xoonya 3.1.17 → 3.2.1

package/scripts/verify_control_plane_routes.js

@@ -1,70 +0,0 @@
-"use strict";
-
-const assert = require("assert");
-const { createServer } = require("../server.js");
-
-async function getJson(baseUrl, route) {
-  const response = await fetch(`${baseUrl}${route}`);
-  return {
-    status: response.status,
-    json: await response.json()
-  };
-}
-
-async function main() {
-  const server = createServer();
-  await new Promise((resolve) => server.listen(0, "127.0.0.1", resolve));
-  const address = server.address();
-  const baseUrl = `http://127.0.0.1:${address.port}`;
-
-  try {
-    const adapterCertification = await getJson(baseUrl, "/v1/adapter-certification");
-    assert.strictEqual(adapterCertification.status, 200, "adapter certification route failed");
-    assert.strictEqual(adapterCertification.json.category, "naxytra-adapter-certification-contract", "adapter certification category mismatch");
-    assert.strictEqual(adapterCertification.json.certification_fronts.length >= 8, true, "adapter certification front count mismatch");
-
-    const adapterCertificationSummary = await getJson(baseUrl, "/v1/adapter-certification/summary");
-    assert.strictEqual(adapterCertificationSummary.status, 200, "adapter certification summary route failed");
-    assert.strictEqual(adapterCertificationSummary.json.certification_state_count >= 5, true, "adapter certification summary count mismatch");
-
-    const adapterCertificationDetail = await getJson(baseUrl, "/v1/adapter-certification/protocol_front");
-    assert.strictEqual(adapterCertificationDetail.status, 200, "adapter certification detail route failed");
-    assert.strictEqual(adapterCertificationDetail.json.front.front_id, "protocol_front", "adapter certification detail mismatch");
-
-    const trustBoundary = await getJson(baseUrl, "/v1/trust-portability-boundary");
-    assert.strictEqual(trustBoundary.status, 200, "trust portability boundary route failed");
-    assert.strictEqual(trustBoundary.json.category, "naxytra-trust-portability-boundary-contract", "trust portability boundary category mismatch");
-    assert.strictEqual(trustBoundary.json.portable_axes.length >= 4, true, "trust portability boundary axis count mismatch");
-
-    const trustBoundarySummary = await getJson(baseUrl, "/v1/trust-portability-boundary/summary");
-    assert.strictEqual(trustBoundarySummary.status, 200, "trust portability boundary summary route failed");
-    assert.strictEqual(trustBoundarySummary.json.portable_axis_count >= 4, true, "trust portability boundary summary count mismatch");
-
-    const trustBoundaryDetail = await getJson(baseUrl, "/v1/trust-portability-boundary/agent_identity_portability");
-    assert.strictEqual(trustBoundaryDetail.status, 200, "trust portability boundary detail route failed");
-    assert.strictEqual(trustBoundaryDetail.json.axis.axis_id, "agent_identity_portability", "trust portability boundary detail mismatch");
-
-    const signedAudit = await getJson(baseUrl, "/v1/signed-audit-provenance");
-    assert.strictEqual(signedAudit.status, 200, "signed audit provenance route failed");
-    assert.strictEqual(signedAudit.json.category, "naxytra-signed-audit-provenance-contract", "signed audit provenance category mismatch");
-    assert.strictEqual(signedAudit.json.evidence_surfaces.length >= 6, true, "signed audit provenance evidence surface count mismatch");
-
-    const signedAuditSummary = await getJson(baseUrl, "/v1/signed-audit-provenance/summary");
-    assert.strictEqual(signedAuditSummary.status, 200, "signed audit provenance summary route failed");
-    assert.strictEqual(signedAuditSummary.json.evidence_surface_count >= 6, true, "signed audit provenance summary count mismatch");
-
-    const signedAuditDetail = await getJson(baseUrl, "/v1/signed-audit-provenance/release_provenance");
-    assert.strictEqual(signedAuditDetail.status, 200, "signed audit provenance detail route failed");
-    assert.strictEqual(signedAuditDetail.json.surface.surface_id, "release_provenance", "signed audit provenance detail mismatch");
-  } finally {
-    await new Promise((resolve) => server.close(resolve));
-  }
-
-  console.log("xoonya verify:control-plane-routes passed");
-}
-
-main().catch((error) => {
-  console.error(error);
-  process.exit(1);
-});
-

package/scripts/verify_examples.js

@@ -1,19 +0,0 @@
-"use strict";
-
-const { spawnSync } = require("child_process");
-const path = require("path");
-
-function runExample(scriptPath) {
-  const result = spawnSync(process.execPath, [scriptPath], {
-    stdio: "inherit"
-  });
-  if (result.status !== 0) {
-    process.exit(result.status || 1);
-  }
-}
-
-runExample(path.join(__dirname, "..", "examples", "package_quickstart.js"));
-runExample(path.join(__dirname, "..", "examples", "review_carried_handoff.js"));
-runExample(path.join(__dirname, "..", "examples", "partner_proof_walkthrough.js"));
-runExample(path.join(__dirname, "..", "examples", "proof_review_walkthrough.js"));
-runExample(path.join(__dirname, "..", "examples", "integration_boundary_walkthrough.js"));

