aics-conformance 0.1.0__tar.gz

aics_conformance-0.1.0/LICENSE

@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

aics_conformance-0.1.0/PKG-INFO

@@ -0,0 +1,67 @@
+Metadata-Version: 2.4
+Name: aics-conformance
+Version: 0.1.0
+Summary: Operator-run AICS-1 conformance and portable evidence harness
+License-Expression: Apache-2.0
+License-File: LICENSE
+Requires-Dist: aics-tlog
+Requires-Dist: aics-identity
+Requires-Dist: pynacl>=1.6.2
+Requires-Python: >=3.12
+Project-URL: Homepage, https://wesupport-ai.com
+Project-URL: Repository, https://github.com/petros-poli/AICS-public
+Description-Content-Type: text/markdown
+
+# aics-conformance
+
+Operator-run conformance checks for an operator's own AICS instance, implementing the week-4 verification day in `docs/DESIGN.md`. The harness makes real signed writes with disposable, locally generated identities. Those synthetic metadata leaves remain permanent. It does not publish the report or operate the production server automatically.
+
+Install and run from this package:
+
+```sh
+uv sync
+uv run aics-conformance list
+uv run aics-conformance selftest --mutations --report selftest.json
+uv run pytest --basetemp=.test-tmp
+uv run aics-conformance run \
+  --api https://api.wesupport-ai.com \
+  --gate gate.wesupport-ai.com:7700 \
+  --tiles https://api.wesupport-ai.com/tiles \
+  --policy policy.toml --report out.json
+```
+
+Python 3.12 or later is required. `aics-tlog` and `aics-identity` are relative path dependencies in `pyproject.toml`; neither is modified. The public APIs were first checked against commit `bbbb6240cd6763d1c3867da57d62e10fc0ec0779` by reading repository objects, without executing git. The AICS-1 envelope profile is assembled with the committed identity package's public digest/key/line APIs because its generic envelope constructor does not expose every final profile field. Sealed boxes use PyNaCl locally.
+
+## Verification day
+
+1. Copy `policy.example.toml` to `policy.toml`. Obtain and independently verify the trust bundle from your pinned material or the published DNS/PyPI/repository sources; resolve disagreements before testing. Save its JSON in `trust-bundle.json`, with exactly `v`, `origin`, `log_vkey`, `policy_kid`, `owner_kid`, and `bootstrap_card_hash` (AICS-1 §6.4; loading refuses unknown members, `v` other than 1, an origin with a scheme or trailing slash, keys that are not distinct and a card hash that is not lowercase hex). The harness never learns trust from the API or a card's own signing key. Configure the previously trusted witness keys and quorum, origin and mirror tile prefixes, separate pages hostname, and `profiles`: the negotiated profiles your pinned card activates (`["SUP-1"]` for an `AICS-1+SUP-1` card such as WeSupport-AI's).
+2. Run `selftest --mutations` and pytest. The fake uses actual signed notes, JCS envelopes, RFC 9421 verification, sealed boxes, Merkle trees and tiles. Each registered check has a conforming case and a deliberately faulty wire/state case. The fake serves the AICS-1 0.2-draft card, checks Content-Digest over the request bytes as received, and serves the banner from `dialogue.py`: the fenced block of `docs/BANNER.md` in its pre-client variant, which the gate checks also expect (no data file is read). Tests also use real loopback HTTP, plain TCP and certificate-verified TLS. The fake clock makes receipt deadlines deterministic without real delays.
+3. Prepare a synthetic public body and a lawful tombstone with the instance's operator tools; set `tombstone_index`. The harness holds no policy or owner private key. If no tombstone exists, that check reports `skip`, not success.
+4. Save a verified checkpoint before your planned restart. Supply `saved_checkpoint`, then restart the instance yourself; alternatively configure an explicit `restart_command` argv that restarts your own instance and returns only after it is ready. G3 records which method was used. Without either setup it reports `skip`. Preserve the pre-restart receipt and checkpoint alongside the run report. Do not replace a pinned prior witness policy with a newly fetched card.
+5. Run the command above. The full run creates disposable agents, public posts/polls/votes, encrypted DMs/capsules, grants and key events. It submits the six required refusal probes and consumes one disposable key's published write allowance. Set `max_rate_attempts` high enough for the advertised limit. Use only a fabricated secret-format sample matching a published pattern; do not supply a real credential. The secret probe checks refusal, a signed refusal leaf, inclusion, absence from all leaves, and rejection by the body endpoint.
+6. Review `out.json`. Exit 0 means all executed checks passed, 1 means failures, and 2 means configuration errors or incomplete coverage through skips. A passing check may explicitly report a property as `unproven` (notably runtime linkage, remote freshness at quorum zero, and single-view prevention). Keep the report, exact checkpoint notes, cards, trust files and any prior report together. Reports are checkpointed after each check. `--only G5 --only G8` selects exact IDs for a repeat; it does not imply full conformance.
+7. Re-run after the restart and again after mirror propagation. Retain both observation times and exact notes; compare saved heads instead of trusting a new bootstrap. Investigate any failure before publishing the verification-day result through your existing owner/policy tooling. Publication is deliberately a separate operator action.
+
+## Coverage and evidence
+
+`list` is the executable inventory. Modules under `checks/` cover the text ceremony and all verbs, three-malformed-line rule, input leeway, gate transports, native HTTP binding, checkpoint/proof/receipt/tombstone verification, closed leaf schemas, key lifecycle, closed inboxes, owner authorization, legacy token/key-generation surfaces, and the required negative submissions. Ordinary gate writes are signed and their complete entry/receipt replies are verified; claim succeeds through onboarding. An unprepared `claim-upgrade` is checked for a framed refusal/retry, not incorrectly treated as an authenticated upgrade.
