));
+    assert.strictEqual(first, second, `verification result must be deterministic for options ${JSON.stringify(options)}`);
+  }
+}
+
+function main() {
+  const classes = sdk.listProofVerificationClasses().map((entry) => entry.id).sort();
+  assert.deepStrictEqual(classes, ["anchored_binding", "cryptographic", "digest", "structural"], "verification class registry mismatch");
+  assert.deepStrictEqual(
+    sdk.PROOF_VERIFICATION_STRICT_REJECTION_CODES.slice(),
+    ["digest_only_not_cryptographically_verified", "external_verification_required"],
+    "strict rejection code registry mismatch"
+  );
+  assert.deepStrictEqual(
+    sdk.PROOF_VERIFICATION_TRUST_ROOT_REJECTION_CODES.slice(),
+    ["native_public_key_not_trusted", "native_hybrid_public_key_not_trusted"],
+    "trust root rejection code registry mismatch"
+  );
+
+  const refs = checkKeySubstitution();
+  checkExternalStructural();
+  checkDigestDefault();
+  const hybridBundle = checkHybrid();
+  checkDeterminism(hybridBundle, refs);
+
+  console.log("xoonya verify:forgery-resistance passed");
+  console.log("key substitution without trust root: accepted (documented limitation; pin with trusted_public_key_refs)");
+  console.log("key substitution with trust root: native_public_key_not_trusted");
+  console.log("external methods under strict: external_verification_required");
+  console.log("digest method under strict: digest_only_not_cryptographically_verified");
+  console.log("hybrid tampered pq signature: native_hybrid_pq_signature_invalid");
+  console.log("hybrid wrong pq pin: native_hybrid_public_key_not_trusted");
+}
+
+main();

package/scripts/verify_integrations.js

@@ -1,170 +1,170 @@
-"use strict";
-
-const assert = require("assert");
-const stagedPartnerVerifierRegistrationRecord = require("../integrations/examples/example-third-party-verifier-registration.record.json");
-const root = require("../index.js");
-
-async function main() {
-  const integrations = root.listIntegrations();
-  assert.ok(Array.isArray(integrations), "proof integrations list missing");
-  assert.ok(integrations.length >= 4, "proof integration breadth missing");
-  assert.ok(integrations.some((integration) => integration.integration_id === "builtin.identity.legacy_material"), "legacy identity integration missing");
-  assert.ok(integrations.some((integration) => integration.integration_id === "builtin.verifier.registry_profile"), "registry verifier integration missing");
-  assert.ok(integrations.some((integration) => integration.integration_id === stagedPartnerVerifierRegistrationRecord.integration_id), "staged proof verifier integration missing");
-  assert.ok(integrations.some((integration) => integration.certification_state === "certified"), "proof integration certification metadata missing");
-
-  const summary = root.summarizeIntegrations();
-  assert.strictEqual(summary.ok, true, "proof integration summary ok mismatch");
-  assert.ok(summary.integration_count >= integrations.length, "proof integration count mismatch");
-  assert.strictEqual(summary.certified_integration_count >= 5, true, "proof integration certified count mismatch");
-  assert.strictEqual(summary.production_default_count >= 5, true, "proof integration production-default count mismatch");
-  assert.strictEqual(summary.staged_registration_count >= 1, true, "proof integration staged registration count mismatch");
-
-  const detail = root.getIntegration("builtin.verifier.economic_profile");
-  assert.ok(detail, "proof integration detail missing");
-  assert.strictEqual(detail.integration_class, "verification_helper_adapter", "proof integration class mismatch");
-  assert.strictEqual(detail.integration_maturity, "production_default", "proof integration maturity mismatch");
-
-  const bundledFiltered = root.listIntegrations({
-    source: "builtin",
-    certification_state: "certified",
-    integration_maturity: "production_default",
-    bundled: "true"
-  });
-  assert.ok(bundledFiltered.length >= 5, "proof builtin integration filtering mismatch");
