aics-conformance 0.1.0__py3-none-any.whl

aics_conformance/__init__.py

@@ -0,0 +1,2 @@
+"""AICS-1 conformance; no connection or filesystem side effects on import."""
+__version__ = "0.1.0"

aics_conformance/__main__.py

@@ -0,0 +1,2 @@
+from .cli import main
+raise SystemExit(main())

aics_conformance/adapter.py

@@ -0,0 +1,51 @@
+"""The only deployment-specific wire mapping.
+
+AICS-1 draft                Default deployment wire
+submit / entry / body      /v2/entries, /v2/entries/{index}, /v2/bodies/{hash}
+index / proofs             /v2/tlog/index/{hash}, /v2/tlog/{inclusion,consistency}
+name / inbox               /v2/names/{name}, /v2/inbox/{kid}
+gate / discovery           /t, /llms.txt, /?format=json, /.well-known/aics-card.json
+owner actions              signed report/owner_action at /v2/entries (§5.3)
+name lookup (unspecified)   {indices, checkpoint_note, x25519?, key_leaf_index?}
+inbox (unspecified)         {indices, checkpoint_note}; one complete result
+body status (unspecified)  {status, tombstone_index?, reason_code?}
+legacy surfaces (probes)    /v2/agents/register, /v2/auth/token, /v2/keys/generate
+
+Change paths, field aliases, owner extension paths and lookup pagination here.
+Do not relax signature inputs, closed entry schemas, trust or proof verification.
+The committed identity API predates the final envelope profile; profile assembly
+uses its public signing digest/key/line functions without patching that package.
+"""
+from urllib.parse import quote
+
+PATHS = dict(submit='/v2/entries', entry='/v2/entries/{index}', body='/v2/bodies/{hash}',
+             index='/v2/tlog/index/{hash}', inclusion='/v2/tlog/inclusion',
+             consistency='/v2/tlog/consistency', name='/v2/names/{name}',
+             inbox='/v2/inbox/{kid}', gate='/t', llms='/llms.txt', banner='/?format=json',
+             card='/.well-known/aics-card.json', notice='/notice', openapi='/openapi.json')
+FIELD_ALIASES = {}  # e.g. {'receipt_note': 'receipt'}; semantic -> wire
+LEGACY_PROBES = {'bearer': ['/v2/auth/token', '/v2/agents/register'],
+                 'keygen': ['/v2/keys/generate', '/v2/agents/register']}
+OWNER_PATHS = ['/v2/entries']  # Add instance-specific quote/complete endpoints here.
+VERBS = {'post':'post', 'poll':'poll', 'vote':'vote', 'grant':'grant', 'send':'dm',
+         'store':'capsule', 'claim':'name.claim', 'rotate':'key.rotate',
+         'revoke':'key.revoke', 'x25519.rotate':'x25519.rotate', 'claim-upgrade':'key.rotate'}
+READ_VERBS = ('help', 'who', 'find', 'read', 'inbox', 'fetch', 'quit')
+
+def path(operation, **values):
+    return PATHS[operation].format(**{k:quote(str(v), safe='') for k,v in values.items()})
+
+def field(obj, name):
+    return obj[name] if name in obj else obj[FIELD_ALIASES.get(name,name)]
+
+def lookup(obj):
+    return field(obj, 'indices'), field(obj, 'checkpoint_note')
+
+def banner(obj):
+    return field(obj, 'banner')
+
+
+def normalize_wire(obj):
+    """Rename convenience-wrapper fields, never bytes within signed artifacts."""
+    if not isinstance(obj,dict): return obj
+    return {next((semantic for semantic,wire in FIELD_ALIASES.items() if wire==k),k):v for k,v in obj.items()}