package/scripts/verify_external_proof_import_gate.js

@@ -1,84 +0,0 @@
-"use strict";
-
-const assert = require("assert");
-const {
-  buildExternalProofImportAdapterPack,
-  validateExternalProofImportEvidence
-} = require("../proof_sdk");
-
-function validImport() {
-  return {
-    method: "jwt-assertion-v1",
-    import_ref: "external-import-gate-demo",
-    issuer_ref: "did:example:issuer",
-    subject_ref: "txn:xytara:demo",
-    external_proof: "eyJhbGciOiJFZERTQSJ9.eyJzdWIiOiJ0eG4teHl0YXJhLWRlbW8ifQ.signature",
-    evidence_refs: ["memory://external/import-gate-demo"]
-  };
-}
-
-function assertRejected(input, expectedCode) {
-  const validation = validateExternalProofImportEvidence(input);
-  assert.strictEqual(validation.import_allowed, false, `expected ${expectedCode} to block external proof import`);
-  assert.strictEqual(
-    validation.rejection_codes.includes(expectedCode),
-    true,
-    `missing deterministic rejection code ${expectedCode}`
-  );
-  return validation;
-}
-
-function main() {
-  const pack = buildExternalProofImportAdapterPack();
-  const validValidation = validateExternalProofImportEvidence(validImport());
-
-  assert.strictEqual(pack.category, "xoonya-external-proof-import-adapter", "external import adapter category mismatch");
-  assert.strictEqual(pack.deterministic_rejection_codes.length >= 11, true, "external import rejection code count missing");
-  assert.strictEqual(validValidation.import_allowed, true, "valid structural external import should pass");
-  assert.deepStrictEqual(validValidation.rejection_codes, [], "valid structural external import should not carry rejection codes");
-
-  assertRejected({ ...validImport(), method: "" }, "verification_method_required");
-  assertRejected({ ...validImport(), method: "unknown-method-v1" }, "verification_method_unsupported");
-  assertRejected({ ...validImport(), method: "xoonya-native-sha256-v1" }, "verification_method_not_external_importable");
-  assertRejected({ method: "jwt-assertion-v1" }, "external_proof_material_required");
-  assertRejected({ ...validImport(), external_proof: "   " }, "external_proof_material_empty");
-  assertRejected({ ...validImport(), declared_hash_sha256: "00".repeat(32) }, "external_proof_hash_mismatch");
-  assertRejected({ ...validImport(), claim_external_issuer_truth: true }, "external_issuer_truth_claim_requires_external_verifier");
-  assertRejected({ ...validImport(), claim_external_signature_truth: true }, "external_signature_truth_claim_requires_external_verifier");
-  assertRejected({ ...validImport(), claim_external_revocation_status: true }, "external_revocation_status_claim_requires_external_verifier");
-  assertRejected({ ...validImport(), method: "did-vc-v1", claim_did_resolution_truth: true }, "did_resolution_truth_claim_requires_external_verifier");
-  assertRejected({ ...validImport(), external_verifier_api_key: "sk_live_accidental_secret" }, "secret_material_forbidden");
-
-  const externallyVerified = validateExternalProofImportEvidence({
-    ...validImport(),
-    method: "did-vc-v1",
-    external_proof: {
-      "@context": ["https://www.w3.org/ns/credentials/v2"],
-      type: ["VerifiableCredential"],
-      issuer: "did:example:issuer",
-      credentialSubject: { id: "did:example:agent" }
-    },
-    claim_external_issuer_truth: true,
-    claim_external_signature_truth: true,
-    claim_external_revocation_status: true,
-    claim_did_resolution_truth: true,
-    external_issuer_verifier_ref: "external.verifier.issuer.did-vc.2026-04-22",
-    external_signature_verifier_ref: "external.verifier.signature.did-vc.2026-04-22",
-    external_revocation_verifier_ref: "external.verifier.revocation.did-vc.2026-04-22",
-    did_resolution_verifier_ref: "external.verifier.did_resolution.did-vc.2026-04-22"
-  });
-  assert.strictEqual(externallyVerified.import_allowed, true, "external verifier-backed truth claims should pass structural validation");
-
-  const output = {
-    ok: true,
-    product: "xoonya",
-    category: "xoonya-external-proof-import-gate-verification",
-    status: "external_import_binds_evidence_without_claiming_external_truth_unless_external_verifier_refs_exist",
-    deterministic_rejection_code_count: pack.deterministic_rejection_codes.length,
-    adversarial_case_count: 11,
-    boundary: "xoonya_imports_external_evidence_but_external_issuer_signature_revocation_and_did_truth_stay_with_external_verifiers"
-  };
-  process.stdout.write(`${JSON.stringify(output, null, 2)}\n`);
-}
-
-main();

package/scripts/verify_external_proof_signature.js

@@ -1,142 +0,0 @@
-"use strict";
-
-// Verifies xoonya's external-proof signature verification (lib/external_proof_verify.js
-// + proof_sdk integration) under the HONEST trust model: it reports signature_valid
-// (a fact) + signing_key_ref, and only reports trust_anchored when the caller declared
-// an expected_key_ref that matches the signer. Covers JWS (EdDSA/ES256/RS256), the
-// alg<->key binding, alg:none/crit/malformed rejection, private-key refusal, detached
-// signatures, import-run promotion, and byte-for-byte backward compatibility.
