xoonya 3.1.16 → 3.2.0

package/package.json

@@ -1,12 +1,10 @@
 {
   "name": "xoonya",
-  "version": "3.1.16",
-  "description": "Deterministic proof and review engine with post-quantum verification (Ed25519 + ML-DSA-65 hybrid) for receipts, handoffs, governance, and the native XNYA machine-evidence format. Verified live via the paid x402 lane.",
-  "main": "index.js",
+  "version": "3.2.0",
+  "description": "Verifier for xoonya proofs and naxytra delivery evidence: deterministic verification of xoonya native proof bundles (replayable digest, Ed25519/secp256k1/P-256 signed, Ed25519 + ML-DSA-65 post-quantum hybrid, anchored), XNYA machine-evidence atoms, and detached signatures (Ed25519, ECDSA, RSA, ML-DSA). The proof engine and server are a hosted service and are not distributed.",
+  "main": "verify.js",
   "bin": {
-    "xoonya": "bin/xoonya.js",
-    "xoonya-review": "bin/xoonya-review.js",
-    "xoonya-release": "bin/xoonya-release.js"
+    "xoonya": "bin/xoonya.js"
   },
   "type": "commonjs",
   "license": "Apache-2.0",
@@ -19,38 +17,20 @@
     "node": ">=24"
   },
   "files": [
-    "index.js",
-    "proof_sdk.js",
-    "server.js",
-    "bin/",
-    "scripts/",
-    "lib/",
-    "integrations/",
-    "reference/",
-    "vectors/",
-    "RELEASE_NOTES.md",
-    ".env.example",
+    "verify.js",
+    "lib/native_verify.js",
+    "lib/external_proof_verify.js",
+    "bin/xoonya.js",
+    "bin/xoonya-first-run.js",
+    "scripts/verify_vectors.js",
+    "scripts/verify_release_candidate.js",
+    "vectors/conformance-vectors.json",
+    "vectors/adversarial-vectors.json",
+    "vectors/native-atom-vectors.json",
+    "vectors/native-payload-profile-vectors.json",
     "README.md",
-    "XOONYA_PROOF_TRUTH_MODEL.md",
-    "XOONYA_DEFAULT_PATH_MODEL.md",
-    "XOONYA_FOLLOWTHROUGH_TRUTH_MODEL.md",
-    "XOONYA_NATIVE_PROOF_FORMAT.md",
-    "XOONYA_NATIVE_ATOM_SPEC.md",
-    "XOONYA_NATIVE_STANDARD_GOVERNANCE.md",
-    "XNYA_CONFORMANCE_MARK.md",
-    "XNYA_REFERENCE_IMPLEMENTATIONS.md",
-    "WHY_XYTARA_XOONYA.md",
-    "CARRIED_HANDOFF_DEMO.md",
-    "PARTNER_READY_PATH.md",
-    "EXAMPLE_PATHS.md",
-    "PUBLIC_DEMO_SCRIPT.md",
     "START_HERE.md",
-    "examples/",
-    "FINAL_CONTRACT.md",
-    "SERVICE_CONTRACT.md",
-    "TERMINOLOGY.md",
-    "CROSS_RUNTIME_POSTURE.md",
-    "COMPATIBILITY_NOTE.md",
+    "RELEASE_NOTES.md",
     "LICENSE",
     "NOTICE"
   ],
@@ -60,22 +40,19 @@
   },
   "keywords": [
     "proof",
-    "review",
-    "handoff",
-    "governance",
-    "audit",
+    "verifier",
+    "verification",
     "receipt",
-    "canonical-events",
     "proof-bundle",
     "deterministic",
     "machine",
     "evidence",
     "post-quantum",
     "ml-dsa",
-    "slh-dsa",
     "pqc",
     "xnya",
     "ed25519",
+    "jws",
     "x402"
   ],
   "scripts": {

package/scripts/verify_release_candidate.js

@@ -1,131 +1,258 @@
 "use strict";
 
+// Release-candidate gate for the xoonya verifier package. Node built-ins only.