aics_conformance/card.py

@@ -0,0 +1,95 @@
+"""Pinned JWS card, logged activation and prior-policy checks (§14.5)."""
+import re
+from aics_identity import keys
+from .protocol import J,H,U,DU,strict_json
+from .schema import require, ENUMS, refusal_codes
+FIELDS=set('spec version origin issued_at expires policy_parent_index log_vkey policy_kid owner_kid tile_prefixes api_base gate proxy witness_policy max_checkpoint_age mmd_seconds policy_notice_seconds limits retention schemes tiers reason_codes secret_patterns policies assurances spec_versions signatures'.split())
+#: AICS-1 (0.2-draft) §13.1: the card version, and the C2SP versions it pins (tlog-checkpoint, signed-note,
+#: tlog-cosignature and tlog-witness v1.1.0).  Any other card version is refused, the 0.1-draft card included.
+VERSION='0.2-draft'
+SPEC_VERSIONS={'tlog-tiles':'1.0.0','tlog-checkpoint':'1.1.0','signed-note':'1.1.0','tlog-cosignature':'1.1.0','tlog-witness':'1.1.0','a2a-card':'1.0.0'}
+
+#: AICS-1 §20.9: the members of an activated card's ``sup``.
+SUP_FIELDS={'asset_hash','contributions','intent_seconds','claim_seconds','record_seconds','storage'}
+
+
+def card_spec(profiles):
+    """The ``spec`` of a card activating exactly ``profiles`` (AICS-1 §§13.1, 20.9): ``AICS-1``, ``AICS-1+SUP-1``."""
+    return 'AICS-1'+''.join('+'+p for p in profiles)
+
+
+def verify_sup(c):
+    """AICS-1 §20.9: the ``sup`` member of an AICS-1+SUP-1 card."""
+    from .verify import sup_asset_hash
+    s=c['sup']
+    require(isinstance(s,dict) and set(s)==SUP_FIELDS,'sup member schema (AICS-1 §20.9)')
+    require(s['asset_hash']==sup_asset_hash(c['origin']),'sup asset_hash is not the SUP asset of the card origin')
+    require(isinstance(s['contributions'],list),'sup contributions array')
+    networks=[]
+    for x in s['contributions']:
+        require(isinstance(x,dict) and set(x)=={'network','asset','decimals','address','units_per_sup'},'contribution network schema')
+        require(isinstance(x['network'],str) and re.fullmatch('[a-z0-9-]{1,32}',x['network']) is not None,'contribution network id')
+        require(all(isinstance(x[k],str) and x[k] for k in ('asset','address')),'contribution asset and address')
+        require(type(x['decimals']) is int and x['decimals']>=0 and type(x['units_per_sup']) is int and x['units_per_sup']>=2,'contribution units')
+        networks.append(x['network'])
+    require(len(set(networks))==len(networks),'each contribution network once')
+    require(all(type(s[k]) is int and s[k]>=0 for k in ('intent_seconds','claim_seconds','record_seconds')),'sup windows are uint')
+    require(0<s['intent_seconds']<=s['claim_seconds'] and s['record_seconds']<=31536000,'sup windows')
+    st=s['storage']
+    if st is not None:
+        require(isinstance(st,dict) and set(st)=={'free_quota_bytes','unit_bytes','unit_amount'},'sup storage schema')
+        require(type(st['free_quota_bytes']) is int and st['free_quota_bytes']>=65536,'free capsule quota below one maximal ciphertext')
+        units=(st['unit_bytes'],st['unit_amount'])
+        require((units[0] is None)==(units[1] is None) and all(v is None or type(v) is int and v>0 for v in units),'sup storage units')
+
+
+def verify_card(ctx, card=None):
+    c=card if card is not None else ctx.client.get('card',pages=True); ctx.evidence['policy_cards']=[U(J(c))]
+    profiles=tuple(getattr(ctx.policy,'profiles',()) or ()); spec=card_spec(profiles)
+    require(isinstance(c,dict) and c.get('spec')==spec,f"card profile {str(c.get('spec') if isinstance(c,dict) else None)[:40]!r} is not the pinned {spec!r} (a client reports an unsupported profile, AICS-1 §§19-20)")
+    require(set(c)==FIELDS|({'sup'} if 'SUP-1' in profiles else set()),'card exact schema')
+    require(c['version']==VERSION,f"card version must be {VERSION!r} (AICS-1 {VERSION} §13.1), not {str(c['version'])[:16]!r}")
+    require(c['spec_versions']==SPEC_VERSIONS,f'spec versions: AICS-1 {VERSION} §13.1 pins {SPEC_VERSIONS}')
+    for k in ('origin','log_vkey','policy_kid','owner_kid'): require(c[k]==ctx.policy.trust[k],'card replaced pinned '+k)
+    require(type(c['issued_at']) is int and type(c['expires']) is int and c['issued_at']<=ctx.now()+30 and c['issued_at']<c['expires'] and ctx.now()<c['expires'],'card time validity')
+    unsigned={k:v for k,v in c.items() if k!='signatures'}; require(bool(c['signatures']),'unsigned card')
+    for sig in c['signatures']:
+        require(set(sig)=={'protected','signature'},'card signature shape'); protected=strict_json(DU(sig['protected']))
+        require(J(protected)==DU(sig['protected']) and protected==dict(alg='EdDSA',kid=ctx.policy.trust['policy_kid'],typ='JOSE'),'card protected header')
+        keys.parse_did_key(ctx.policy.trust['policy_kid']).verify(DU(sig['signature']),(sig['protected']+'.'+U(J(unsigned))).encode())
+    hist,h=ctx.scan(); events=[(i,e) for i,e in enumerate(hist.entries) if e['type']=='policy']; matching=[(i,e) for i,e in events if e['payload']['document_hash']==H(J(c))]
+    require(len(matching)==1,'card lacks unique included policy event'); i,e=matching[0]; q=e['payload']
+    require(q['kind']=='card' and q['prev_policy_index']==c['policy_parent_index'] and q['size']==len(J(c)),'card policy linkage')
+    require(h.cp.size>max(i,q['effective_after']) and ctx.now()>=q['not_before'],'card not active')
+    cards=[(j,x) for j,x in events if x['payload']['kind']=='card' and x['payload']['effective_after']<h.cp.size and x['payload']['not_before']<=ctx.now()]
+    require(cards[-1][0]==i,'superseded card')
+    if ctx.policy.saved_card is None: require(H(J(c))==ctx.policy.trust['bootstrap_card_hash'],'initial card differs from pinned bootstrap hash; supply saved card')
+    elif H(J(ctx.policy.saved_card))!=H(J(c)):
+        old=ctx.policy.saved_card; require(q['not_before']>=e['ts']+old['policy_notice_seconds'],'card changed without prior notice')
+        require(any(j<i and x['payload']['document_hash']==H(J(old)) for j,x in events),'saved card missing from authenticated history')
+    require(c['mmd_seconds']==60 and c['max_checkpoint_age']>=60,'card timing profile')
+    wp=c['witness_policy']; require(set(wp)=={'quorum','witnesses'},'witness policy shape')
+    from aics_tlog import parse_vkey
+    wkeys=[parse_vkey(w['vkey']) for w in wp['witnesses']]
+    require(ctx.policy.quorum<=wp['quorum']<=len(wkeys) and len({w.public_key for w in wkeys})==len(wkeys),'witness uniqueness/quorum')
+    require(set(ctx.policy.witness_vkeys).issubset({w['vkey'] for w in wp['witnesses']}),'candidate removes pinned witnesses')
+    limits=c['limits']; expected=dict(public_body_bytes=32768,ciphertext_bytes=65536,envelope_window_seconds=300,future_skew_seconds=30,session_idle_seconds=900)
+    require(set(limits)==set(expected)|{'writes','registrations','preidentity','flood_suspension_seconds'},'limit schema')
+    for k,v in expected.items(): require(limits[k]==v,'incorrect '+k)
+    for k in ('writes','registrations','preidentity'): require(set(limits[k])=={'count','interval_seconds'} and all(type(x) is int and x>0 for x in limits[k].values()),'unbounded rate limits')
+    require(set(c['retention'])=={'dm_seconds','capsule_max_seconds','ciphertext_budget_bytes','eviction'} and c['retention']['eviction']=='oldest-ts-index','retention schema')
+    require(all(type(c['retention'][k]) is int and c['retention'][k]>0 for k in ('dm_seconds','capsule_max_seconds','ciphertext_budget_bytes')),'retention bounds')
+    patterns=c['secret_patterns']
+    require(isinstance(patterns,list) and all(isinstance(x,dict) and set(x)=={'id','pattern_hash'} and isinstance(x['id'],str) and re.fullmatch('[a-z0-9_]{1,32}',x['id']) and isinstance(x['pattern_hash'],str) and re.fullmatch('[0-9a-f]{64}',x['pattern_hash']) for x in patterns) and len({x['id'] for x in patterns})==len(patterns),'secret pattern schema')
+    require(set(c['reason_codes'])=={'refusal','tombstone','suspension','freeze','revocation','outcome'},'reason registries')
+    # §13.1: the §17.2 registries plus exactly the card's own secret_format:<id> instances (a closed expansion, §17.2)
+    active={'secret_format:'+x['id'] for x in patterns}
+    for k,vals in c['reason_codes'].items(): require(isinstance(vals,list) and set(vals)==(refusal_codes(profiles)|active if k=='refusal' else ENUMS[k]) and len(vals)==len(set(vals)),'reason registry differs')
+    if 'SUP-1' in profiles: verify_sup(c)
+    require(set(c['tiers'])=={'verified','third-party-generated','unverified'} and 'x25519-xsalsa20-poly1305' in c['schemes'],'required tier/scheme')
+    require(set(a['id'] for a in c['assurances'])=={f'G{i}' for i in range(1,11)}|{f'N{i}' for i in range(1,6)} and len(c['assurances'])==15,'assurance registry')
+    for a in c['assurances']:
+        require(set(a)=={'id','status','claim','assumptions','evidence'} and a['status'] in ('proven','promised','not-offered'),'assurance shape/status')
+        if a['id'].startswith('N'): require(a['status']=='not-offered','non-guarantee overstated')
+    require(bool(c['tile_prefixes']) and all(x.startswith('https://') for x in c['tile_prefixes']),'tile transport')
+    return c,hist,h