-
-const crypto = require("crypto");
-const assert = require("assert");
-const { verifyJws, verifyDetachedSignature } = require("../lib/external_proof_verify");
-
-const b64url = (buf) => Buffer.from(buf).toString("base64url");
-
-function makeJws(alg, payloadObj, signFn, extraHeader) {
-  const header = { alg, ...(extraHeader || {}) };
-  const protectedB64 = b64url(Buffer.from(JSON.stringify(header), "utf8"));
-  const payloadB64 = b64url(Buffer.from(JSON.stringify(payloadObj), "utf8"));
-  const signingInput = `${protectedB64}.${payloadB64}`;
-  return `${signingInput}.${b64url(signFn(Buffer.from(signingInput, "utf8")))}`;
-}
-
-function main() {
-  const ed = crypto.generateKeyPairSync("ed25519");
-  const edPubPem = ed.publicKey.export({ type: "spki", format: "pem" });
-  const edJws = makeJws("EdDSA", { sub: "agent-1" }, (d) => crypto.sign(null, d, ed.privateKey));
-
-  // 1. EdDSA JWS: signature_valid is a fact; trust requires a declared key ref.
-  let r = verifyJws(edJws, { trusted_public_key: edPubPem });
-  assert.strictEqual(r.ok, true);
-  assert.strictEqual(r.signature_valid, true, "EdDSA signature valid");
-  assert.ok(r.signing_key_ref && r.signing_key_ref.startsWith("ed25519-"));
-  assert.strictEqual(r.trust_anchored, false, "no expected_key_ref -> not trust-anchored");
-  const edRef = r.signing_key_ref;
-  assert.strictEqual(verifyJws(edJws, { trusted_public_key: edPubPem, expected_key_ref: edRef }).trust_anchored, true, "matching expected_key_ref -> anchored");
-  assert.strictEqual(verifyJws(edJws, { trusted_public_key: edPubPem, expected_key_ref: "ed25519-spki-sha256:deadbeef" }).trust_anchored, false, "wrong expected_key_ref -> not anchored");
-
-  // wrong key / tamper -> signature invalid
-  const ed2 = crypto.generateKeyPairSync("ed25519");
-  assert.strictEqual(verifyJws(edJws, { trusted_public_key: ed2.publicKey.export({ type: "spki", format: "pem" }) }).signature_valid, false);
-
-  // 2. Embedded self-asserted key: signature internally valid but NOT caller-supplied.
-  const edJwk = ed.publicKey.export({ format: "jwk" });
-  const edJwsEmbedded = makeJws("EdDSA", { sub: "agent-1" }, (d) => crypto.sign(null, d, ed.privateKey), { jwk: edJwk });
-  r = verifyJws(edJwsEmbedded);
-  assert.strictEqual(r.signature_valid, true, "embedded-key signature internally valid");
-  assert.strictEqual(r.key_source, "embedded_self_asserted");
-  assert.strictEqual(r.trust_anchored, false, "self-asserted key is never trust-anchored");
-
-  // 3. ES256 works; alg<->key binding rejects an ES256K header over a P-256 key.
-  const ec = crypto.generateKeyPairSync("ec", { namedCurve: "P-256" });
-  const ecPubPem = ec.publicKey.export({ type: "spki", format: "pem" });
-  const es256Jws = makeJws("ES256", { sub: "a" }, (d) => crypto.sign("sha256", d, { key: ec.privateKey, dsaEncoding: "ieee-p1363" }));
-  assert.strictEqual(verifyJws(es256Jws, { trusted_public_key: ecPubPem }).signature_valid, true, "ES256 valid");
-  const es256kMisdeclared = makeJws("ES256K", { sub: "a" }, (d) => crypto.sign("sha256", d, { key: ec.privateKey, dsaEncoding: "ieee-p1363" }));
-  assert.strictEqual(verifyJws(es256kMisdeclared, { trusted_public_key: ecPubPem }).signature_valid, false, "alg<->key mismatch (ES256K over P-256) rejected");
-
-  // 4. RS256
-  const rsa = crypto.generateKeyPairSync("rsa", { modulusLength: 2048 });
-  const rsaJws = makeJws("RS256", { sub: "a" }, (d) => crypto.sign("sha256", d, rsa.privateKey));
-  assert.strictEqual(verifyJws(rsaJws, { trusted_public_key: rsa.publicKey.export({ type: "spki", format: "pem" }) }).signature_valid, true, "RS256 valid");
-
-  // 5. none / crit / malformed / private-key refusal.