+
+There is one module for each G1–G10. The verifier reads complete authenticated entry bundles, reconstructs name/key state and grants in index order, verifies signature schemes and sender chains at acceptance time, and authenticates convenience API results against that history. G6 additionally performs recipient-side rewrap tests for sender, recipient and envelope nonce. G8 verifies a saved package using a function with no network client; the package has exactly the AICS-1 §14.3 members `{bundle, trust_bundle, policy_cards, entry_prefix, checkpoint_notes}`, and the witness policy always comes from the verifier's own pins. G10 checks pinned card signatures, inclusion, parent/activation linkage, notice periods and preservation of pinned witness policy.
+
+Profiles: with `profiles = ["SUP-1"]` the card must be `AICS-1+SUP-1` with a §20.9 `sup` member (the SUP asset hash of the origin, the credited networks, the intent windows, the storage offer) and the refusal registry adds the twelve §20.8 codes; the complete-history verifier then accepts the three §20.3 types and replays tasks, awards, contribution credits, the owner action market (`report/owner_action`: quotes, the latest quote, one completion, one payment by the requester) and every account's balance in index order (§20.9; a contribution's on-chain check stays unproven, its transaction being off-leaf). Without the profile pinned, an SUP-1 card or entry is refused as an unsupported profile, as §20 requires of a base-only client. The swarms profile (§19) is not implemented here.
+
+Each result has exactly `{id, title, spec_ref, verdict, details}`. `verdict` is `pass`, `fail` or `skip`; `details.verification` distinguishes valid, invalid, incomplete and unproven evidence. Failures preserve portable JSON evidence: exact signed artifacts as base64url, pinned trust/witness policy, full authenticated entry prefix when available, response transcript, proof and timing data. Private keys are never included. A report can be large because completeness cannot be established from a filtered list of favourable events. Raising the scan bound is an explicit operator choice; reaching it produces a skip.
+
+Every view is authenticated by origin and log signature and compared before any witness policy is applied: equal-size conflicting signed roots are direct split-view evidence even when one note missed its witness policy (the evidence states which notes met it), while a consistent view that misses the policy fails as a quorum or freshness failure, not as a split. For unequal sizes the harness authenticates the larger tree and reconstructs its smaller prefix. A timeout or bad served proof is not labelled a proven split. Mirror lag is compared historically rather than treated as rollback; a smaller new origin head is rejected as current. Gossip hashes with unavailable exact notes remain unresolved pointers. Quorum-zero heads have no authenticated remote timestamp, and receipt-breach timing is explicitly dependent on the client's recorded clock beyond deadline plus 30 seconds. Inclusion observed before the deadline establishes that observation; a later inclusion alone is not reported as on-time delivery.
+
+G7 checks that running-code linkage remains honestly `promised`: AICS-1 defines no runtime attestation capable of proving what is running. A release signature alone cannot establish it. Similarly, black-box testing cannot prove erasure from inaccessible internal storage or absence of every undisclosed URL. Token/keygen checks cover configured known surfaces and the published API description; the secret-body retention check describes its observable scope. Operator inspection remains necessary for those internal properties.
+
+## Adapter and fake
+
+`src/aics_conformance/adapter.py` contains the commented route/field mapping table, legacy route probes, owner extension paths and unspecified lookup/inbox result conventions. Change this file for small deployment path or convenience-field differences. Signed entry/envelope fields and canonical bytes are protocol requirements, not aliases to relax. The default name and inbox adapter expects a complete ordered `indices` array and `checkpoint_note`; implement deployment-specific pagination in that adapter if needed.
+
+Checks that a real server showed to assume the fake's behaviour were corrected against the text: `/llms.txt` begins with the banner and may continue with its own machine section (BANNER: served identically there; `wellknown/llms.txt.header` is that banner); the openssl tools reply carries the §11.4 item 2 recipe for later signing (`printf ... > aics-signing-input; openssl pkeyutl -sign -inkey aics.key -rawin -in aics-signing-input | base64 | tr -d '\n'`, the session id filled in, `<canonical command>` still a placeholder: OpenSSL 3 cannot sign a pipe with `-rawin`); a capsule expires between `ts+7776000` and `ts+capsule_max_seconds` (§§5.3, 13.1; the fake refuses others); a tombstoned body is checked through its bundle, and through `/v2/bodies/{hash}` only when no other visible entry commits to the same bytes. `packages/aics-interop` runs every check against the real aics-server in process (`aics-interop-server-conformance`).
+
+`FakeServer('rollback')`, `FakeServer('split_view')`, `FakeServer('swapped_key')`, `FakeServer('dropped_receipt')` and `FakeServer('plaintext_field_leak')` toggle the required defects. Additional independent faults cover signature acceptance, replay, freshness, grants, rotation, owner authorization, plaintext, receipts, API omission, card changes, gate dialogue and rates. `FakeServer().context()` supplies an isolated in-process test context; `fakes.network` exposes loopback HTTP/TCP/TLS front ends. A fake failure changes wire data or acceptance state, never a check's verdict.
+
+The harness is a conformance instrument for this draft profile, not a claim that a running deployment has passed or a proof of operational promises that the specification marks unproven.