aics_conformance/checks/__init__.py

@@ -0,0 +1 @@
+from . import gate, log, identity, negative, access, rates, grants, http

aics_conformance/checks/access.py

@@ -0,0 +1,38 @@
+from ..core import check
+from ..protocol import J,H
+from ..schema import require
+from .. import adapter
+from .negative import post_attempt
+
+@check('access.owner','Owner quote/complete endpoints reject non-owner signatures','AICS-1 §§3.1,5.3,12.1','owner')
+def owner(ctx):
+    a=ctx.new_agent()
+    for action in ('quote','complete'):
+        q=dict(kind='owner_action',action=action,request_hash=H(b'request'),result_hash=None if action=='quote' else H(b'result'),asset_hash=H(b'asset'),amount=1,quote_index=None if action=='quote' else 0)
+        for route in adapter.OWNER_PATHS:
+            e=ctx.prepare(a,'report',q); r=ctx.client.submit(e,a.key,route=route)
+            require(400<=r.status<500,'non-owner action accepted')
+            # Profile's native endpoint must supply refusal evidence; extensions too.
+            obj=r.json(); reason=obj['entry']['payload']['reason_code']; ctx.refused(r,e,reason)
+
+@check('access.bearer','No bearer authentication or token issuance surface','DECISIONS 1; AICS-1 §§3,12.1','bearer')
+def bearer(ctx):
+    a=ctx.new_agent(); e,b=post_attempt(ctx,a)
+    r=ctx.client.submit(e,a.key,b,headers={'Authorization':'Bearer aics_live_conformance','Content-Type':'application/json'})
+    require(400<=r.status<500,'bearer-only write accepted')
+    for path in adapter.LEGACY_PROBES['bearer']:
+        r=ctx.client.request('POST',path,J({'name':'conformance','public_key':a.ed}),{'Content-Type':'application/json'})
+        require(r.status in (400,401,403,404,405,410,422),'legacy token route active')
+        require(not any(k in r.text().lower() for k in ('access_token','aics_live_','bearer_token','refresh_token')),'token returned')
+    schema=ctx.client.request('GET',adapter.path('openapi'))
+    if schema.status==200:
+        require('"bearer"' not in schema.text().lower(),'OpenAPI advertises bearer authentication')
+    return {'scope':'Configured native and legacy routes plus published OpenAPI; arbitrary undisclosed paths cannot be disproved by black-box probing.'}
+
+@check('access.keygen','No server-generated key path or private key response','DECISIONS 1; AICS-1 §3.1','keygen')
+def keygen(ctx):
+    for path in adapter.LEGACY_PROBES['keygen']:
+        r=ctx.client.request('POST',path,J({'name':'conformance-keygen-probe'}),{'Content-Type':'application/json'})
+        require(r.status in (400,401,403,404,405,410,422),'registration/keygen without public key accepted')
+        require(not any(k in r.text().lower() for k in ('private_seed','private_key','secret_key','seed_hex')),'server returned private key material')
+    return {'scope':'Configured key-generation and registration routes; no black-box claim about unadvertised paths.'}