-  assert.strictEqual(verifyJws(makeJws("none", { x: 1 }, () => Buffer.alloc(0)), { trusted_public_key: edPubPem }).reason, "jws_alg_none_rejected");
-  const critJws = makeJws("EdDSA", { sub: "a" }, (d) => crypto.sign(null, d, ed.privateKey), { crit: ["exp"] });
-  assert.strictEqual(verifyJws(critJws, { trusted_public_key: edPubPem }).reason, "jws_crit_unsupported");
-  assert.strictEqual(verifyJws("only.two").reason, "jws_malformed");
-  assert.strictEqual(verifyJws(edJws, { trusted_public_key: ed.privateKey.export({ type: "pkcs8", format: "pem" }) }).reason, "no_public_key", "PEM private key refused as trust key");
-  assert.strictEqual(verifyJws(edJws, { trusted_public_key: ed.privateKey.export({ format: "jwk" }) }).reason, "no_public_key", "private JWK refused");
-
-  // 6. Detached signature.
-  const material = "x402-receipt:0xabc";
-  const detSig = crypto.sign(null, Buffer.from(material), ed.privateKey).toString("base64");
-  r = verifyDetachedSignature({ material, signature: detSig, signature_encoding: "base64", public_key: edPubPem, algorithm: "EdDSA", expected_key_ref: edRef });
-  assert.strictEqual(r.signature_valid, true);
-  assert.strictEqual(r.trust_anchored, true, "detached with matching expected_key_ref -> anchored");
-  assert.strictEqual(verifyDetachedSignature({ material: "tampered", signature: detSig, signature_encoding: "base64", public_key: edPubPem, algorithm: "EdDSA" }).signature_valid, false);
-
-  // 7. proof_sdk integration.
-  const proofSdk = require("../proof_sdk");
-  // no verification input -> structural, NO external_signature_* fields (byte-for-byte).
-  const run0 = proofSdk.runExternalProofImport({ method: "jwt-assertion-v1", token: edJws, issuer_ref: "iss" });
-  assert.strictEqual(run0.external_signature_valid, undefined, "no verification -> no top-level field");
-  assert.strictEqual(run0.proof_bundle.attestations[0].external_signature_valid, undefined, "no verification -> no attestation field");
-  assert.ok(String(run0.proof_bundle.attestations[0].verification_boundary).includes("external_truth_out_of_scope"));
-  const run0Keys = Object.keys(run0.proof_bundle.attestations[0]).length;
-
-  // A stray TOP-LEVEL signature/key field must NOT activate verification (namespace only).
-  const run0b = proofSdk.runExternalProofImport({ method: "jwt-assertion-v1", token: edJws, issuer_ref: "iss", signature: "ZZZZ", public_key: edPubPem });
-  assert.strictEqual(run0b.external_signature_valid, undefined, "top-level fields do not activate verification");
-  assert.strictEqual(Object.keys(run0b.proof_bundle.attestations[0]).length, run0Keys, "attestation shape unchanged by stray top-level fields");
-
-  // trusted key but no expected_key_ref -> signature_valid, NOT anchored; result echo is whitelisted.
-  const run1 = proofSdk.runExternalProofImport({ method: "jwt-assertion-v1", token: edJws, issuer_ref: "iss", signature_verification: { trusted_public_key: edPubPem } });
-  assert.strictEqual(run1.external_signature_valid, true, "imported JWS signature verified");
-  assert.strictEqual(run1.external_signature_trust_anchored, false);
-  assert.ok(String(run1.proof_bundle.attestations[0].verification_boundary).includes("consumer_decision"));
-  assert.strictEqual(run1.signature_verification.header, undefined, "result echo does not leak JWS header");
-  assert.strictEqual(run1.signature_verification.payload_b64url, undefined, "result echo does not leak payload");
-
-  // declared expected_key_ref matching the signer -> trust-anchored.
-  const run2 = proofSdk.runExternalProofImport({ method: "jwt-assertion-v1", token: edJws, issuer_ref: "iss", signature_verification: { trusted_public_key: edPubPem, expected_key_ref: edRef } });
-  assert.strictEqual(run2.external_signature_trust_anchored, true, "declared+matching key -> anchored");
-  assert.ok(String(run2.proof_bundle.attestations[0].verification_boundary).includes("cryptographically_verified_against_declared_key_ref"));
-
-  // Requested-but-INVALID signature hard-fails the import (ok:false).
-  const run3 = proofSdk.runExternalProofImport({ method: "jwt-assertion-v1", token: edJws, issuer_ref: "iss", signature_verification: { trusted_public_key: ed2.publicKey.export({ type: "spki", format: "pem" }) } });
-  assert.strictEqual(run3.ok, false, "invalid requested signature hard-fails");
-  assert.strictEqual(run3.reason, "external_signature_invalid");
-  // ...unless the caller opts out.
-  const run3b = proofSdk.runExternalProofImport({ method: "jwt-assertion-v1", token: edJws, issuer_ref: "iss", signature_verification: { trusted_public_key: ed2.publicKey.export({ type: "spki", format: "pem" }), require_valid_signature: false } });
-  assert.strictEqual(run3b.ok, true, "opt-out records the import despite invalid signature");
-  assert.strictEqual(run3b.external_signature_valid, false);
-
-  // Object material + detached signature request -> unsupported (does not mislead), hard-fails by default.