-
-  const stagedFiltered = root.listIntegrations({
-    source: "third_party_example",
-    registration_state: "staging_registered",
-    proof_scope: "profile_verification",
-    bundled: "false"
-  });
-  assert.strictEqual(stagedFiltered.length, 1, "proof staged integration filtering mismatch");
-  assert.strictEqual(stagedFiltered[0].registration.requires_explicit_selection, true, "proof staged integration explicit-selection mismatch");
-
-  const validation = root.validateIntegrationRegistration({
-    integration_id: stagedPartnerVerifierRegistrationRecord.integration_id,
-    integration_class: stagedPartnerVerifierRegistrationRecord.integration_class,
-    proof_scope: stagedPartnerVerifierRegistrationRecord.proof_scope
-  }, stagedPartnerVerifierRegistrationRecord);
-  assert.strictEqual(validation.ok, true, "proof integration registration validation failed");
-
-  const imported = root.importRegisteredIntegration({
-    integration_id: "partner.verifier.memory_canary",
-    integration_class: "verification_helper_adapter",
-    display_name: "Memory Canary Verifier",
-    description: "Imported proof-side verifier used to validate normalization.",
-    proof_scope: "profile_verification",
-    capabilities: ["memory_canary.verify"],
-    public_surfaces: ["sdk"],
-    required_inputs: ["profile"],
-    emitted_artifacts: [],
-    verification_targets: ["memory_canary_profile"]
-  }, {
-    integration_id: "partner.verifier.memory_canary",
-    integration_class: "verification_helper_adapter",
-    proof_scope: "profile_verification",
-    registration_state: "local_only",
-    integration_maturity: "reference_example",
-    certification_state: "reference_example",
-    bundled: false,
-    default_selection_enabled: false,
-    requires_explicit_selection: true,
-    registered_at: "2026-03-20T00:00:00Z"
-  }, {
-    source: "verification_import_test",
-    certification_scope: ["contract_shape"],
-    operational_readiness: "reference"
-  });
-  assert.strictEqual(imported.integration_id, "partner.verifier.memory_canary", "proof imported integration id mismatch");
-  assert.strictEqual(imported.registration.registration_state, "local_only", "proof imported integration registration state mismatch");
-
-  const snapshot = root.exportIntegrationRegistrySnapshot({
-    registration_state: "staging_registered"
-  });
-  assert.strictEqual(snapshot.integration_count >= 1, true, "proof integration snapshot count mismatch");
-  assert.strictEqual(root.validateIntegrationRegistrySnapshot(snapshot).ok, true, "proof integration snapshot validation mismatch");
-
-  const builtinPromotion = root.summarizeIntegrationPromotionReadiness("builtin.verifier.registry_profile");
-  assert.strictEqual(builtinPromotion.ok, true, "proof builtin promotion readiness mismatch");
-  assert.strictEqual(builtinPromotion.promotion_readiness.default_eligible, true, "proof builtin default eligibility mismatch");
-  assert.strictEqual(builtinPromotion.promotion_readiness.production_default_ready, true, "proof builtin production-default readiness mismatch");
-
-  const stagedPromotion = root.summarizeIntegrationPromotionReadiness("partner.verifier.lattice_notary");
-  assert.strictEqual(stagedPromotion.ok, true, "proof staged promotion readiness mismatch");
-  assert.strictEqual(stagedPromotion.promotion_readiness.review_ready, true, "proof staged review-ready mismatch");
-  assert.strictEqual(stagedPromotion.promotion_readiness.default_eligible, false, "proof staged default eligibility mismatch");
-  assert.strictEqual(stagedPromotion.promotion_readiness.production_default_ready, false, "proof staged production-default readiness mismatch");
-  assert.ok(stagedPromotion.promotion_readiness.blockers.includes("not_certified"), "proof staged certification blocker missing");
-
-  const builtinPromotionWorkflow = root.summarizeIntegrationPromotionWorkflow("builtin.verifier.registry_profile");