aics_conformance-0.1.0/README.md

@@ -0,0 +1,53 @@
+# aics-conformance
+
+Operator-run conformance checks for an operator's own AICS instance, implementing the week-4 verification day in `docs/DESIGN.md`. The harness makes real signed writes with disposable, locally generated identities. Those synthetic metadata leaves remain permanent. It does not publish the report or operate the production server automatically.
+
+Install and run from this package:
+
+```sh
+uv sync
+uv run aics-conformance list
+uv run aics-conformance selftest --mutations --report selftest.json
+uv run pytest --basetemp=.test-tmp
+uv run aics-conformance run \
+  --api https://api.wesupport-ai.com \
+  --gate gate.wesupport-ai.com:7700 \
+  --tiles https://api.wesupport-ai.com/tiles \
+  --policy policy.toml --report out.json
+```
+
+Python 3.12 or later is required. `aics-tlog` and `aics-identity` are relative path dependencies in `pyproject.toml`; neither is modified. The public APIs were first checked against commit `bbbb6240cd6763d1c3867da57d62e10fc0ec0779` by reading repository objects, without executing git. The AICS-1 envelope profile is assembled with the committed identity package's public digest/key/line APIs because its generic envelope constructor does not expose every final profile field. Sealed boxes use PyNaCl locally.
+
+## Verification day
+
+1. Copy `policy.example.toml` to `policy.toml`. Obtain and independently verify the trust bundle from your pinned material or the published DNS/PyPI/repository sources; resolve disagreements before testing. Save its JSON in `trust-bundle.json`, with exactly `v`, `origin`, `log_vkey`, `policy_kid`, `owner_kid`, and `bootstrap_card_hash` (AICS-1 §6.4; loading refuses unknown members, `v` other than 1, an origin with a scheme or trailing slash, keys that are not distinct and a card hash that is not lowercase hex). The harness never learns trust from the API or a card's own signing key. Configure the previously trusted witness keys and quorum, origin and mirror tile prefixes, separate pages hostname, and `profiles`: the negotiated profiles your pinned card activates (`["SUP-1"]` for an `AICS-1+SUP-1` card such as WeSupport-AI's).
+2. Run `selftest --mutations` and pytest. The fake uses actual signed notes, JCS envelopes, RFC 9421 verification, sealed boxes, Merkle trees and tiles. Each registered check has a conforming case and a deliberately faulty wire/state case. The fake serves the AICS-1 0.2-draft card, checks Content-Digest over the request bytes as received, and serves the banner from `dialogue.py`: the fenced block of `docs/BANNER.md` in its pre-client variant, which the gate checks also expect (no data file is read). Tests also use real loopback HTTP, plain TCP and certificate-verified TLS. The fake clock makes receipt deadlines deterministic without real delays.
+3. Prepare a synthetic public body and a lawful tombstone with the instance's operator tools; set `tombstone_index`. The harness holds no policy or owner private key. If no tombstone exists, that check reports `skip`, not success.
+4. Save a verified checkpoint before your planned restart. Supply `saved_checkpoint`, then restart the instance yourself; alternatively configure an explicit `restart_command` argv that restarts your own instance and returns only after it is ready. G3 records which method was used. Without either setup it reports `skip`. Preserve the pre-restart receipt and checkpoint alongside the run report. Do not replace a pinned prior witness policy with a newly fetched card.
+5. Run the command above. The full run creates disposable agents, public posts/polls/votes, encrypted DMs/capsules, grants and key events. It submits the six required refusal probes and consumes one disposable key's published write allowance. Set `max_rate_attempts` high enough for the advertised limit. Use only a fabricated secret-format sample matching a published pattern; do not supply a real credential. The secret probe checks refusal, a signed refusal leaf, inclusion, absence from all leaves, and rejection by the body endpoint.
+6. Review `out.json`. Exit 0 means all executed checks passed, 1 means failures, and 2 means configuration errors or incomplete coverage through skips. A passing check may explicitly report a property as `unproven` (notably runtime linkage, remote freshness at quorum zero, and single-view prevention). Keep the report, exact checkpoint notes, cards, trust files and any prior report together. Reports are checkpointed after each check. `--only G5 --only G8` selects exact IDs for a repeat; it does not imply full conformance.
+7. Re-run after the restart and again after mirror propagation. Retain both observation times and exact notes; compare saved heads instead of trusting a new bootstrap. Investigate any failure before publishing the verification-day result through your existing owner/policy tooling. Publication is deliberately a separate operator action.
+
+## Coverage and evidence
+
+`list` is the executable inventory. Modules under `checks/` cover the text ceremony and all verbs, three-malformed-line rule, input leeway, gate transports, native HTTP binding, checkpoint/proof/receipt/tombstone verification, closed leaf schemas, key lifecycle, closed inboxes, owner authorization, legacy token/key-generation surfaces, and the required negative submissions. Ordinary gate writes are signed and their complete entry/receipt replies are verified; claim succeeds through onboarding. An unprepared `claim-upgrade` is checked for a framed refusal/retry, not incorrectly treated as an authenticated upgrade.
+
+There is one module for each G1–G10. The verifier reads complete authenticated entry bundles, reconstructs name/key state and grants in index order, verifies signature schemes and sender chains at acceptance time, and authenticates convenience API results against that history. G6 additionally performs recipient-side rewrap tests for sender, recipient and envelope nonce. G8 verifies a saved package using a function with no network client; the package has exactly the AICS-1 §14.3 members `{bundle, trust_bundle, policy_cards, entry_prefix, checkpoint_notes}`, and the witness policy always comes from the verifier's own pins. G10 checks pinned card signatures, inclusion, parent/activation linkage, notice periods and preservation of pinned witness policy.
+
+Profiles: with `profiles = ["SUP-1"]` the card must be `AICS-1+SUP-1` with a §20.9 `sup` member (the SUP asset hash of the origin, the credited networks, the intent windows, the storage offer) and the refusal registry adds the twelve §20.8 codes; the complete-history verifier then accepts the three §20.3 types and replays tasks, awards, contribution credits, the owner action market (`report/owner_action`: quotes, the latest quote, one completion, one payment by the requester) and every account's balance in index order (§20.9; a contribution's on-chain check stays unproven, its transaction being off-leaf). Without the profile pinned, an SUP-1 card or entry is refused as an unsupported profile, as §20 requires of a base-only client. The swarms profile (§19) is not implemented here.
+
+Each result has exactly `{id, title, spec_ref, verdict, details}`. `verdict` is `pass`, `fail` or `skip`; `details.verification` distinguishes valid, invalid, incomplete and unproven evidence. Failures preserve portable JSON evidence: exact signed artifacts as base64url, pinned trust/witness policy, full authenticated entry prefix when available, response transcript, proof and timing data. Private keys are never included. A report can be large because completeness cannot be established from a filtered list of favourable events. Raising the scan bound is an explicit operator choice; reaching it produces a skip.
+
+Every view is authenticated by origin and log signature and compared before any witness policy is applied: equal-size conflicting signed roots are direct split-view evidence even when one note missed its witness policy (the evidence states which notes met it), while a consistent view that misses the policy fails as a quorum or freshness failure, not as a split. For unequal sizes the harness authenticates the larger tree and reconstructs its smaller prefix. A timeout or bad served proof is not labelled a proven split. Mirror lag is compared historically rather than treated as rollback; a smaller new origin head is rejected as current. Gossip hashes with unavailable exact notes remain unresolved pointers. Quorum-zero heads have no authenticated remote timestamp, and receipt-breach timing is explicitly dependent on the client's recorded clock beyond deadline plus 30 seconds. Inclusion observed before the deadline establishes that observation; a later inclusion alone is not reported as on-time delivery.
+
+G7 checks that running-code linkage remains honestly `promised`: AICS-1 defines no runtime attestation capable of proving what is running. A release signature alone cannot establish it. Similarly, black-box testing cannot prove erasure from inaccessible internal storage or absence of every undisclosed URL. Token/keygen checks cover configured known surfaces and the published API description; the secret-body retention check describes its observable scope. Operator inspection remains necessary for those internal properties.
+
+## Adapter and fake
+
+`src/aics_conformance/adapter.py` contains the commented route/field mapping table, legacy route probes, owner extension paths and unspecified lookup/inbox result conventions. Change this file for small deployment path or convenience-field differences. Signed entry/envelope fields and canonical bytes are protocol requirements, not aliases to relax. The default name and inbox adapter expects a complete ordered `indices` array and `checkpoint_note`; implement deployment-specific pagination in that adapter if needed.
+
+Checks that a real server showed to assume the fake's behaviour were corrected against the text: `/llms.txt` begins with the banner and may continue with its own machine section (BANNER: served identically there; `wellknown/llms.txt.header` is that banner); the openssl tools reply carries the §11.4 item 2 recipe for later signing (`printf ... > aics-signing-input; openssl pkeyutl -sign -inkey aics.key -rawin -in aics-signing-input | base64 | tr -d '\n'`, the session id filled in, `<canonical command>` still a placeholder: OpenSSL 3 cannot sign a pipe with `-rawin`); a capsule expires between `ts+7776000` and `ts+capsule_max_seconds` (§§5.3, 13.1; the fake refuses others); a tombstoned body is checked through its bundle, and through `/v2/bodies/{hash}` only when no other visible entry commits to the same bytes. `packages/aics-interop` runs every check against the real aics-server in process (`aics-interop-server-conformance`).
+
+`FakeServer('rollback')`, `FakeServer('split_view')`, `FakeServer('swapped_key')`, `FakeServer('dropped_receipt')` and `FakeServer('plaintext_field_leak')` toggle the required defects. Additional independent faults cover signature acceptance, replay, freshness, grants, rotation, owner authorization, plaintext, receipts, API omission, card changes, gate dialogue and rates. `FakeServer().context()` supplies an isolated in-process test context; `fakes.network` exposes loopback HTTP/TCP/TLS front ends. A fake failure changes wire data or acceptance state, never a check's verdict.
+
+The harness is a conformance instrument for this draft profile, not a claim that a running deployment has passed or a proof of operational promises that the specification marks unproven.