-  const run4 = proofSdk.runExternalProofImport({ method: "signed-envelope-v1", proof_envelope: { claim: "x" }, issuer_ref: "iss", signature_verification: { trusted_public_key: edPubPem, signature: "AA", algorithm: "EdDSA" } });
-  assert.strictEqual(run4.ok, false);
-  assert.strictEqual(run4.reason, "unsupported_import_signature_verification");
-
-  // standalone function
-  assert.strictEqual(proofSdk.verifyExternalProofSignature({ jws: edJws, trusted_public_key: edPubPem }).signature_valid, true);
-  assert.strictEqual(proofSdk.verifyExternalProofSignature({}).reason, "no_signature_verification_input");
-
-  // Detached ML-DSA-65 (FIPS-204): valid verifies + anchors to the declared key ref; tampered
-  // material fails; the declared alg is bound to the key type (no cross-alg confusion).
-  const mldsa = crypto.generateKeyPairSync("ml-dsa-65");
-  const mlSpki = mldsa.publicKey.export({ type: "spki", format: "der" }).toString("base64");
-  const mlRef = "ml-dsa-65-spki-sha256:" + crypto.createHash("sha256").update(mldsa.publicKey.export({ type: "spki", format: "der" })).digest("hex");
-  const mlMaterial = '{"receipt":"x","v":1}';
-  const mlSig = crypto.sign(null, Buffer.from(mlMaterial, "utf8"), mldsa.privateKey).toString("base64");
-  const mlOk = proofSdk.verifyExternalProofSignature({ material: mlMaterial, signature: mlSig, algorithm: "ML-DSA-65", public_key: mlSpki, expected_key_ref: mlRef });
-  assert.strictEqual(mlOk.signature_valid, true, "ML-DSA-65 detached signature verifies");
-  assert.strictEqual(mlOk.trust_anchored, true, "ML-DSA-65 anchors to the declared key ref");
-  assert.strictEqual(proofSdk.verifyExternalProofSignature({ material: mlMaterial + " ", signature: mlSig, algorithm: "ML-DSA-65", public_key: mlSpki }).signature_valid, false, "ML-DSA-65 tampered material fails");
-  assert.strictEqual(proofSdk.verifyExternalProofSignature({ material: mlMaterial, signature: mlSig, algorithm: "ML-DSA-44", public_key: mlSpki }).signature_valid, false, "ML-DSA alg bound to the key's parameter set");
-  assert.strictEqual(proofSdk.verifyExternalProofSignature({ material: mlMaterial, signature: mlSig, algorithm: "EdDSA", public_key: mlSpki }).signature_valid, false, "EdDSA cannot verify with an ML-DSA key");
-
-  console.log("verify_external_proof_signature: all checks passed");
-}
-
-main();

package/scripts/verify_forgery_resistance.js

@@ -1,281 +0,0 @@
-"use strict";
-
-// Forgery-resistance checks for the xoonya proof engine.
-//
-// This script talks to proof_sdk.js directly (no HTTP server) and pins down:
-//   (a) key substitution: a proof signed by key B that claims key A's identity
-//       self-verifies WITHOUT a trust root (known limitation, documented here)
-//       and is rejected WITH a trust root pinned to key A;
-//   (b) external methods are structural-only and fail under strict mode;
-//   (c) the default digest method is digest-only and fails under strict mode;
-//   (d) hybrid ed25519+ml-dsa-65: tampered PQ signature is rejected, and a
-//       wrong pinned PQ ref yields native_hybrid_public_key_not_trusted;
-//   (e) results are deterministic across repeated runs for the same inputs.
-
-const assert = require("assert");
-const crypto = require("crypto");
-const sdk = require("../proof_sdk.js");
-
-function canonicalize(value) {
-  if (Array.isArray(value)) {
-    return `[${value.map((item) => canonicalize(item)).join(",")}]`;
-  }
-  if (value && typeof value === "object") {
-    const keys = Object.keys(value).sort();
-    return `{${keys.map((key) => `${JSON.stringify(key)}:${canonicalize(value[key])}`).join(",")}}`;
-  }
-  return JSON.stringify(value);
-}
-
-function pem(key, type) {
-  return key.export({ type, format: "pem" });
-}
-
-function tamperBase64url(value) {
-  const last = value.slice(-1);
-  return `${value.slice(0, -1)}${last === "A" ? "B" : "A"}`;
-}
-
-const event = {
-  version: "canonical-event-bundle/v1",
-  domain_id: "forgery.resistance",
-  sequence: "1",
-  actor_id: "alice",
-  adapter_source: "verify_forgery_resistance",
-  event_type: "proof.forgery.probe",
-  event_hash: "cd".repeat(32)
-};
-const ALICE_IDENTITY_REF = "did:xoonya:alice";
-
-function signedReceiptFor(keyPair) {
-  return sdk.emitReceipt(event, {
-    agent_identity: "alice",
-    algorithm: "xoonya-native-signed-v1",
-    identity_ref: ALICE_IDENTITY_REF,
-    signature_suite: "ed25519",
-    private_key_pem: pem(keyPair.privateKey, "pkcs8"),
-    public_key_pem: pem(keyPair.publicKey, "spki")
-  });
-}
-
-function bundleFor(receipt) {
-  return sdk.buildProofBundle({ ceb: event, receipt });
-}
-
-function checkKeySubstitution() {
-  const keyA = crypto.generateKeyPairSync("ed25519");
-  const keyB = crypto.generateKeyPairSync("ed25519");
-  const receiptA = signedReceiptFor(keyA);
-  const receiptB = signedReceiptFor(keyB);
-  const refA = receiptA.native_proof.public_key_ref;
-  const refB = receiptB.native_proof.public_key_ref;
-  assert.notStrictEqual(refA, refB, "distinct keys must produce distinct public_key_ref values");
-  assert.strictEqual(receiptB.native_proof.identity_ref, ALICE_IDENTITY_REF, "key B proof claims alice's identity_ref");
-
-  // Known limitation: without a verifier-supplied trust root, public_key_ref is only
-  // self-bound to the carried key material, so key B can claim alice's identity.