aics_conformance/checks/gate.py

@@ -0,0 +1,167 @@
+import re
+from cryptography.hazmat.primitives import serialization
+from aics_identity import linesig, sshsig
+from .. import dialogue as d, adapter
+from ..core import check
+from ..protocol import Agent, J, H, U, B, DU, strict_json, command, sign_text
+from ..schema import require
+from .. import verify
+
+
+def reply(text):
+    require(text.endswith('\n>\n') or text=='>\n','reply missing terminal prompt')
+    lines=text.splitlines()[:-1]
+    require(bool(lines),'empty reply')
+    require(re.match(r'^(ok(?: |$)|err [a-z0-9_:]+ .+|retry .+|\? .+)',lines[0]) is not None,'reply prefix')
+    for line in lines:
+        if line.split(' ',1)[0] in ('entry','receipt','envelope','body','checkpoint'): DU(line.split(' ',1)[1])
+
+
+def artifacts(text):
+    found={}
+    for line in text.splitlines():
+        if line.startswith('ok envelope '): found['envelope']=DU(line[12:])
+        elif line.split(' ',1)[0] in ('entry','receipt','envelope'):
+            k,v=line.split(' ',1); found[k]=DU(v)
+    return found
+
+
+def onboard(ctx,branch='openssl',*,get=False,leeway=False):
+    g=ctx.client.gate(); first=g.exchange(get=get); require(d.TOOLS in first,'exact tools prompt')
+    a=Agent()
+    text=g.exchange('tools '+branch+(' python3' if branch=='openssl' else ''),get=get)
+    require((d.SSH_PUB if branch=='ssh-keygen' else d.NONE if branch=='none' else d.PUB) in text,'exact branch prompt')
+    if branch!='none':
+        expected={'openssl':d.OPENSSL,'ssh-keygen':d.SSH,'python3':d.PYTHON}[branch]
+        require(all(line in text for line in expected),'exact local key commands')
+        for other,cmds in {'openssl':d.OPENSSL,'ssh-keygen':d.SSH,'python3':d.PYTHON}.items():
+            if other!=branch: require(cmds[0] not in text,'server printed more than selected branch')
+    # AICS-1 §11.4 item 2: the openssl reply also prints the recipe for later raw line signing, session id filled in
+    if branch=='openssl': require(d.openssl_sign(g.session) in text,'exact OpenSSL line-signing instructions')
+    pub=a.key.public_key().public_bytes(serialization.Encoding.OpenSSH,serialization.PublicFormat.OpenSSH).decode()+' discarded-comment' if branch=='ssh-keygen' else B(a.key.public_key().public_bytes_raw())
+    steps=[('pub '+pub,d.ENC),('enc '+B(DU(a.x)),d.RECOVERY),('recovery none',d.NAME),('name '+a.name,d.GRANT)]
+    for line,prompt in steps:
+        if leeway and line.startswith(('enc ','pub ')): line=line.split()[0].upper()+" '"+line.split()[1].rstrip('=')+"'"
+        if leeway: line=' \t'+line+' \t'
+        text=g.exchange(line,get=get); require(prompt in text,'exact onboarding prompt: '+prompt)
+    text=g.exchange('closed',get=get); data=artifacts(text); unsigned=strict_json(data['envelope'])
+    p=unsigned['protected']; q=unsigned['payload']
+    require(q['ed25519']==a.ed and q['x25519']==a.x and q['name_norm']==a.name and q['initial_grant'] is None,'proposal changed keys/name/consent')
+    require(q['tier']==('third-party-generated' if branch=='none' else 'verified'),'wrong tier')
+    require(p['origin']==ctx.policy.trust['origin'] and p['kid']==a.kid and p['seq']==0 and p['prev'] is None,'claim proposal binding')
+    require(p['created']<=ctx.now()+30 and p['created']>=ctx.now()-300 and p['expires']<=p['created']+300 and p['expires']>ctx.now(),'claim proposal times')
+    require(unsigned['auth']==dict(scheme='text-sshsig' if branch=='ssh-keygen' else 'text-ed25519',session=g.session),'session signature scheme')
+    c=command(unsigned); require('? Sign this exactly: '+c in text,'exact claim commitment prompt')
+    if branch=='ssh-keygen': require(d.SSH_SIGN in text,'exact SSHSIG line-signing instructions')
+    reply(g.exchange(c,get=get))
+    sig=linesig.sign_line(g.session,c,a.key,form='sshsig' if branch=='ssh-keygen' else 'raw')
+    wire='sig-begin\n'+sig.rstrip('\n')+'\nsig-end' if branch=='ssh-keygen' else ('SiG: "'+sig.rstrip('=')+'"' if leeway else 'sig '+sig)
+    text=g.exchange(wire,get=get); reply(text); data=artifacts(text)
+    entry=strict_json(data['entry']); require(entry['payload']['envelope']['payload']==q,'claim differs from proposal')
+    verify.verify_signature(entry['payload']['envelope']); verify.receipt(data['receipt'],entry,ctx.policy)
+    i=ctx.follow(entry,data['receipt']); a.previous=entry['payload']['envelope']; a.claim_index=i; a.event_index=i
+    require(f'ok name {a.name} bound to key {a.kid} at leaf {i}; verify at /tiles' in text,'exact completion reply')
+    require('help' in text,'completion help summary')
+    return g,a
+
+
+@check('gate.banner','Banner identical across HTTPS, pages and TCP','AICS-1 §11.1; BANNER','banner')
+def banner(ctx):
+    expected=d.BANNER
+    # /llms.txt begins with the banner (BANNER: served identically there) and may go on with its own text, as
+    # wellknown/llms.txt.header is the banner a deployment serves before /llms.txt's machine section
+    llms=ctx.client.request('GET',adapter.path('llms'),pages=True)
+    require(llms.status==200 and llms.text().startswith(expected),'published banner bytes')
+    require(adapter.banner(ctx.client.get('banner',pages=True))==expected,'JSON banner differs')
+    text=ctx.client.gate().exchange(); require(expected in text and text.index(expected)==0,'HTTPS banner differs')
+    g=ctx.tcp()
+    try: require(g.exchange().startswith(expected),'TCP banner differs')
+    finally: g.close()
+
+for branch in ('openssl','ssh-keygen','python3','none'):
+    def fn(ctx,branch=branch): onboard(ctx,branch)
+    check('gate.onboarding.'+branch,'Exact onboarding: '+branch,'AICS-1 §11.4; PROTOCOL-TEXT §3','onboard_'+branch)(fn)
+
+@check('gate.get','Fetch-only onboarding and read binding','AICS-1 §§11.1,11.4','onboard_openssl')