-  assert.strictEqual(builtinPromotionWorkflow.ok, true, "proof builtin promotion workflow mismatch");
-  assert.strictEqual(
-    builtinPromotionWorkflow.next_transition.action,
-    "maintain_production_default",
-    "proof builtin promotion workflow next-transition mismatch"
-  );
-  assert.strictEqual(
-    builtinPromotionWorkflow.promotion_recommendation.recommendation,
-    "eligible_for_production_default",
-    "proof builtin promotion workflow recommendation mismatch"
-  );
-
-  const stagedPromotionWorkflow = root.summarizeIntegrationPromotionWorkflow("partner.verifier.lattice_notary");
-  assert.strictEqual(stagedPromotionWorkflow.ok, true, "proof staged promotion workflow mismatch");
-  assert.strictEqual(
-    stagedPromotionWorkflow.next_transition.action,
-    "complete_certification",
-    "proof staged promotion workflow next-transition mismatch"
-  );
-  assert.strictEqual(
-    stagedPromotionWorkflow.next_transition.later_actions.includes("promote_maturity"),
-    true,
-    "proof staged promotion workflow later-actions mismatch"
-  );
-  assert.strictEqual(
-    stagedPromotionWorkflow.promotion_recommendation.recommendation,
-    "keep_staged_until_requirements_clear",
-    "proof staged promotion workflow recommendation mismatch"
-  );
-  assert.strictEqual(
-    stagedPromotionWorkflow.certification_gaps.missing_requirements.includes("certification_state"),
-    true,
-    "proof staged promotion workflow certification gap mismatch"
-  );
-  assert.strictEqual(
-    stagedPromotionWorkflow.blocker_categories.some((entry) => entry.category === "certification"),
-    true,
-    "proof staged promotion workflow blocker-category mismatch"
-  );
-
-  const promotionWorkflowList = root.summarizeIntegrationPromotionWorkflowList({
-    source: "third_party_example",
-    registration_state: "staging_registered",
-    bundled: "false"
-  });
-  assert.strictEqual(promotionWorkflowList.ok, true, "proof promotion workflow list mismatch");
-  assert.strictEqual(promotionWorkflowList.integration_count >= 1, true, "proof promotion workflow list breadth mismatch");
-  assert.strictEqual(
-    promotionWorkflowList.next_actions.some((entry) => entry.action === "complete_certification"),
-    true,
-    "proof promotion workflow list next-action mismatch"
-  );
-  assert.strictEqual(
-    promotionWorkflowList.recommendations.some((entry) => entry.recommendation === "keep_staged_until_requirements_clear"),
-    true,
-    "proof promotion workflow list recommendation mismatch"
-  );
-  assert.strictEqual(
-    promotionWorkflowList.blocker_categories.some((entry) => entry.category === "certification"),
-    true,
-    "proof promotion workflow list blocker-category mismatch"
-  );
-
-  console.log("xoonya verify:integrations passed");
-}
-
-main().catch((error) => {
-  console.error(error);
-  process.exit(1);
-});
+"use strict";
+
+const assert = require("assert");
+const stagedPartnerVerifierRegistrationRecord = require("../integrations/examples/example-third-party-verifier-registration.record.json");
+const root = require("../index.js");
+
+async function main() {
+  const integrations = root.listIntegrations();
+  assert.ok(Array.isArray(integrations), "proof integrations list missing");
+  assert.ok(integrations.length >= 4, "proof integration breadth missing");
+  assert.ok(integrations.some((integration) => integration.integration_id === "builtin.identity.legacy_material"), "legacy identity integration missing");
+  assert.ok(integrations.some((integration) => integration.integration_id === "builtin.verifier.registry_profile"), "registry verifier integration missing");
+  assert.ok(integrations.some((integration) => integration.integration_id === stagedPartnerVerifierRegistrationRecord.integration_id), "staged proof verifier integration missing");
+  assert.ok(integrations.some((integration) => integration.certification_state === "certified"), "proof integration certification metadata missing");
+
+  const summary = root.summarizeIntegrations();