-  const substitutionWithoutRoot = sdk.verifyProofBundle(bundleFor(receiptB));
-  assert.strictEqual(substitutionWithoutRoot.valid, true, "key substitution self-verifies without a trust root (documented limitation)");
-  assert.strictEqual(substitutionWithoutRoot.verification_class, "cryptographic", "native signed class must be cryptographic");
-  assert.strictEqual(substitutionWithoutRoot.cryptographically_verified, true, "native signed proof must report cryptographic verification");
-  assert.strictEqual(substitutionWithoutRoot.trust_root_applied, false, "trust_root_applied must be false without a trust root");
-  assert.strictEqual(substitutionWithoutRoot.public_key_ref, refB, "verify result must surface the signing key ref so callers can pin it");
-
-  const trustRoot = { trusted_public_key_refs: { [ALICE_IDENTITY_REF]: refA } };
-  const substitutionWithRoot = sdk.verifyProofBundle(bundleFor(receiptB), trustRoot);
-  assert.strictEqual(substitutionWithRoot.valid, false, "key substitution must be rejected with a pinned trust root");
-  assert.strictEqual(substitutionWithRoot.reason, "native_public_key_not_trusted", "key substitution rejection reason mismatch");
-  assert.strictEqual(substitutionWithRoot.trust_root_applied, true, "trust_root_applied must be true with a trust root");
-  assert.strictEqual(substitutionWithRoot.cryptographically_verified, false, "rejected result must not claim cryptographic verification");
-
-  const genuineWithRoot = sdk.verifyProofBundle(bundleFor(receiptA), trustRoot);
-  assert.strictEqual(genuineWithRoot.valid, true, "genuine key A proof must verify with trust root pinned to key A");
-  assert.strictEqual(genuineWithRoot.trust_root_applied, true, "genuine trust_root_applied mismatch");
-
-  const genuineArrayRoot = sdk.verifyProofBundle(bundleFor(receiptA), { trusted_public_key_refs: { [ALICE_IDENTITY_REF]: [refB, refA] } });
-  assert.strictEqual(genuineArrayRoot.valid, true, "array-valued trust root must accept any listed ref");
-
-  const expectedRefRoot = sdk.verifyProofBundle(bundleFor(receiptB), { expected_public_key_ref: refA });
-  assert.strictEqual(expectedRefRoot.reason, "native_public_key_not_trusted", "expected_public_key_ref must reject key B");
-  assert.strictEqual(sdk.verifyProofBundle(bundleFor(receiptA), { expected_public_key_ref: refA }).valid, true, "expected_public_key_ref must accept key A");
-
-  const unknownIdentityRoot = sdk.verifyProofBundle(bundleFor(receiptA), { trusted_public_key_refs: { "did:xoonya:bob": refA } });
-  assert.strictEqual(unknownIdentityRoot.reason, "native_public_key_not_trusted", "identity absent from trust root must fail closed");
-
-  const hybridOnlyRoot = sdk.verifyProofBundle(bundleFor(receiptA), { expected_pq_public_key_ref: "ml-dsa-65-spki-sha256:" + "00".repeat(32) });
-  assert.strictEqual(hybridOnlyRoot.reason, "native_public_key_not_trusted", "a PQ-only pin against a classical-only proof must fail closed");
-
-  const strictGenuine = sdk.verifyProofBundle(bundleFor(receiptA), { ...trustRoot, strict: true });
-  assert.strictEqual(strictGenuine.valid, true, "cryptographic class must pass strict mode");
-  return { refA, refB };
-}
-
-function checkExternalStructural() {
-  const methods = ["jwt-assertion-v1", "did-vc-v1", "sd-jwt-vc-v1", "signed-envelope-v1", "partner-proof-envelope-v1", "detached-assertion-v1"];
-  for (const methodId of methods) {
-    const receipt = sdk.emitReceipt(event, {
-      agent_identity: "alice",
-      algorithm: methodId,
-      signature: `garbage-signature-${crypto.randomBytes(8).toString("hex")}`
-    });
-    const relaxed = sdk.verifyProofBundle(bundleFor(receipt));
-    assert.strictEqual(relaxed.valid, true, `${methodId} garbage signature is accepted structurally by default`);
-    assert.strictEqual(relaxed.verification_class, "structural", `${methodId} class must be structural`);
-    assert.strictEqual(relaxed.cryptographically_verified, false, `${methodId} must not claim cryptographic verification`);
-    const strict = sdk.verifyProofBundle(bundleFor(receipt), { strict: true });
-    assert.strictEqual(strict.valid, false, `${methodId} must fail under strict verification`);
-    assert.strictEqual(strict.reason, "external_verification_required", `${methodId} strict rejection reason mismatch`);
-    assert.strictEqual(strict.verification_class, "structural", `${methodId} strict class mismatch`);
-  }
-}
-
-function checkDigestDefault() {
-  const receipt = sdk.emitReceipt(event, { agent_identity: "alice" });
-  assert.strictEqual(receipt.algorithm, "xoonya-native-sha256-v1", "default receipt method mismatch");
-  const relaxed = sdk.verifyProofBundle(bundleFor(receipt));
-  assert.strictEqual(relaxed.valid, true, "digest bundle verifies by default");
-  assert.strictEqual(relaxed.verification_class, "digest", "digest class mismatch");
-  assert.strictEqual(relaxed.cryptographically_verified, false, "digest must not claim cryptographic verification");
-
-  // Anyone can forge a digest receipt for any identity: there is no key involved.