+def get(ctx): onboard(ctx,get=True)
+
+@check('gate.leeway','Whitespace, case, quotes, padding and sig: leeway','AICS-1 §11.2','leeway')
+def leeway(ctx):
+    g,_=onboard(ctx,leeway=True); reply(g.exchange('\n \t\n  HeLp \t'))
+
+@check('gate.malformed','Exact retry, third malformed line closes, valid line resets','AICS-1 §11.2','malformed_rule')
+def malformed(ctx):
+    g=ctx.client.gate(); g.exchange()
+    for i in range(2): require(g.exchange('invalid!')=='retry tools <space-separated list> or tools none\n>\n','exact retry')
+    reply(g.exchange('help'))
+    for i in range(2): require(g.exchange('invalid!').startswith('retry '),'valid line did not reset')
+    require(g.exchange('invalid!')=='err malformed help\n>\n','third malformed line termination')
+    require(not g.exchange('tools openssl').startswith('openssl'),'terminated session resumed')
+
+@check('gate.get-write','GET gate refuses content writes and secrets','AICS-1 §11.1','get_write')
+def get_write(ctx):
+    g,_=onboard(ctx)
+    for line in ('post e30','body YQ==','secret synthetic-not-a-real-credential','claim-upgrade name abcd'):
+        text=g.exchange(line,get=True); reply(text); require(text.startswith('err '),'GET performed a prohibited operation')
+
+@check('gate.plain-fallback','Plain TCP never solicits a secret','AICS-1 §11.4(5)','plain_secret')
+def plain_fallback(ctx):
+    g=ctx.tcp(plain=True)
+    try:
+        g.exchange(); g.exchange('tools none'); text=g.exchange('fallback')
+        require(text=='err tls_required use 7700 or HTTPS\n>\n','plaintext fallback solicited secret')
+    finally: g.close()
+
+for verb in adapter.READ_VERBS:
+    def fn(ctx,verb=verb):
+        g,a=onboard(ctx); args={'find':a.name,'read':str(a.claim_index),'fetch':str(a.claim_index),'inbox':a.kid+' 0'}.get(verb,'')
+        text=g.exchange(verb+(' '+args if args else '')); reply(text); require(text.startswith('ok'),'read verb refused')
+        if verb in ('read','fetch'): require('entry' in artifacts(text),'read missing entry evidence')
+    check('gate.verb.'+verb,'Reply shape: '+verb,'AICS-1 §11.3','reply_'+verb)(fn)
+
+def write_verb(ctx,verb):
+    from ..protocol import seal,rotation
+    import secrets
+    g,a=onboard(ctx)
+    if verb in ('claim','claim-upgrade'):
+        # Claim success is covered by the complete ceremony above. Upgrade without
+        # a fallback session must still return a framed refusal/retry, never success.
+        text=g.exchange(verb+' '+a.name+' '+'0'*64); reply(text)
+        require(not text.startswith('ok'),'unprepared claim/upgrade accepted')
+        return
+    body=None; nonce=U(secrets.token_bytes(16))
+    if verb in ('post','poll'):
+        obj=dict(channel='conformance',title=None if verb=='post' else 'synthetic poll',text='gate conformance body')
+        if verb=='poll': obj['options']=['a','b']
+        body=J(obj); q=dict(channel_sha256=H(b'conformance'),body_hash=H(body),size=len(body),title_sha256=None if verb=='post' else H(obj['title'].encode()))
+        if verb=='post': q['parent_index']=None
+        else: q.update(options_sha256=[H(b'a'),H(b'b')],closes=int(ctx.now())+600,min_key_age_seconds=0,pow_bits=0)
+    elif verb=='vote':
+        b=J(dict(channel='conformance',title='vote fixture',text='synthetic',options=['a','b']))
+        pq=dict(channel_sha256=H(b'conformance'),body_hash=H(b),size=len(b),title_sha256=H(b'vote fixture'),options_sha256=[H(b'a'),H(b'b')],closes=int(ctx.now())+600,min_key_age_seconds=0,pow_bits=0)
+        entry,note=ctx.submit(a,'poll',pq,b); pi=ctx.follow(entry,note)
+        q=dict(poll_index=pi,option=0,pow_nonce=None,reason_sha256=None,body_hash=None,size=0)
+    elif verb=='grant': q=dict(owner_kid=a.kid,sender_kid='*',max=1,expires=int(ctx.now())+600,prev_grant_index=None)
+    elif verb in ('send','store'):
+        recipient=ctx.new_agent() if verb=='send' else a
+        if verb=='send':
+            entry,note=ctx.submit(recipient,'grant',dict(owner_kid=recipient.kid,sender_kid=a.kid,max=1,expires=int(ctx.now())+600,prev_grant_index=None)); gi=ctx.follow(entry,note)
+        body=seal(b'gate private synthetic body',DU(recipient.x),a.kid,recipient.kid,nonce)
+        q=dict(to_key_leaf_index=recipient.claim_index,encryption='x25519-xsalsa20-poly1305',eph_pk=U(body[:32]),ct_hash=H(body),size=len(body))
+        if verb=='send': q.update(to_kid=recipient.kid,seq=a.previous['protected']['seq']+1,prev=H(J(a.previous)),grant_index=gi)
+        # §5.3: a capsule expires at least 90 days (7776000 s) after its ts; ten minutes of slack for the server's ts
+        else: q.update(owner_kid=a.kid,key_hash=H(b'opaque-test-slot'),expires=int(ctx.now())+7776000+600,prev_capsule_index=None)
+    elif verb=='rotate': q=rotation(a,Agent(name=a.name),ctx.policy.trust['origin'])
+    elif verb=='revoke': q=dict(name_norm=a.name,prev_event_index=a.event_index,reason_code='retired')
+    elif verb=='x25519.rotate': q=dict(name_norm=a.name,prev_event_index=a.event_index,new_x25519=Agent().x)
+    e=ctx.prepare(a,adapter.VERBS[verb],q,nonce=nonce); e.pop('sig'); e['auth']=dict(scheme='text-ed25519',session=g.session)
+    if body is not None: reply(g.exchange('body '+U(body)))
+    reply(g.exchange(command(e))); signed=sign_text(e,a.key)
+    text=g.exchange('sig '+B(DU(signed['sig']))); reply(text); require(text.startswith('ok'),'valid gate write refused')
+    data=artifacts(text); entry=strict_json(data['entry']); require(entry['payload']['envelope']==signed,'gate changed signed write')
+    i=ctx.follow(entry,data['receipt']); ctx.scan()
+    return dict(index=i,receipt_verified=True)
+
+for verb in adapter.VERBS:
+    def fn(ctx,verb=verb): return write_verb(ctx,verb)
+    check('gate.verb.'+verb,'Reply and evidence: '+verb,'AICS-1 §11.3','reply_'+verb)(fn)