+//
+// Source checkout (proof_sdk.js present): the `npm pack --dry-run` file list must
+// equal the publish allowlist exactly, the vectors must pass on the standalone
+// verifier AND the engine-parity cross-check must run, and the CLI surface must
+// behave as documented.
+//
+// Installed package (no proof_sdk.js): the engine, server and operator tooling
+// must be absent, and the vectors must pass on the standalone verifier.
+
 const assert = require("assert");
 const fs = require("fs");
 const path = require("path");
-const { execFileSync, execSync } = require("child_process");
-const packageJson = require("../package.json");
-
-function parsePackDryRun() {
-  const output = execSync("npm pack --dry-run --json", {
-    cwd: path.resolve(__dirname, ".."),
-    encoding: "utf8"
-  });
-  const parsed = JSON.parse(output);
-  return Array.isArray(parsed) ? parsed[0] : parsed;
+const { execFileSync, execSync, spawnSync } = require("child_process");
+
+const ROOT = path.resolve(__dirname, "..");
+const packageJson = JSON.parse(fs.readFileSync(path.join(ROOT, "package.json"), "utf8"));
+
+const PUBLISHED_FILES = Object.freeze([
+  "LICENSE",
+  "NOTICE",
+  "README.md",
+  "RELEASE_NOTES.md",
+  "START_HERE.md",
+  "bin/xoonya-first-run.js",
+  "bin/xoonya.js",
+  "lib/external_proof_verify.js",
+  "lib/native_verify.js",
+  "package.json",
+  "scripts/verify_release_candidate.js",
+  "scripts/verify_vectors.js",
+  "vectors/adversarial-vectors.json",
+  "vectors/conformance-vectors.json",
+  "vectors/native-atom-vectors.json",
+  "vectors/native-payload-profile-vectors.json",
+  "verify.js"
+]);
+
+// Never published. Checked against the pack list in the source checkout and
+// against the filesystem in an installed package.
+const FORBIDDEN_PATHS = Object.freeze([
+  "proof_sdk.js",
+  "server.js",
+  "index.js",
+  ".env.example",
+  "integrations",
+  "reference",
+  "examples",
+  "bin/xoonya-release.js",
+  "bin/xoonya-review.js",
+  "scripts/verify_all.js",
+  "scripts/verify_service.js",
+  "scripts/verify_tooling.js",
+  "lib/release_center.js",
+  "lib/release_pack.js",
+  "lib/review_intelligence.js",
+  "lib/governance_intelligence.js",
+  "lib/bridge_intelligence.js"
+]);
+
+const REQUIRED_NATIVE_METHODS = Object.freeze([
+  "xoonya-native-sha256-v1",
+  "xoonya-native-signed-v1",
+  "xoonya-native-anchored-v1"
+]);
+
+const checks = [];
+function check(name, condition, detail) {
+  assert.strictEqual(Boolean(condition), true, detail ? `${name}: ${detail}` : name);
+  checks.push(name);
+}
+
+function runNode(args, options = {}) {
+  return execFileSync(process.execPath, args, { cwd: ROOT, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"], ...options });
+}
+
+function verifyPackageManifest() {
+  check("package name", packageJson.name === "xoonya");
+  check("package main is verify.js", packageJson.main === "verify.js");
+  check("package bin is xoonya only", JSON.stringify(packageJson.bin) === JSON.stringify({ xoonya: "bin/xoonya.js" }));
+  check("package license Apache-2.0", packageJson.license === "Apache-2.0");
+  check("package publish access public", packageJson.publishConfig && packageJson.publishConfig.access === "public");
+  check("package prepublishOnly runs the gate", packageJson.scripts && packageJson.scripts.prepublishOnly === "npm run verify:release-candidate");
+  check("package files allowlist declared", Array.isArray(packageJson.files) && packageJson.files.length > 0);
+  for (const forbidden of FORBIDDEN_PATHS) {
+    check(`package files excludes ${forbidden}`, !packageJson.files.some((entry) => entry === forbidden || entry === `${forbidden}/` || entry.startsWith(`${forbidden}/`)));
+  }