-  const forged = sdk.emitReceipt(event, { agent_identity: "alice" });
-  assert.strictEqual(forged.signature, receipt.signature, "digest receipts are reproducible by anyone who knows the event");
-
-  const strict = sdk.verifyProofBundle(bundleFor(receipt), { strict: true });
-  assert.strictEqual(strict.valid, false, "digest bundle must fail under strict verification");
-  assert.strictEqual(strict.reason, "digest_only_not_cryptographically_verified", "strict digest reason mismatch");
-
-  const previous = process.env.XOONYA_STRICT_VERIFY;
-  process.env.XOONYA_STRICT_VERIFY = "1";
-  try {
-    const envStrict = sdk.verifyProofBundle(bundleFor(receipt));
-    assert.strictEqual(envStrict.valid, false, "XOONYA_STRICT_VERIFY=1 must enable strict mode globally");
-    assert.strictEqual(envStrict.strict, true, "env strict flag must echo in the result");
-  } finally {
-    if (previous === undefined) delete process.env.XOONYA_STRICT_VERIFY;
-    else process.env.XOONYA_STRICT_VERIFY = previous;
-  }
-}
-
-function checkHybrid() {
-  const classical = crypto.generateKeyPairSync("ed25519");
-  const pq = crypto.generateKeyPairSync("ml-dsa-65");
-  const receipt = sdk.emitReceipt(event, {
-    agent_identity: "alice",
-    algorithm: "xoonya-native-hybrid-v1",
-    identity_ref: ALICE_IDENTITY_REF,
-    classical_signature_suite: "ed25519",
-    pq_signature_suite: "ml-dsa-65",
-    classical_public_key_pem: pem(classical.publicKey, "spki"),
-    classical_private_key_pem: pem(classical.privateKey, "pkcs8"),
-    pq_public_key_pem: pem(pq.publicKey, "spki"),
-    pq_private_key_pem: pem(pq.privateKey, "pkcs8")
-  });
-  const bundle = bundleFor(receipt);
-  const genuine = sdk.verifyProofBundle(bundle);
-  assert.strictEqual(genuine.valid, true, "hybrid bundle must verify");
-  assert.strictEqual(genuine.verification_class, "cryptographic", "hybrid class must be cryptographic");
-  assert.strictEqual(genuine.cryptographically_verified, true, "hybrid must report cryptographic verification");
-  assert.strictEqual(genuine.classical_public_key_ref, receipt.native_proof.classical_public_key_ref, "hybrid classical ref surfaced");
-  assert.strictEqual(genuine.pq_public_key_ref, receipt.native_proof.pq_public_key_ref, "hybrid pq ref surfaced");
-
-  const tamperedPqSignature = tamperBase64url(receipt.native_proof.proof_material.pq_signature);
-  const tamperedReceipt = {
-    ...receipt,
-    native_proof: {
-      ...receipt.native_proof,
-      proof_material: { ...receipt.native_proof.proof_material, pq_signature: tamperedPqSignature }
-    },
-    signature: `xoonya-native-hybrid-v1:${receipt.native_proof.hybrid_suite}:${receipt.native_proof.proof_material.classical_signature}.${tamperedPqSignature}`
-  };
-  const tampered = sdk.verifyProofBundle(bundleFor(tamperedReceipt));
-  assert.strictEqual(tampered.valid, false, "tampered PQ signature must be rejected");
-  assert.strictEqual(tampered.reason, "native_hybrid_pq_signature_invalid", "tampered PQ signature reason mismatch");
-  assert.strictEqual(tampered.cryptographically_verified, false, "tampered hybrid must not claim cryptographic verification");
-
-  const wrongPqRef = `ml-dsa-65-spki-sha256:${"11".repeat(32)}`;
-  const wrongPqPinned = sdk.verifyProofBundle(bundle, {
-    trusted_public_key_refs: { [ALICE_IDENTITY_REF]: { classical: genuine.classical_public_key_ref, pq: wrongPqRef } }
-  });
-  assert.strictEqual(wrongPqPinned.valid, false, "wrong pinned PQ ref must be rejected");
-  assert.strictEqual(wrongPqPinned.reason, "native_hybrid_public_key_not_trusted", "wrong PQ pin reason mismatch");
-  assert.strictEqual(wrongPqPinned.trust_root_applied, true, "hybrid trust_root_applied mismatch");
-
-  const wrongExpectedPq = sdk.verifyProofBundle(bundle, { expected_pq_public_key_ref: wrongPqRef });
-  assert.strictEqual(wrongExpectedPq.reason, "native_hybrid_public_key_not_trusted", "expected_pq_public_key_ref mismatch must be rejected");