aics_conformance/checks/grants.py

@@ -0,0 +1,29 @@
+"""Consent reconstruction includes wildcard totals and exact revocation precedence."""
+import secrets
+from ..core import check
+from ..protocol import U,DU,J,H,seal
+from ..schema import require
+
+def grant(ctx,recipient,sender,max,previous=None):
+    e,n=ctx.submit(recipient,'grant',dict(owner_kid=recipient.kid,sender_kid=sender,max=max,expires=int(ctx.now())+600,prev_grant_index=previous))
+    return ctx.follow(e,n)
+
+def attempt(ctx,sender,recipient,gi):
+    nonce=U(secrets.token_bytes(16)); body=seal(b'grant probe',DU(recipient.x),sender.kid,recipient.kid,nonce)
+    q=dict(to_kid=recipient.kid,to_key_leaf_index=recipient.claim_index,encryption='x25519-xsalsa20-poly1305',eph_pk=U(body[:32]),ct_hash=H(body),size=len(body),seq=sender.previous['protected']['seq']+1,prev=H(J(sender.previous)),grant_index=gi)
+    e=ctx.prepare(sender,'dm',q,nonce=nonce)
+    return e,ctx.client.submit(e,sender.key,body)
+
+@check('grants.wildcard','Wildcard allowance is total across all senders','AICS-1 §9','wildcard_capacity')
+def wildcard(ctx):
+    recipient=ctx.new_agent(); first=ctx.new_agent(); second=ctx.new_agent(); gi=grant(ctx,recipient,'*',1)
+    e,r=attempt(ctx,first,recipient,gi); entry,note=ctx.accepted(r,first,e); ctx.follow(entry,note)
+    e,r=attempt(ctx,second,recipient,gi); ctx.refused(r,e,'grant_exhausted')
+
+@check('grants.exact-revocation','Exact revocation never falls back to wildcard','AICS-1 §9','exact_revocation')
+def revocation(ctx):
+    recipient=ctx.new_agent(); sender=ctx.new_agent(); grant(ctx,recipient,'*',4); gi=grant(ctx,recipient,sender.kid,0)
+    e,r=attempt(ctx,sender,recipient,gi)
+    require(400<=r.status<500,'exact revocation ignored')
+    reason=r.json()['entry']['payload']['reason_code']; require(reason in ('no_consent','grant_exhausted'),'wrong consent refusal')
+    ctx.refused(r,e,reason)

aics_conformance/checks/http.py

@@ -0,0 +1,24 @@
+"""RFC 9421 and envelope metadata must describe the same logical attempt."""
+import secrets
+from aics_identity import http_signatures
+from ..core import check
+from ..protocol import J,U
+from ..schema import require
+from .. import adapter
+from .negative import post_attempt
+
+@check('http.binding','Native HTTP signatures bind the exact envelope metadata','AICS-1 §12.1','http_binding')
+def binding(ctx):
+    a=ctx.new_agent()
+    for changed in ('nonce','created','expires','label'):
+        e,b=post_attempt(ctx,a); p=e['protected']; raw=J(dict(envelope=e,body=U(b)))
+        args=dict(key=a.key,keyid=p['kid'],created=p['created'],expires=p['expires'],nonce=p['nonce'],label='aics',tag='aics',components=http_signatures.AICS_COMPONENTS)
+        if changed=='nonce': args['nonce']=U(secrets.token_bytes(16))
+        elif changed=='label': args['label']='other'
+        else: args[changed]-=1
+        headers=http_signatures.sign_request('POST',ctx.client.api+adapter.path('submit'),{'Content-Type':'application/json'},raw,**args)
+        r=ctx.client.submit(e,a.key,b,headers=headers)
+        require(400<=r.status<500,'HTTP/envelope mismatch accepted')
+        q=r.json()['entry']['payload']; require(q['reason_code'] in ('bad_signature','malformed'),'wrong HTTP-binding refusal')
+        # The transport binding is invalid. Do not accept asserted identity fields.
+        ctx.refused(r,e,q['reason_code'],authenticated=False)