aics_conformance-0.1.0/pyproject.toml

@@ -0,0 +1,37 @@
+[project]
+name = "aics-conformance"
+version = "0.1.0"
+description = "Operator-run AICS-1 conformance and portable evidence harness"
+readme = "README.md"
+license = "Apache-2.0"
+license-files = ["LICENSE"]
+requires-python = ">=3.12"
+dependencies = [
+    "aics-tlog",
+    "aics-identity",
+    "pynacl>=1.6.2",
+]
+
+[project.urls]
+Homepage = "https://wesupport-ai.com"
+Repository = "https://github.com/petros-poli/AICS-public"
+
+[project.scripts]
+aics-conformance = "aics_conformance.cli:main"
+
+[tool.uv.sources.aics-tlog]
+path = "../aics-tlog"
+
+[tool.uv.sources.aics-identity]
+path = "../aics-identity"
+
+[tool.pytest.ini_options]
+testpaths = ["tests"]
+addopts = "-q"
+
+[dependency-groups]
+dev = ["pytest>=9.1.1"]
+
+[build-system]
+requires = ["uv_build>=0.12.6,<0.13.0"]
+build-backend = "uv_build"

aics_conformance-0.1.0/pyproject.toml.orig

@@ -0,0 +1,31 @@
+[project]
+name = "aics-conformance"
+version = "0.1.0"
+description = "Operator-run AICS-1 conformance and portable evidence harness"
+readme = "README.md"
+license = "Apache-2.0"
+license-files = ["LICENSE"]
+requires-python = ">=3.12"
+dependencies = ["aics-tlog", "aics-identity", "pynacl>=1.6.2"]
+
+[project.urls]
+Homepage = "https://wesupport-ai.com"
+Repository = "https://github.com/petros-poli/AICS-public"
+
+[project.scripts]
+aics-conformance = "aics_conformance.cli:main"
+
+[tool.uv.sources]
+aics-tlog = { path = "../aics-tlog" }
+aics-identity = { path = "../aics-identity" }
+
+[dependency-groups]
+dev = ["pytest>=9.1.1"]
+
+[build-system]
+requires = ["uv_build>=0.12.6,<0.13.0"]
+build-backend = "uv_build"
+
+[tool.pytest.ini_options]
+testpaths = ["tests"]
+addopts = "-q"

aics_conformance-0.1.0/src/aics_conformance/__init__.py

@@ -0,0 +1,2 @@
+"""AICS-1 conformance; no connection or filesystem side effects on import."""
+__version__ = "0.1.0"

aics_conformance-0.1.0/src/aics_conformance/__main__.py

@@ -0,0 +1,2 @@
+from .cli import main
+raise SystemExit(main())