-
-  const rightPinned = sdk.verifyProofBundle(bundle, {
-    trusted_public_key_refs: { [ALICE_IDENTITY_REF]: { classical: genuine.classical_public_key_ref, pq: genuine.pq_public_key_ref } },
-    strict: true
-  });
-  assert.strictEqual(rightPinned.valid, true, "correctly pinned hybrid must verify under strict mode");
-
-  const classicalOnlyPin = sdk.verifyProofBundle(bundle, { trusted_public_key_refs: { [ALICE_IDENTITY_REF]: genuine.classical_public_key_ref } });
-  assert.strictEqual(classicalOnlyPin.valid, true, "string-valued trust root pins the classical lane of a hybrid proof");
-
-  const otherClassical = crypto.generateKeyPairSync("ed25519");
-  const otherClassicalRef = sdk.emitReceipt(event, {
-    agent_identity: "alice",
-    algorithm: "xoonya-native-signed-v1",
-    identity_ref: ALICE_IDENTITY_REF,
-    signature_suite: "ed25519",
-    private_key_pem: pem(otherClassical.privateKey, "pkcs8"),
-    public_key_pem: pem(otherClassical.publicKey, "spki")
-  }).native_proof.public_key_ref;
-  const wrongClassicalPin = sdk.verifyProofBundle(bundle, { trusted_public_key_refs: { [ALICE_IDENTITY_REF]: otherClassicalRef } });
-  assert.strictEqual(wrongClassicalPin.reason, "native_hybrid_public_key_not_trusted", "wrong classical pin on hybrid must be rejected");
-  return bundle;
-}
-
-function checkDeterminism(hybridBundle, refs) {
-  const keyA = crypto.generateKeyPairSync("ed25519");
-  const signedBundle = bundleFor(signedReceiptFor(keyA));
-  const digestBundle = bundleFor(sdk.emitReceipt(event, { agent_identity: "alice" }));
-  const externalBundle = bundleFor(sdk.emitReceipt(event, { agent_identity: "alice", algorithm: "jwt-assertion-v1", signature: "garbage" }));
-  const cases = [
-    [signedBundle, {}],
-    [signedBundle, { strict: true }],
-    [signedBundle, { trusted_public_key_refs: { [ALICE_IDENTITY_REF]: refs.refA } }],
-    [digestBundle, {}],
-    [digestBundle, { strict: true }],
-    [externalBundle, { strict: true }],
-    [hybridBundle, {}],
-    [hybridBundle, { expected_pq_public_key_ref: "nope" }]
-  ];
-  for (const [bundle, options] of cases) {
-    const first = canonicalize(sdk.verifyProofBundle(bundle, options));
-    const second = canonicalize(sdk.verifyProofBundle(bundle, options));
-    assert.strictEqual(first, second, `verification result must be deterministic for options ${JSON.stringify(options)}`);
-  }
-}
-
-function main() {
-  const classes = sdk.listProofVerificationClasses().map((entry) => entry.id).sort();
-  assert.deepStrictEqual(classes, ["anchored_binding", "cryptographic", "digest", "structural"], "verification class registry mismatch");
-  assert.deepStrictEqual(
-    sdk.PROOF_VERIFICATION_STRICT_REJECTION_CODES.slice(),
-    ["digest_only_not_cryptographically_verified", "external_verification_required"],
-    "strict rejection code registry mismatch"
-  );
-  assert.deepStrictEqual(
-    sdk.PROOF_VERIFICATION_TRUST_ROOT_REJECTION_CODES.slice(),
-    ["native_public_key_not_trusted", "native_hybrid_public_key_not_trusted"],
-    "trust root rejection code registry mismatch"
-  );
-
-  const refs = checkKeySubstitution();
-  checkExternalStructural();
-  checkDigestDefault();
-  const hybridBundle = checkHybrid();
-  checkDeterminism(hybridBundle, refs);
-
-  console.log("xoonya verify:forgery-resistance passed");
-  console.log("key substitution without trust root: accepted (documented limitation; pin with trusted_public_key_refs)");
-  console.log("key substitution with trust root: native_public_key_not_trusted");
-  console.log("external methods under strict: external_verification_required");
-  console.log("digest method under strict: digest_only_not_cryptographically_verified");
-  console.log("hybrid tampered pq signature: native_hybrid_pq_signature_invalid");
-  console.log("hybrid wrong pq pin: native_hybrid_public_key_not_trusted");
-}
-
-main();