+  check("package description names the verifier role", /verif/i.test(packageJson.description || ""));
 }
 
 function verifyReleaseNotes() {
-  const notesPath = path.resolve(__dirname, "..", "RELEASE_NOTES.md");
-  const notes = fs.readFileSync(notesPath, "utf8");
-  assert.strictEqual(
-    /^#\s+xoonya\s+\d+\.\d+\.\d+\s+Release Notes\s*$/m.test(notes),
-    false,
-    "RELEASE_NOTES.md must not duplicate the GitHub release title as a heading"
-  );
-  assert.strictEqual(
-    notes.includes(`xoonya\` ${packageJson.version}`),
-    true,
-    "RELEASE_NOTES.md must mention the current package version"
-  );
-  const mentionedVersions = notes.match(/\b\d+\.\d+\.\d+\b/g) || [];
-  assert.strictEqual(
-    mentionedVersions.every((version) => version === packageJson.version),
-    true,
-    "RELEASE_NOTES.md must not mention prior package versions"
-  );
+  const notes = fs.readFileSync(path.join(ROOT, "RELEASE_NOTES.md"), "utf8");
+  check("release notes do not duplicate the release title heading", !/^#\s+xoonya\s+\d+\.\d+\.\d+\s+Release Notes\s*$/m.test(notes));
+  check("release notes mention the package version", notes.includes(`\`xoonya\` ${packageJson.version}`), `expected \`xoonya\` ${packageJson.version}`);
+  const mentioned = notes.match(/\b\d+\.\d+\.\d+\b/g) || [];
+  check("release notes mention no other version", mentioned.every((version) => version === packageJson.version), `found ${JSON.stringify(Array.from(new Set(mentioned)))}`);
+}
+
+// Every shipped JS file may require only Node built-ins or other shipped files.
+function verifyShippedRequires() {
+  const builtins = new Set(require("module").builtinModules);
+  const shippedJs = PUBLISHED_FILES.filter((entry) => entry.endsWith(".js"));
+  for (const file of shippedJs) {
+    const source = fs.readFileSync(path.join(ROOT, file), "utf8");
+    const pattern = /require\(\s*["']([^"']+)["']\s*\)/g;
+    let match;
+    while ((match = pattern.exec(source)) !== null) {
+      const target = match[1];
+      if (target.startsWith(".")) {
+        const resolved = path.relative(ROOT, path.resolve(ROOT, path.dirname(file), target)).replace(/\\/g, "/");
+        const candidates = [resolved, `${resolved}.js`, `${resolved}.json`];
+        check(`${file} requires shipped ${target}`, candidates.some((candidate) => PUBLISHED_FILES.includes(candidate)), `resolved to ${resolved}`);
+      } else {
+        check(`${file} requires built-in ${target}`, builtins.has(target.replace(/^node:/, "")));
+      }
+    }
+  }
+}
+
+function verifyPackList() {
+  const output = execSync("npm pack --dry-run --json", { cwd: ROOT, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] });
+  const parsed = JSON.parse(output);
+  const dryRun = Array.isArray(parsed) ? parsed[0] : parsed;
+  check("npm pack name", dryRun.name === packageJson.name);
+  check("npm pack version", dryRun.version === packageJson.version);
+  const packed = dryRun.files.map((entry) => entry.path).sort();
+  const expected = PUBLISHED_FILES.slice().sort();
+  const extra = packed.filter((entry) => !expected.includes(entry));
+  const missing = expected.filter((entry) => !packed.includes(entry));
+  check("npm pack file list equals the publish allowlist", extra.length === 0 && missing.length === 0, `extra=${JSON.stringify(extra)} missing=${JSON.stringify(missing)}`);
+  for (const forbidden of FORBIDDEN_PATHS) {
+    check(`npm pack excludes ${forbidden}`, !packed.some((entry) => entry === forbidden || entry.startsWith(`${forbidden}/`)));
+  }
+  return packed.length;
+}
+
+function verifyInstalledLayout() {
+  for (const forbidden of FORBIDDEN_PATHS) {
+    check(`installed package has no ${forbidden}`, !fs.existsSync(path.join(ROOT, forbidden)));