+  assert.strictEqual(summary.ok, true, "proof integration summary ok mismatch");
+  assert.ok(summary.integration_count >= integrations.length, "proof integration count mismatch");
+  assert.strictEqual(summary.certified_integration_count >= 5, true, "proof integration certified count mismatch");
+  assert.strictEqual(summary.production_default_count >= 5, true, "proof integration production-default count mismatch");
+  assert.strictEqual(summary.staged_registration_count >= 1, true, "proof integration staged registration count mismatch");
+
+  const detail = root.getIntegration("builtin.verifier.economic_profile");
+  assert.ok(detail, "proof integration detail missing");
+  assert.strictEqual(detail.integration_class, "verification_helper_adapter", "proof integration class mismatch");
+  assert.strictEqual(detail.integration_maturity, "production_default", "proof integration maturity mismatch");
+
+  const bundledFiltered = root.listIntegrations({
+    source: "builtin",
+    certification_state: "certified",
+    integration_maturity: "production_default",
+    bundled: "true"
+  });
+  assert.ok(bundledFiltered.length >= 5, "proof builtin integration filtering mismatch");
+
+  const stagedFiltered = root.listIntegrations({
+    source: "third_party_example",
+    registration_state: "staging_registered",
+    proof_scope: "profile_verification",
+    bundled: "false"
+  });
+  assert.strictEqual(stagedFiltered.length, 1, "proof staged integration filtering mismatch");
+  assert.strictEqual(stagedFiltered[0].registration.requires_explicit_selection, true, "proof staged integration explicit-selection mismatch");
+
+  const validation = root.validateIntegrationRegistration({
+    integration_id: stagedPartnerVerifierRegistrationRecord.integration_id,
+    integration_class: stagedPartnerVerifierRegistrationRecord.integration_class,
+    proof_scope: stagedPartnerVerifierRegistrationRecord.proof_scope
+  }, stagedPartnerVerifierRegistrationRecord);
+  assert.strictEqual(validation.ok, true, "proof integration registration validation failed");
+
+  const imported = root.importRegisteredIntegration({
+    integration_id: "partner.verifier.memory_canary",
+    integration_class: "verification_helper_adapter",
+    display_name: "Memory Canary Verifier",
+    description: "Imported proof-side verifier used to validate normalization.",
+    proof_scope: "profile_verification",
+    capabilities: ["memory_canary.verify"],
+    public_surfaces: ["sdk"],
+    required_inputs: ["profile"],
+    emitted_artifacts: [],
+    verification_targets: ["memory_canary_profile"]
+  }, {
+    integration_id: "partner.verifier.memory_canary",
+    integration_class: "verification_helper_adapter",
+    proof_scope: "profile_verification",
+    registration_state: "local_only",
+    integration_maturity: "reference_example",
+    certification_state: "reference_example",
+    bundled: false,
+    default_selection_enabled: false,
+    requires_explicit_selection: true,
+    registered_at: "2026-03-20T00:00:00Z"
+  }, {
+    source: "verification_import_test",
+    certification_scope: ["contract_shape"],
+    operational_readiness: "reference"
+  });
+  assert.strictEqual(imported.integration_id, "partner.verifier.memory_canary", "proof imported integration id mismatch");
+  assert.strictEqual(imported.registration.registration_state, "local_only", "proof imported integration registration state mismatch");
+
+  const snapshot = root.exportIntegrationRegistrySnapshot({
+    registration_state: "staging_registered"
+  });
+  assert.strictEqual(snapshot.integration_count >= 1, true, "proof integration snapshot count mismatch");
+  assert.strictEqual(root.validateIntegrationRegistrySnapshot(snapshot).ok, true, "proof integration snapshot validation mismatch");
+
+  const builtinPromotion = root.summarizeIntegrationPromotionReadiness("builtin.verifier.registry_profile");
+  assert.strictEqual(builtinPromotion.ok, true, "proof builtin promotion readiness mismatch");