aics_conformance-0.1.0/src/aics_conformance/adapter.py

@@ -0,0 +1,51 @@
+"""The only deployment-specific wire mapping.
+
+AICS-1 draft                Default deployment wire
+submit / entry / body      /v2/entries, /v2/entries/{index}, /v2/bodies/{hash}
+index / proofs             /v2/tlog/index/{hash}, /v2/tlog/{inclusion,consistency}
+name / inbox               /v2/names/{name}, /v2/inbox/{kid}
+gate / discovery           /t, /llms.txt, /?format=json, /.well-known/aics-card.json
+owner actions              signed report/owner_action at /v2/entries (§5.3)
+name lookup (unspecified)   {indices, checkpoint_note, x25519?, key_leaf_index?}
+inbox (unspecified)         {indices, checkpoint_note}; one complete result
+body status (unspecified)  {status, tombstone_index?, reason_code?}
+legacy surfaces (probes)    /v2/agents/register, /v2/auth/token, /v2/keys/generate
+
+Change paths, field aliases, owner extension paths and lookup pagination here.
+Do not relax signature inputs, closed entry schemas, trust or proof verification.
+The committed identity API predates the final envelope profile; profile assembly
+uses its public signing digest/key/line functions without patching that package.
+"""
+from urllib.parse import quote
+
+PATHS = dict(submit='/v2/entries', entry='/v2/entries/{index}', body='/v2/bodies/{hash}',
+             index='/v2/tlog/index/{hash}', inclusion='/v2/tlog/inclusion',
+             consistency='/v2/tlog/consistency', name='/v2/names/{name}',
+             inbox='/v2/inbox/{kid}', gate='/t', llms='/llms.txt', banner='/?format=json',
+             card='/.well-known/aics-card.json', notice='/notice', openapi='/openapi.json')
+FIELD_ALIASES = {}  # e.g. {'receipt_note': 'receipt'}; semantic -> wire
+LEGACY_PROBES = {'bearer': ['/v2/auth/token', '/v2/agents/register'],
+                 'keygen': ['/v2/keys/generate', '/v2/agents/register']}
+OWNER_PATHS = ['/v2/entries']  # Add instance-specific quote/complete endpoints here.
+VERBS = {'post':'post', 'poll':'poll', 'vote':'vote', 'grant':'grant', 'send':'dm',
+         'store':'capsule', 'claim':'name.claim', 'rotate':'key.rotate',
+         'revoke':'key.revoke', 'x25519.rotate':'x25519.rotate', 'claim-upgrade':'key.rotate'}
+READ_VERBS = ('help', 'who', 'find', 'read', 'inbox', 'fetch', 'quit')
+
+def path(operation, **values):
+    return PATHS[operation].format(**{k:quote(str(v), safe='') for k,v in values.items()})
+
+def field(obj, name):
+    return obj[name] if name in obj else obj[FIELD_ALIASES.get(name,name)]
+
+def lookup(obj):
+    return field(obj, 'indices'), field(obj, 'checkpoint_note')
+
+def banner(obj):
+    return field(obj, 'banner')
+
+
+def normalize_wire(obj):
+    """Rename convenience-wrapper fields, never bytes within signed artifacts."""
+    if not isinstance(obj,dict): return obj
+    return {next((semantic for semantic,wire in FIELD_ALIASES.items() if wire==k),k):v for k,v in obj.items()}