+  }
+  const libFiles = fs.readdirSync(path.join(ROOT, "lib")).sort();
+  check("installed lib/ holds only the two verifier modules", JSON.stringify(libFiles) === JSON.stringify(["external_proof_verify.js", "native_verify.js"]), JSON.stringify(libFiles));
+  const scriptFiles = fs.readdirSync(path.join(ROOT, "scripts")).sort();
+  check("installed scripts/ holds only the two shipped scripts", JSON.stringify(scriptFiles) === JSON.stringify(["verify_release_candidate.js", "verify_vectors.js"]), JSON.stringify(scriptFiles));
+  const binFiles = fs.readdirSync(path.join(ROOT, "bin")).sort();
+  check("installed bin/ holds only the dispatcher and first-run", JSON.stringify(binFiles) === JSON.stringify(["xoonya-first-run.js", "xoonya.js"]), JSON.stringify(binFiles));
+  for (const file of PUBLISHED_FILES) {
+    check(`installed package has ${file}`, fs.existsSync(path.join(ROOT, file)));
+  }
+  return PUBLISHED_FILES.length;
+}
+
+function verifyVectors(inRepo) {
+  const args = [path.join(ROOT, "scripts", "verify_vectors.js"), "--json"];
+  if (inRepo) args.push("--require-engine-parity");
+  const summary = JSON.parse(runNode(args));
+  check("vectors ok", summary.ok === true);
+  check("conformance vector count", summary.conformance_count >= 8, String(summary.conformance_count));
+  check("adversarial vector count", summary.adversarial_count >= 8, String(summary.adversarial_count));
+  check("native atom vectors", summary.native_atom_vector_count >= 1 && summary.native_atom_adversarial_count >= 1);
+  for (const method of REQUIRED_NATIVE_METHODS) {
+    check(`verification methods include ${method}`, summary.verification_methods.includes(method));
+  }
+  check("verification methods include xoonya-native-hybrid-v1", summary.verification_methods.includes("xoonya-native-hybrid-v1"));
+  check("adversarial reasons include native_hybrid_pq_signature_invalid", summary.adversarial_reasons.includes("native_hybrid_pq_signature_invalid"));
+  check("external signature self-test Ed25519", summary.external_signature_checks.EdDSA === true);
+  check("external signature self-test ML-DSA-65", summary.external_signature_checks["ML-DSA-65"] === true);
+  if (inRepo) {
+    check("engine parity checked", summary.engine_parity.checked === true);
+    check("engine parity comparisons", summary.engine_parity.comparisons >= 100, String(summary.engine_parity.comparisons));
+  } else {
+    check("engine not present", summary.engine_parity.checked === false && summary.engine_parity.reason === "engine_not_present");
+  }
+  return summary;
+}
+
+function verifyCli() {
+  const cli = path.join(ROOT, "bin", "xoonya.js");
+  const startHere = runNode([cli, "start-here"]);
+  check("start-here names the anchored method", startHere.includes("xoonya-native-anchored-v1"));
+  check("start-here links the first-run kit", startHere.includes("https://www.naxytra.com/v1/first-run-kit"));
+  check("start-here states the verifier role", startHere.includes("this package is the verifier"));
+
+  const firstRun = JSON.parse(runNode([cli, "first-run", "--verify-native", "--pretty"]));
+  check("first-run --verify-native ok", firstRun.ok === true);
+  check("first-run required native methods present", firstRun.required_native_methods_present === true);
+
+  const guide = JSON.parse(runNode([cli, "first-run", "--json", "--offline"]));
+  check("first-run guide category", guide.category === "xoonya-first-run-proof-guide");
+
+  const conformance = JSON.parse(runNode([cli, "conformance", "--json"]));
+  check("conformance --json ok", conformance.ok === true);
+  check("conformance --json includes anchored method", conformance.verification_methods.includes("xoonya-native-anchored-v1"));