+  assert.strictEqual(builtinPromotion.promotion_readiness.default_eligible, true, "proof builtin default eligibility mismatch");
+  assert.strictEqual(builtinPromotion.promotion_readiness.production_default_ready, true, "proof builtin production-default readiness mismatch");
+
+  const stagedPromotion = root.summarizeIntegrationPromotionReadiness("partner.verifier.lattice_notary");
+  assert.strictEqual(stagedPromotion.ok, true, "proof staged promotion readiness mismatch");
+  assert.strictEqual(stagedPromotion.promotion_readiness.review_ready, true, "proof staged review-ready mismatch");
+  assert.strictEqual(stagedPromotion.promotion_readiness.default_eligible, false, "proof staged default eligibility mismatch");
+  assert.strictEqual(stagedPromotion.promotion_readiness.production_default_ready, false, "proof staged production-default readiness mismatch");
+  assert.ok(stagedPromotion.promotion_readiness.blockers.includes("not_certified"), "proof staged certification blocker missing");
+
+  const builtinPromotionWorkflow = root.summarizeIntegrationPromotionWorkflow("builtin.verifier.registry_profile");
+  assert.strictEqual(builtinPromotionWorkflow.ok, true, "proof builtin promotion workflow mismatch");
+  assert.strictEqual(
+    builtinPromotionWorkflow.next_transition.action,
+    "maintain_production_default",
+    "proof builtin promotion workflow next-transition mismatch"
+  );
+  assert.strictEqual(
+    builtinPromotionWorkflow.promotion_recommendation.recommendation,
+    "eligible_for_production_default",
+    "proof builtin promotion workflow recommendation mismatch"
+  );
+
+  const stagedPromotionWorkflow = root.summarizeIntegrationPromotionWorkflow("partner.verifier.lattice_notary");
+  assert.strictEqual(stagedPromotionWorkflow.ok, true, "proof staged promotion workflow mismatch");
+  assert.strictEqual(
+    stagedPromotionWorkflow.next_transition.action,
+    "complete_certification",
+    "proof staged promotion workflow next-transition mismatch"
+  );
+  assert.strictEqual(
+    stagedPromotionWorkflow.next_transition.later_actions.includes("promote_maturity"),
+    true,
+    "proof staged promotion workflow later-actions mismatch"
+  );
+  assert.strictEqual(
+    stagedPromotionWorkflow.promotion_recommendation.recommendation,
+    "keep_staged_until_requirements_clear",
+    "proof staged promotion workflow recommendation mismatch"
+  );
+  assert.strictEqual(
+    stagedPromotionWorkflow.certification_gaps.missing_requirements.includes("certification_state"),
+    true,
+    "proof staged promotion workflow certification gap mismatch"
+  );
+  assert.strictEqual(
+    stagedPromotionWorkflow.blocker_categories.some((entry) => entry.category === "certification"),
+    true,
+    "proof staged promotion workflow blocker-category mismatch"
+  );
+
+  const promotionWorkflowList = root.summarizeIntegrationPromotionWorkflowList({
+    source: "third_party_example",
+    registration_state: "staging_registered",
+    bundled: "false"
+  });
+  assert.strictEqual(promotionWorkflowList.ok, true, "proof promotion workflow list mismatch");
+  assert.strictEqual(promotionWorkflowList.integration_count >= 1, true, "proof promotion workflow list breadth mismatch");
+  assert.strictEqual(
+    promotionWorkflowList.next_actions.some((entry) => entry.action === "complete_certification"),
+    true,
+    "proof promotion workflow list next-action mismatch"
+  );
+  assert.strictEqual(
+    promotionWorkflowList.recommendations.some((entry) => entry.recommendation === "keep_staged_until_requirements_clear"),
+    true,
+    "proof promotion workflow list recommendation mismatch"
+  );
+  assert.strictEqual(
+    promotionWorkflowList.blocker_categories.some((entry) => entry.category === "certification"),
+    true,
+    "proof promotion workflow list blocker-category mismatch"
+  );
+
+  console.log("xoonya verify:integrations passed");
+}
+
+main().catch((error) => {
+  console.error(error);
+  process.exit(1);
+});