aics_conformance/checks/identity.py

@@ -0,0 +1,42 @@
+from ..core import check
+from ..protocol import Agent,J,H,U,DU,rotation
+from ..schema import require
+from .negative import post_attempt
+
+@check('identity.claim-pop','Claim requires possession of claimed key','AICS-1 §7.1','accept_bad_signature')
+def claim(ctx):
+    a=Agent(); e=ctx.prepare(a,'name.claim',a.claim()); e['sig']=U(bytes(64))
+    ctx.refused(ctx.client.submit(e,a.key),e,'bad_signature',authenticated=False)
+
+@check('identity.rotate','Rotation requires both proofs and succeeds with both','AICS-1 §7.2','one_signature')
+def rotate(ctx):
+    a=ctx.new_agent(); new=Agent(name=a.name)
+    for missing in ('sig_old','sig_new'):
+        q=rotation(a,new,ctx.policy.trust['origin']); q[missing]['signature']=U(bytes(64))
+        e=ctx.prepare(a,'key.rotate',q); ctx.refused(ctx.client.submit(e,a.key),e,'bad_signature')
+    entry,note=ctx.submit(a,'key.rotate',rotation(a,new,ctx.policy.trust['origin'])); i=ctx.follow(entry,note)
+    new.claim_index=a.claim_index; new.event_index=i; ctx.post(new)
+    hist,_=ctx.scan(); require(hist.names[a.name]['kid']==new.kid,'new signing key not current')
+
+@check('identity.fork','Second event consuming a key predecessor is refused','AICS-1 §7.2','key_fork')
+def fork(ctx):
+    a=ctx.new_agent(); predecessor=a.event_index; new=Agent(name=a.name)
+    entry,note=ctx.submit(a,'key.rotate',rotation(a,new,ctx.policy.trust['origin'])); i=ctx.follow(entry,note)
+    # Current key signs, but deliberately consumes the already-used name predecessor.
+    new.event_index=predecessor
+    e=ctx.prepare(new,'key.rotate',rotation(new,Agent(name=a.name),ctx.policy.trust['origin']))
+    result=ctx.refused(ctx.client.submit(e,new.key),e,'key_fork')
+    require(result['payload']['conflict_index']==i,'fork refusal missing first successor')
+
+@check('identity.revoke','Revocation permanently prevents reclaim and rotation','AICS-1 §7.3','revocation')
+def revoke(ctx):
+    a=ctx.new_agent(); entry,note=ctx.submit(a,'key.revoke',dict(name_norm=a.name,prev_event_index=a.event_index,reason_code='retired')); a.event_index=ctx.follow(entry,note)
+    replacement=Agent(name=a.name); e=ctx.prepare(replacement,'name.claim',replacement.claim())
+    ctx.refused(ctx.client.submit(e,replacement.key),e,'revoked')
+    e=ctx.prepare(a,'key.rotate',rotation(a,replacement,ctx.policy.trust['origin'])); ctx.refused(ctx.client.submit(e,a.key),e,'revoked')
+
+@check('identity.x25519','Encryption key rotates and lookup proves latest key','AICS-1 §7.3','xrotate')
+def xrotate(ctx):
+    a=ctx.new_agent(); new=Agent(); entry,note=ctx.submit(a,'x25519.rotate',dict(name_norm=a.name,prev_event_index=a.event_index,new_x25519=new.x)); i=ctx.follow(entry,note)
+    hist,_=ctx.scan(); require(hist.names[a.name]['x']==new.x and hist.names[a.name]['key_index']==i,'encryption key did not advance')
+    lookup=ctx.client.get('name',name=a.name); require(lookup.get('x25519',new.x)==new.x,'API did not advance')

aics_conformance/checks/log.py

@@ -0,0 +1,53 @@
+from aics_tlog import inclusion_proof_from_tiles, consistency_proof_from_tiles, MerkleTree, verify_consistency
+from ..core import check, Skip
+from ..protocol import J, DU, DB, H
+from ..schema import require
+from .. import verify, adapter
+
+@check('log.checkpoint','Checkpoint signature uses out-of-band key','AICS-1 §§6.2–6.4,14.1','bad_checkpoint')
+def checkpoint(ctx):
+    h=ctx.head()
+    return dict(size=h.cp.size,checkpoint_hash=H(h.raw),freshness='witnessed' if ctx.policy.quorum else 'remote freshness unproven')
+
+@check('log.consistency','Two current fetches extend the same history','AICS-1 §§6.1,14.2','rollback')
+def consistency(ctx):
+    old=ctx.head(); a=ctx.new_agent(); ctx.post(a); entries,new=ctx.scan(validate=False)
+    verify.continuity(old,new,entries)
+
+@check('log.proofs','Served proofs equal authenticated tile-derived proofs','AICS-1 §§6.1,12.1,14.2','bad_proof')
+def proofs(ctx):
+    old=ctx.head(); ctx.new_agent(); entries,h=ctx.scan(validate=False); reader=ctx.tiles.authenticated(h.cp)
+    for i in sorted({0,h.cp.size-1,h.cp.size//2}):
+        r=ctx.client.get('inclusion',params=dict(index=i,size=h.cp.size)); require(r['index']==i and r['size']==h.cp.size,'proof coordinates')
+        require([DB(x) for x in r['hashes']]==inclusion_proof_from_tiles(reader,i,h.cp.size),'served inclusion differs from tiles')
+    for m in (0,old.cp.size,h.cp.size):
+        r=ctx.client.get('consistency',params={'from':m,'to':h.cp.size}); require(r['from']==m and r['to']==h.cp.size,'consistency coordinates')
+        require([DB(x) for x in r['hashes']]==consistency_proof_from_tiles(reader,m,h.cp.size),'served consistency differs from tiles')
+
+@check('log.receipt','Exact receipted entry included within 60 seconds','AICS-1 §§10.1,14.4','dropped_receipt')
+def receipt(ctx):
+    a=ctx.new_agent(); entry,note=ctx.post(a); i=ctx.follow(entry,note)
+    return dict(index=i,timing=ctx.evidence['timing_evidence'])
+
+@check('log.tombstone','Tombstone hides only body and preserves exact leaf','AICS-1 §10.3','tombstone_delete')
+def tombstone(ctx):
+    hist,h=ctx.scan(); candidates=[(i,e) for i,e in enumerate(hist.entries) if e['type']=='tombstone']
+    if ctx.policy.tombstone_index is not None: candidates=[(i,e) for i,e in candidates if i==ctx.policy.tombstone_index]
+    if not candidates: raise Skip('operator must prepare a lawful synthetic tombstone fixture; no administrative signing key required')
+    def digest_of(q): return q.get('body_hash',q.get('ct_hash'))
+    for i,e in candidates:
+        target=e['payload']['target_index']; b=ctx.client.get('entry',index=target)
+        require(DU(b['entry_bytes'])==hist.raw[target],'tombstone changed or deleted target leaf')
+        targetq=hist.entries[target]['payload']; digest=digest_of(targetq)
+        if digest:
+            require(b['body_or_ct'] is None,'tombstoned body still served in its bundle')
+            # Another entry that is not hidden may commit to the same bytes (two identical public bodies): the body
+            # service then serves them for that entry, and the hidden one is checked through its bundle only.
+            shared=[j for j,x in enumerate(hist.entries) if j!=target and digest_of(x['payload'])==digest and j not in hist.tombstones]
+            if shared: continue
+            r=ctx.client.body(digest); require(r.status in (404,410),'tombstoned body still served')
+            status=r.json(); require(status['tombstone_index']==i and status['reason_code']==e['payload']['reason_code'],'body status lacks tombstone evidence')
+
+@check('log.metadata','Every entry bundle contains only closed metadata schemas','AICS-1 §§5.1–5.3,6.1','plaintext_field_leak')
+def metadata(ctx):
+    hist,h=ctx.scan(); return dict(entries_scanned=len(hist.entries),checkpoint_hash=H(h.raw))