+
+  for (const command of ["release", "review"]) {
+    const result = spawnSync(process.execPath, [cli, command, "--summary"], { cwd: ROOT, encoding: "utf8" });
+    check(`${command} command exits 2`, result.status === 2, String(result.status));
+    check(`${command} command points to the website`, `${result.stdout}${result.stderr}`.includes("Operator tooling is not part of the xoonya verifier package. See https://www.naxytra.com/xoonya"));
+  }
+
+  const vectors = JSON.parse(fs.readFileSync(path.join(ROOT, "vectors", "conformance-vectors.json"), "utf8"));
+  const anchored = vectors.vectors.find((vector) => vector.expected.receipt.algorithm === "xoonya-native-anchored-v1");
+  const bundleFile = path.join(require("os").tmpdir(), `xoonya-rc-bundle-${process.pid}.json`);
+  fs.writeFileSync(bundleFile, JSON.stringify({
+    version: anchored.expected.proof_bundle_version,
+    ceb: anchored.event,
+    receipt: anchored.expected.receipt,
+    anchors: anchored.anchors
+  }));
+  try {
+    const verified = JSON.parse(runNode([cli, "verify", bundleFile]));
+    check("verify <bundle> accepts the anchored vector", verified.valid === true && verified.verification_method === "xoonya-native-anchored-v1");
+    const strict = spawnSync(process.execPath, [cli, "verify", bundleFile, "--strict"], { cwd: ROOT, encoding: "utf8" });
+    check("verify --strict rejects the digest-class bundle with exit 1", strict.status === 1 && JSON.parse(strict.stdout).reason === "digest_only_not_cryptographically_verified");
+  } finally {
+    fs.unlinkSync(bundleFile);
+  }
+}
+
+function verifyEntry() {
+  const entry = require(path.join(ROOT, "verify.js"));
+  for (const name of ["verifyNativeProof", "verifyNativeBundle", "verifyProofBundle", "verifyDetachedSignature", "verifyJws", "verifyExternalProofSignature", "verifyxoonyaNativeAtom", "verifyVectors", "canonicalizeEvent", "hashEvent"]) {
+    check(`entry exports ${name}`, typeof entry[name] === "function");
+  }
+  for (const name of ["emitReceipt", "buildProofBundle", "buildNativeSignedReceiptProof", "buildNativeHybridReceiptProof", "createReceipt", "reviewGovernanceCase", "buildBridgeCenter"]) {
+    check(`entry does not export engine function ${name}`, entry[name] === undefined);
+  }
+  check("entry version equals package version", entry.version === packageJson.version);
+  check("entry endpoints", entry.endpoints.hosted_service === "https://xoonya.onrender.com" && entry.endpoints.website === "https://www.naxytra.com");
 }
 
 function main() {
-  const releaseOutput = execFileSync(process.execPath, [
-    path.resolve(__dirname, "..", "bin", "xoonya-release.js"),
-    "--candidate",
-    "--summary"
-  ], {
-    cwd: path.resolve(__dirname, ".."),
-    encoding: "utf8"
-  });
-  const releaseCandidate = JSON.parse(releaseOutput);
-  assert.strictEqual(releaseCandidate.product, "xoonya", "release candidate product mismatch");
-  assert.strictEqual(releaseCandidate.publish_access, "public", "release candidate publish access mismatch");
-  assert.strictEqual(releaseCandidate.checklist_count >= 5, true, "release candidate checklist count mismatch");
+  const inRepo = fs.existsSync(path.join(ROOT, "proof_sdk.js"));
+  verifyPackageManifest();
   verifyReleaseNotes();
-
-  const conformanceOutput = execFileSync(process.execPath, [
-    path.resolve(__dirname, "..", "bin", "xoonya.js"),
-    "conformance",
-    "--json"
-  ], {
-    cwd: path.resolve(__dirname, ".."),
-    encoding: "utf8"
-  });
-  const conformanceSummary = JSON.parse(conformanceOutput);
-  assert.strictEqual(conformanceSummary.ok, true, "conformance command did not pass");