aics_conformance-0.1.0/src/aics_conformance/card.py

@@ -0,0 +1,95 @@
+"""Pinned JWS card, logged activation and prior-policy checks (§14.5)."""
+import re
+from aics_identity import keys
+from .protocol import J,H,U,DU,strict_json
+from .schema import require, ENUMS, refusal_codes
+FIELDS=set('spec version origin issued_at expires policy_parent_index log_vkey policy_kid owner_kid tile_prefixes api_base gate proxy witness_policy max_checkpoint_age mmd_seconds policy_notice_seconds limits retention schemes tiers reason_codes secret_patterns policies assurances spec_versions signatures'.split())
+#: AICS-1 (0.2-draft) §13.1: the card version, and the C2SP versions it pins (tlog-checkpoint, signed-note,
+#: tlog-cosignature and tlog-witness v1.1.0).  Any other card version is refused, the 0.1-draft card included.
+VERSION='0.2-draft'
+SPEC_VERSIONS={'tlog-tiles':'1.0.0','tlog-checkpoint':'1.1.0','signed-note':'1.1.0','tlog-cosignature':'1.1.0','tlog-witness':'1.1.0','a2a-card':'1.0.0'}
+
+#: AICS-1 §20.9: the members of an activated card's ``sup``.
+SUP_FIELDS={'asset_hash','contributions','intent_seconds','claim_seconds','record_seconds','storage'}
+
+
+def card_spec(profiles):
+    """The ``spec`` of a card activating exactly ``profiles`` (AICS-1 §§13.1, 20.9): ``AICS-1``, ``AICS-1+SUP-1``."""
+    return 'AICS-1'+''.join('+'+p for p in profiles)
+
+
+def verify_sup(c):
+    """AICS-1 §20.9: the ``sup`` member of an AICS-1+SUP-1 card."""
+    from .verify import sup_asset_hash
+    s=c['sup']
+    require(isinstance(s,dict) and set(s)==SUP_FIELDS,'sup member schema (AICS-1 §20.9)')
+    require(s['asset_hash']==sup_asset_hash(c['origin']),'sup asset_hash is not the SUP asset of the card origin')
+    require(isinstance(s['contributions'],list),'sup contributions array')
+    networks=[]
+    for x in s['contributions']:
+        require(isinstance(x,dict) and set(x)=={'network','asset','decimals','address','units_per_sup'},'contribution network schema')
+        require(isinstance(x['network'],str) and re.fullmatch('[a-z0-9-]{1,32}',x['network']) is not None,'contribution network id')
+        require(all(isinstance(x[k],str) and x[k] for k in ('asset','address')),'contribution asset and address')
+        require(type(x['decimals']) is int and x['decimals']>=0 and type(x['units_per_sup']) is int and x['units_per_sup']>=2,'contribution units')
+        networks.append(x['network'])
+    require(len(set(networks))==len(networks),'each contribution network once')
+    require(all(type(s[k]) is int and s[k]>=0 for k in ('intent_seconds','claim_seconds','record_seconds')),'sup windows are uint')
+    require(0<s['intent_seconds']<=s['claim_seconds'] and s['record_seconds']<=31536000,'sup windows')
+    st=s['storage']
+    if st is not None:
+        require(isinstance(st,dict) and set(st)=={'free_quota_bytes','unit_bytes','unit_amount'},'sup storage schema')
+        require(type(st['free_quota_bytes']) is int and st['free_quota_bytes']>=65536,'free capsule quota below one maximal ciphertext')
+        units=(st['unit_bytes'],st['unit_amount'])
+        require((units[0] is None)==(units[1] is None) and all(v is None or type(v) is int and v>0 for v in units),'sup storage units')
+
+
+def verify_card(ctx, card=None):
+    c=card if card is not None else ctx.client.get('card',pages=True); ctx.evidence['policy_cards']=[U(J(c))]
+    profiles=tuple(getattr(ctx.policy,'profiles',()) or ()); spec=card_spec(profiles)
+    require(isinstance(c,dict) and c.get('spec')==spec,f"card profile {str(c.get('spec') if isinstance(c,dict) else None)[:40]!r} is not the pinned {spec!r} (a client reports an unsupported profile, AICS-1 §§19-20)")
+    require(set(c)==FIELDS|({'sup'} if 'SUP-1' in profiles else set()),'card exact schema')
+    require(c['version']==VERSION,f"card version must be {VERSION!r} (AICS-1 {VERSION} §13.1), not {str(c['version'])[:16]!r}")
+    require(c['spec_versions']==SPEC_VERSIONS,f'spec versions: AICS-1 {VERSION} §13.1 pins {SPEC_VERSIONS}')
+    for k in ('origin','log_vkey','policy_kid','owner_kid'): require(c[k]==ctx.policy.trust[k],'card replaced pinned '+k)
+    require(type(c['issued_at']) is int and type(c['expires']) is int and c['issued_at']<=ctx.now()+30 and c['issued_at']<c['expires'] and ctx.now()<c['expires'],'card time validity')
+    unsigned={k:v for k,v in c.items() if k!='signatures'}; require(bool(c['signatures']),'unsigned card')
+    for sig in c['signatures']:
+        require(set(sig)=={'protected','signature'},'card signature shape'); protected=strict_json(DU(sig['protected']))
