xoonya 3.1.1 → 3.1.3

package/README.md

@@ -2,6 +2,10 @@
 
 `xoonya` is the proof and review foundation for machine actions.
 
+> New to the code? Read [`ARCHITECTURE.md`](ARCHITECTURE.md) first. It separates
+> the compact proof engine (the ~1,600-line crypto core in `proof_sdk.js`) from
+> the large machine-readable proof catalog, so the real engine is legible fast.
+
 It exists to make machine evidence:
 
 - deterministic

package/RELEASE_NOTES.md

@@ -1,18 +1,10 @@
-## 3.1.1
+`xoonya` 3.1.3 is the synchronized release that keeps the proof line aligned with the runtime.
 
-`xoonya` 3.1.1 is the verification-honesty and service-hardening patch on the synchronized control-plane and evidence-line release for the live proof, verification, continuity, governance, replay, and public first-contact line.
-
-This release keeps every frozen proof truth model, public contract, proof, release, and gate surface intact while making verify results say exactly what was checked, letting verifiers pin identities to keys, and hardening the HTTP service against oversized bodies, malformed paths, leaked error details, and private key material submitted over the wire.
+This release carries no change to the proof engine, the native XNYA standard, the verification methods, the conformance vectors, or the public proof surfaces. It exists to keep the proof package on the same synchronized line as the runtime, which in this cycle made runtime credits self-serve: a buyer can turn a single x402 payment into spendable credit with no operator grant.
 
 Highlights:
 
-- adds `verification_class` (`cryptographic`, `digest`, `anchored_binding`, `structural`), `cryptographically_verified`, `strict`, and `trust_root_applied` to every `verifyProofBundle` and `POST /v1/proof-bundles/verify` result without changing default `valid` semantics
-- adds strict verification (`options.strict`, `XOONYA_STRICT_VERIFY=1`) with the deterministic rejection codes `digest_only_not_cryptographically_verified` and `external_verification_required`
-- adds verifier-supplied trust roots (`trusted_public_key_refs`, `expected_public_key_ref`, `expected_pq_public_key_ref`, and related lane pins) with the deterministic rejection codes `native_public_key_not_trusted` and `native_hybrid_public_key_not_trusted`, and documents that native `public_key_ref` is self-bound to the carried key while identity binding requires a trust root
-- caches the native hybrid runtime-support probe per suite pair so sign and verify no longer regenerate classical and PQ key pairs on every call
-- hardens `server.js`: byte-counted 1 MiB body limit with a `content-length` precheck, `OPTIONS` and `HEAD` handling, `400 invalid_path_encoding` for malformed percent-encoding, generic `500 internal_error` with server-side stack logging, request and header timeouts, `x-content-type-options: nosniff`, `cache-control: no-store` on non-GET responses, and `uncaughtException` / `unhandledRejection` handlers
-- adds `XOONYA_ACCEPT_PRIVATE_KEY_MATERIAL`; when `false`, or unset on Render, emit, build, and proof-center run routes reject bodies carrying `/private_key/i` fields with `400 private_key_material_not_accepted` and point to local SDK/CLI signing
-- adds `npm run verify:forgery-resistance` (key substitution with and without a trust root, strict-mode rejection of digest and structural results, hybrid PQ tampering and wrong-pin rejection, result determinism) to `verify:all`, plus strict-mode, hardening, and private-key-policy checks in `verify:service`
-- marks the `dilithium`, `falcon`, and `sphincs-plus` registry entries as `deprecated_placeholder` aliases pointing at the implemented `ml-dsa-65` and `slh-dsa-sha2-128f` suites, and labels native identity prefixes `05`-`07` as legacy placeholders
-- keeps `RELEASE_NOTES.md` scoped to the current release so npm and GitHub release notes stay clean
-- keeps the canonical `https://naxytra.com/xoonya` public product URL and single naxytra website positioning intact
+- keeps the deterministic hash, sign, and verify core, the verification-class and strict-mode behavior, and the trust-root options unchanged
+- keeps the conformance and forgery-resistance vectors and the full verifier suite passing
+- keeps the canonical `https://naxytra.com/xoonya` public product URL and the synchronized package posture intact
+- tracks the runtime's self-serve credits addition so the proof and runtime packages stay on one release number

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "xoonya",
-  "version": "3.1.1",
+  "version": "3.1.3",
   "description": "Deterministic proof and review engine for receipts, handoffs, governance, and verification.",
   "main": "index.js",
   "bin": {