-  assert.strictEqual(conformanceSummary.conformance_count >= 8, true, "conformance vector count too small");
-  assert.strictEqual(conformanceSummary.adversarial_count >= 8, true, "adversarial vector count too small");
-  assert.strictEqual(
-    conformanceSummary.adversarial_reasons.includes("native_hybrid_pq_signature_invalid"),
-    true,
-    "native hybrid adversarial reason missing"
-  );
-  assert.deepStrictEqual(
-    conformanceSummary.verification_methods,
-    [
-      "detached-assertion-v1",
-      "did-vc-v1",
-      "jwt-assertion-v1",
-      "legacy-opreturn-v1",
-      "partner-proof-envelope-v1",
-      "sd-jwt-vc-v1",
-      "signed-envelope-v1",
-      "xoonya-native-anchored-v1",
-      "xoonya-native-hybrid-v1",
-      "xoonya-native-sha256-v1",
-      "xoonya-native-signed-v1"
-    ],
-    "conformance methods mismatch"
-  );
-
-  const dryRun = parsePackDryRun();
-  assert.strictEqual(dryRun.name, packageJson.name, "npm pack dry-run name mismatch");
-  assert.strictEqual(dryRun.version, packageJson.version, "npm pack dry-run version mismatch");
-  assert.strictEqual(Array.isArray(dryRun.files), true, "npm pack dry-run file list missing");
-  assert.strictEqual(dryRun.files.some((entry) => entry.path === "bin/xoonya.js"), true, "npm pack dry-run missing xoonya cli");
-  assert.strictEqual(dryRun.files.some((entry) => entry.path === "bin/xoonya-first-run.js"), true, "npm pack dry-run missing xoonya-first-run");
-  assert.strictEqual(dryRun.files.some((entry) => entry.path === "bin/xoonya-review.js"), true, "npm pack dry-run missing xoonya-review");
-  assert.strictEqual(dryRun.files.some((entry) => entry.path === "bin/xoonya-release.js"), true, "npm pack dry-run missing xoonya-release");
-  assert.strictEqual(dryRun.files.some((entry) => entry.path === "scripts/verify_external_proof_import_gate.js"), true, "npm pack dry-run missing external proof import gate verifier script");
-  assert.strictEqual(dryRun.files.some((entry) => entry.path === "scripts/verify_vectors.js"), true, "npm pack dry-run missing conformance verifier script");
-  assert.strictEqual(dryRun.files.some((entry) => entry.path === "scripts/verify_reference_python.js"), true, "npm pack dry-run missing Python reference verifier script");
-  assert.strictEqual(dryRun.files.some((entry) => entry.path === "scripts/verify_reference_python_crypto.js"), true, "npm pack dry-run missing Python crypto reference verifier script");
-  assert.strictEqual(dryRun.files.some((entry) => entry.path === "scripts/verify_reference_promotion_gate.js"), true, "npm pack dry-run missing reference promotion gate verifier script");
-  assert.strictEqual(dryRun.files.some((entry) => entry.path === "scripts/verify_reference_rust_scaffold.js"), true, "npm pack dry-run missing Rust reference scaffold verifier script");
-  assert.strictEqual(dryRun.files.some((entry) => entry.path === "scripts/verify_native_hybrid_design_gate.js"), true, "npm pack dry-run missing native hybrid verifier script");
-  assert.strictEqual(dryRun.files.some((entry) => entry.path === "scripts/verify_verification_services.js"), true, "npm pack dry-run missing verification services verifier script");
-  assert.strictEqual(dryRun.files.some((entry) => entry.path === "scripts/verify_all.js"), true, "npm pack dry-run missing package verifier script");
-  assert.strictEqual(dryRun.files.some((entry) => entry.path === "vectors/conformance-vectors.json"), true, "npm pack dry-run missing conformance vectors");
-  assert.strictEqual(dryRun.files.some((entry) => entry.path === "vectors/adversarial-vectors.json"), true, "npm pack dry-run missing adversarial vectors");