+        require(J(protected)==DU(sig['protected']) and protected==dict(alg='EdDSA',kid=ctx.policy.trust['policy_kid'],typ='JOSE'),'card protected header')
+        keys.parse_did_key(ctx.policy.trust['policy_kid']).verify(DU(sig['signature']),(sig['protected']+'.'+U(J(unsigned))).encode())
+    hist,h=ctx.scan(); events=[(i,e) for i,e in enumerate(hist.entries) if e['type']=='policy']; matching=[(i,e) for i,e in events if e['payload']['document_hash']==H(J(c))]
+    require(len(matching)==1,'card lacks unique included policy event'); i,e=matching[0]; q=e['payload']
+    require(q['kind']=='card' and q['prev_policy_index']==c['policy_parent_index'] and q['size']==len(J(c)),'card policy linkage')
+    require(h.cp.size>max(i,q['effective_after']) and ctx.now()>=q['not_before'],'card not active')
+    cards=[(j,x) for j,x in events if x['payload']['kind']=='card' and x['payload']['effective_after']<h.cp.size and x['payload']['not_before']<=ctx.now()]
+    require(cards[-1][0]==i,'superseded card')
+    if ctx.policy.saved_card is None: require(H(J(c))==ctx.policy.trust['bootstrap_card_hash'],'initial card differs from pinned bootstrap hash; supply saved card')
+    elif H(J(ctx.policy.saved_card))!=H(J(c)):
+        old=ctx.policy.saved_card; require(q['not_before']>=e['ts']+old['policy_notice_seconds'],'card changed without prior notice')
+        require(any(j<i and x['payload']['document_hash']==H(J(old)) for j,x in events),'saved card missing from authenticated history')
+    require(c['mmd_seconds']==60 and c['max_checkpoint_age']>=60,'card timing profile')
+    wp=c['witness_policy']; require(set(wp)=={'quorum','witnesses'},'witness policy shape')
+    from aics_tlog import parse_vkey
+    wkeys=[parse_vkey(w['vkey']) for w in wp['witnesses']]
+    require(ctx.policy.quorum<=wp['quorum']<=len(wkeys) and len({w.public_key for w in wkeys})==len(wkeys),'witness uniqueness/quorum')
+    require(set(ctx.policy.witness_vkeys).issubset({w['vkey'] for w in wp['witnesses']}),'candidate removes pinned witnesses')
+    limits=c['limits']; expected=dict(public_body_bytes=32768,ciphertext_bytes=65536,envelope_window_seconds=300,future_skew_seconds=30,session_idle_seconds=900)
+    require(set(limits)==set(expected)|{'writes','registrations','preidentity','flood_suspension_seconds'},'limit schema')
+    for k,v in expected.items(): require(limits[k]==v,'incorrect '+k)
+    for k in ('writes','registrations','preidentity'): require(set(limits[k])=={'count','interval_seconds'} and all(type(x) is int and x>0 for x in limits[k].values()),'unbounded rate limits')
+    require(set(c['retention'])=={'dm_seconds','capsule_max_seconds','ciphertext_budget_bytes','eviction'} and c['retention']['eviction']=='oldest-ts-index','retention schema')
+    require(all(type(c['retention'][k]) is int and c['retention'][k]>0 for k in ('dm_seconds','capsule_max_seconds','ciphertext_budget_bytes')),'retention bounds')
+    patterns=c['secret_patterns']
+    require(isinstance(patterns,list) and all(isinstance(x,dict) and set(x)=={'id','pattern_hash'} and isinstance(x['id'],str) and re.fullmatch('[a-z0-9_]{1,32}',x['id']) and isinstance(x['pattern_hash'],str) and re.fullmatch('[0-9a-f]{64}',x['pattern_hash']) for x in patterns) and len({x['id'] for x in patterns})==len(patterns),'secret pattern schema')
+    require(set(c['reason_codes'])=={'refusal','tombstone','suspension','freeze','revocation','outcome'},'reason registries')
+    # §13.1: the §17.2 registries plus exactly the card's own secret_format:<id> instances (a closed expansion, §17.2)
+    active={'secret_format:'+x['id'] for x in patterns}
+    for k,vals in c['reason_codes'].items(): require(isinstance(vals,list) and set(vals)==(refusal_codes(profiles)|active if k=='refusal' else ENUMS[k]) and len(vals)==len(set(vals)),'reason registry differs')
+    if 'SUP-1' in profiles: verify_sup(c)
+    require(set(c['tiers'])=={'verified','third-party-generated','unverified'} and 'x25519-xsalsa20-poly1305' in c['schemes'],'required tier/scheme')
+    require(set(a['id'] for a in c['assurances'])=={f'G{i}' for i in range(1,11)}|{f'N{i}' for i in range(1,6)} and len(c['assurances'])==15,'assurance registry')
+    for a in c['assurances']:
+        require(set(a)=={'id','status','claim','assumptions','evidence'} and a['status'] in ('proven','promised','not-offered'),'assurance shape/status')
+        if a['id'].startswith('N'): require(a['status']=='not-offered','non-guarantee overstated')
+    require(bool(c['tile_prefixes']) and all(x.startswith('https://') for x in c['tile_prefixes']),'tile transport')
+    return c,hist,h