aics_conformance/checks/negative.py

@@ -0,0 +1,56 @@
+import secrets
+from ..core import check
+from ..protocol import J,H,U,DU,seal
+from ..schema import require
+
+
+def post_attempt(ctx,a,text='negative-case synthetic body',**kwargs):
+    b=J(dict(channel='conformance',title=None,text=text)); q=dict(channel_sha256=H(b'conformance'),parent_index=None,body_hash=H(b),size=len(b),title_sha256=None)
+    return ctx.prepare(a,'post',q,**kwargs),b
+
+@check('negative.bad-signature','Bad signature is refused with authenticated refusal leaf','AICS-1 §§4,10.2,12.1','accept_bad_signature')
+def bad_signature(ctx):
+    a=ctx.new_agent(); e,b=post_attempt(ctx,a); e['sig']=U(bytes(64)); r=ctx.client.submit(e,a.key,b)
+    ctx.refused(r,e,'bad_signature',authenticated=False)
+
+@check('negative.replay','Identical request replay is refused and linked to conflict','AICS-1 §§4.3,10.2','accept_replay')
+def replay(ctx):
+    a=ctx.new_agent(); e,b=post_attempt(ctx,a); r=ctx.client.submit(e,a.key,b); entry,note=ctx.accepted(r,a,e); i=ctx.follow(entry,note)
+    result=ctx.refused(ctx.client.submit(e,a.key,b),e,'replay'); q=result['payload']
+    require(q['conflict_index']==i and q['receipt_hash']==H(note),'replay evidence lost original acceptance/receipt')
+
+@check('negative.stale','Stale created is refused with a leaf','AICS-1 §§4.3,10.2','accept_stale')
+def stale(ctx):
+    a=ctx.new_agent(); e,b=post_attempt(ctx,a,created=int(ctx.now())-301)
+    # The envelope and HTTP signature remain cryptographically valid, though expired.
+    ctx.refused(ctx.client.submit(e,a.key,b),e,'expired')
+
+
+def private_attempt(ctx,*,clear=False):
+    a=ctx.new_agent(); recipient=ctx.new_agent(); nonce=U(secrets.token_bytes(16))
+    if clear:
+        grant,note=ctx.submit(recipient,'grant',dict(owner_kid=recipient.kid,sender_kid=a.kid,max=1,expires=int(ctx.now())+600,prev_grant_index=None)); gi=ctx.follow(grant,note)
+        body=b'private plaintext must be refused'; scheme='cleartext'; eph=None
+    else:
+        gi=recipient.claim_index; body=seal(b'closed inbox probe',DU(recipient.x),a.kid,recipient.kid,nonce); scheme='x25519-xsalsa20-poly1305'; eph=U(body[:32])
+    q=dict(to_kid=recipient.kid,to_key_leaf_index=recipient.claim_index,encryption=scheme,eph_pk=eph,ct_hash=H(body),size=len(body),seq=1,prev=H(J(a.previous)),grant_index=gi)
+    return a,ctx.prepare(a,'dm',q,nonce=nonce),body
+
+@check('negative.cleartext','Cleartext private message refused and logged','AICS-1 §§8.1,10.2','cleartext')
+def cleartext(ctx):
+    a,e,b=private_attempt(ctx,clear=True); ctx.refused(ctx.client.submit(e,a.key,b),e,'unsupported_scheme')
+
+@check('negative.closed-inbox','New inbox is closed; rejected message leaves evidence','AICS-1 §§9,10.2','open_inbox')
+def closed(ctx):
+    a,e,b=private_attempt(ctx); ctx.refused(ctx.client.submit(e,a.key,b),e,'no_consent')
+
+@check('negative.secret','Published secret format refused, logged, body unavailable','AICS-1 §10.2','retain_secret')
+def secret(ctx):
+    a=ctx.new_agent(); card=ctx.client.get('card',pages=True)
+    require(ctx.policy.secret_pattern_id in {p['id'] for p in card['secret_patterns']},'configured secret test format is not published')
+    e,b=post_attempt(ctx,a,ctx.policy.secret_sample)
+    ctx.refused(ctx.client.submit(e,a.key,b),e,'secret_format:'+ctx.policy.secret_pattern_id)
+    r=ctx.client.body(H(b)); require(r.status in (404,410),'refused secret body retained by body service')
+    raw,h=ctx.scan(validate=False)
+    for entry in raw: require(ctx.policy.secret_sample.encode() not in entry and U(b).encode() not in entry,'refused body retained in leaf')
+    return dict(retention_evidence='Body service and complete leaves checked; inaccessible internal storage requires operator inspection.')

aics_conformance/checks/rates.py

@@ -0,0 +1,18 @@
+from ..core import check,Skip
+from ..card import verify_card
+from ..schema import require
+from .negative import post_attempt
+@check('rates.published','Published per-key limit yields refusal leaves, never silence','AICS-1 §§10.2,13.1','rate_limit')
+def rates(ctx):
+    card,hist,h=verify_card(ctx); limit=card['limits']['writes']; count=limit['count']
+    if count+1>ctx.policy.max_rate_attempts: raise Skip('published limit exceeds max_rate_attempts')
+    a=ctx.new_agent(); start=ctx.now(); refused=False
+    for i in range(count+1):
+        e,b=post_attempt(ctx,a); r=ctx.client.submit(e,a.key,b)
+        require(ctx.now()-start<limit['interval_seconds'],'incomplete: requests did not fit one rate window')
+        if r.status==202: ctx.accepted(r,a,e)
+        else:
+            require(i>=count-1,'rate refusal before published allowance was consumed')
+            ctx.refused(r,e,'rate_limit'); refused=True; break
+    require(refused,'published rate bound exceeded without a refusal leaf')
+    other=ctx.new_agent(); entry,note=ctx.post(other); ctx.follow(entry,note)