-  assert.strictEqual(dryRun.files.some((entry) => entry.path === "vectors/native-atom-vectors.json"), true, "npm pack dry-run missing native atom vectors");
-  assert.strictEqual(dryRun.files.some((entry) => entry.path === "README.md"), true, "npm pack dry-run missing README");
-  assert.strictEqual(dryRun.files.some((entry) => entry.path === "XOONYA_NATIVE_ATOM_SPEC.md"), true, "npm pack dry-run missing native atom spec");
-  assert.strictEqual(dryRun.files.some((entry) => entry.path === "XOONYA_NATIVE_STANDARD_GOVERNANCE.md"), true, "npm pack dry-run missing native governance doc");
-  assert.strictEqual(dryRun.files.some((entry) => entry.path === "XNYA_CONFORMANCE_MARK.md"), true, "npm pack dry-run missing XNYA conformance mark doc");
-  assert.strictEqual(dryRun.files.some((entry) => entry.path === "XNYA_REFERENCE_IMPLEMENTATIONS.md"), true, "npm pack dry-run missing XNYA reference implementations doc");
-  assert.strictEqual(dryRun.files.some((entry) => entry.path === "reference/python/xnya_reference.py"), true, "npm pack dry-run missing Python XNYA candidate reference");
-  assert.strictEqual(dryRun.files.some((entry) => entry.path === "reference/python/verify_vectors.py"), true, "npm pack dry-run missing Python XNYA vector verifier");
-  assert.strictEqual(dryRun.files.some((entry) => entry.path === "reference/python/requirements-optional.txt"), true, "npm pack dry-run missing Python optional requirements");
-  assert.strictEqual(dryRun.files.some((entry) => entry.path === "reference/rust/Cargo.toml"), true, "npm pack dry-run missing Rust candidate Cargo manifest");
-  assert.strictEqual(dryRun.files.some((entry) => entry.path === "reference/rust/src/lib.rs"), true, "npm pack dry-run missing Rust candidate source");
-  assert.strictEqual(dryRun.files.some((entry) => entry.path === "reference/rust/README.md"), true, "npm pack dry-run missing Rust candidate boundary doc");
-  assert.strictEqual(dryRun.files.some((entry) => entry.path === "RELEASE_NOTES.md"), true, "npm pack dry-run missing release notes");
-  assert.strictEqual(dryRun.files.some((entry) => entry.path === "START_HERE.md"), true, "npm pack dry-run missing start-here");
-  assert.strictEqual(dryRun.files.some((entry) => entry.path === "SERVICE_CONTRACT.md"), true, "npm pack dry-run missing service contract");
-  assert.strictEqual(dryRun.files.some((entry) => entry.path === "OPERATOR_START_HERE.md"), false, "npm pack dry-run should not ship operator start-here");
-  assert.strictEqual(dryRun.files.some((entry) => entry.path === "OPERATIONS_RUNBOOK.md"), false, "npm pack dry-run should not ship operations runbook");
-  assert.strictEqual(dryRun.files.some((entry) => entry.path === "PUBLISH_PLAN.md"), false, "npm pack dry-run should not ship publish plan");
-  assert.strictEqual(dryRun.files.length >= 10, true, "npm pack dry-run file count too small");
-
-  console.log("xoonya verify:release-candidate passed");
+  verifyShippedRequires();
+  const publishedFileCount = inRepo ? verifyPackList() : verifyInstalledLayout();
+  const summary = verifyVectors(inRepo);
+  verifyCli();
+  verifyEntry();
+  process.stdout.write(`${JSON.stringify({
+    ok: true,
+    product: "xoonya",
+    category: "xoonya-verifier-release-candidate",
+    mode: inRepo ? "source_checkout" : "installed_package",
+    version: packageJson.version,
+    published_file_count: publishedFileCount,
+    conformance_count: summary.conformance_count,
+    adversarial_count: summary.adversarial_count,
+    verification_method_count: summary.verification_methods.length,
+    engine_parity_comparisons: summary.engine_parity.checked ? summary.engine_parity.comparisons : null,
+    check_count: checks.length
+  })}\n`);
 }
 
 main();