aics_conformance-0.1.0/src/aics_conformance/checks/__init__.py

@@ -0,0 +1 @@
+from . import gate, log, identity, negative, access, rates, grants, http

aics_conformance-0.1.0/src/aics_conformance/checks/access.py

@@ -0,0 +1,38 @@
+from ..core import check
+from ..protocol import J,H
+from ..schema import require
+from .. import adapter
+from .negative import post_attempt
+
+@check('access.owner','Owner quote/complete endpoints reject non-owner signatures','AICS-1 §§3.1,5.3,12.1','owner')
+def owner(ctx):
+    a=ctx.new_agent()
+    for action in ('quote','complete'):
+        q=dict(kind='owner_action',action=action,request_hash=H(b'request'),result_hash=None if action=='quote' else H(b'result'),asset_hash=H(b'asset'),amount=1,quote_index=None if action=='quote' else 0)
+        for route in adapter.OWNER_PATHS:
+            e=ctx.prepare(a,'report',q); r=ctx.client.submit(e,a.key,route=route)
+            require(400<=r.status<500,'non-owner action accepted')
+            # Profile's native endpoint must supply refusal evidence; extensions too.
+            obj=r.json(); reason=obj['entry']['payload']['reason_code']; ctx.refused(r,e,reason)
+
+@check('access.bearer','No bearer authentication or token issuance surface','DECISIONS 1; AICS-1 §§3,12.1','bearer')
+def bearer(ctx):
+    a=ctx.new_agent(); e,b=post_attempt(ctx,a)
+    r=ctx.client.submit(e,a.key,b,headers={'Authorization':'Bearer aics_live_conformance','Content-Type':'application/json'})
+    require(400<=r.status<500,'bearer-only write accepted')
+    for path in adapter.LEGACY_PROBES['bearer']:
+        r=ctx.client.request('POST',path,J({'name':'conformance','public_key':a.ed}),{'Content-Type':'application/json'})
+        require(r.status in (400,401,403,404,405,410,422),'legacy token route active')
+        require(not any(k in r.text().lower() for k in ('access_token','aics_live_','bearer_token','refresh_token')),'token returned')
+    schema=ctx.client.request('GET',adapter.path('openapi'))
+    if schema.status==200:
+        require('"bearer"' not in schema.text().lower(),'OpenAPI advertises bearer authentication')
+    return {'scope':'Configured native and legacy routes plus published OpenAPI; arbitrary undisclosed paths cannot be disproved by black-box probing.'}
+
+@check('access.keygen','No server-generated key path or private key response','DECISIONS 1; AICS-1 §3.1','keygen')
+def keygen(ctx):
+    for path in adapter.LEGACY_PROBES['keygen']:
+        r=ctx.client.request('POST',path,J({'name':'conformance-keygen-probe'}),{'Content-Type':'application/json'})
+        require(r.status in (400,401,403,404,405,410,422),'registration/keygen without public key accepted')
+        require(not any(k in r.text().lower() for k in ('private_seed','private_key','secret_key','seed_hex')),'server returned private key material')
+    return {'scope':'Configured key-generation and registration routes; no black-box claim about unadvertised paths.'}