bluefox-edge 0.0.1__tar.gz

bluefox_edge-0.0.1/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Format Dynamics, Inc. (DBA BlueFox)
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

bluefox_edge-0.0.1/PKG-INFO

@@ -0,0 +1,76 @@
+Metadata-Version: 2.4
+Name: bluefox-edge
+Version: 0.0.1
+Summary: BlueFox Edge for Python: today, the published offline receipt checker as an installable module; the API client follows.
+Author-email: BlueFox AI <ethan@bluefoxedge.ai>
+License: MIT
+Project-URL: Homepage, https://www.bluefoxedge.ai
+Project-URL: Documentation, https://www.bluefoxedge.ai/docs/sdk/python
+Project-URL: Verify a receipt, https://www.bluefoxedge.ai/docs/verify-a-receipt
+Project-URL: Published checker, https://api.bluefoxedge.ai/verify_receipt.py
+Project-URL: Repository, https://github.com/ethanholien/bluefox-edge
+Keywords: bluefox,receipt,verification,ed25519,rfc8785,jcs,offline,agents
+Classifier: Development Status :: 2 - Pre-Alpha
+Classifier: Intended Audience :: Developers
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3 :: Only
+Classifier: Operating System :: OS Independent
+Classifier: Topic :: Security :: Cryptography
+Requires-Python: >=3.8
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Dynamic: license-file
+
+<!-- DRAFT-FOR-CEO-REVIEW · staged dark by ff115 (SS115/D006) · NOT PUBLISHED · every sentence below is proposed public text -->
+# bluefox-edge (Python)
+
+**0.0.1 — a first, small, genuine release.** It installs the published BlueFox Edge
+offline receipt checker so you can pin it with pip instead of fetching a file:
+
+```bash
+pip install bluefox-edge
+bluefox-edge-verify-receipt my-receipt.json
+```
+
+That command runs the exact bytes served at
+<https://api.bluefoxedge.ai/verify_receipt.py> (sha256 `50dd2124…711d8`, 24,801 B —
+compare with <https://api.bluefoxedge.ai/verify_receipt.py.sha256> any time). Same
+steps, same order, same one-sentence verdicts. Exit 0 means the check passed.
+
+## What it checks
+
+A BlueFox Edge receipt is a signed record of one API answer: the envelope is
+canonicalized (RFC 8785 / JCS), hashed (SHA-256), chained, and signed (Ed25519) with a
+published key. The checker recomputes every signed field from the file's own bytes and
+refuses — in a sentence, never a traceback — on any disagreement. It reads the key set
+from the published JWKS, or fully offline from a file you saved:
+
+```bash
+curl -sSo pinned-jwks.json https://api.bluefoxedge.ai/.well-known/jwks.json
+bluefox-edge-verify-receipt --jwks pinned-jwks.json my-receipt.json
+```
+
+The receipt never names its own key source; the `--jwks` flag is the operator's hand.
+How to read what a receipt does and does not say: <https://www.bluefoxedge.ai/docs/verify-a-receipt>.
+
+## What is coming
+
+The BlueFox Edge API client for Python (`BlueFoxClient`, sync and async) is written and
+tested in the repository at version 0.6.0. It arrives on PyPI under this name once its
+handling of the keyless x402 payment quote (HTTP 402) is cured — until then a 0.0.x
+release does not talk to the API for you. Docs: <https://www.bluefoxedge.ai/docs/sdk/python>.
+
+## Why a 0.0.1 at all
+
+Fifteen files in the repository and both SDK READMEs already print
+`pip install bluefox-edge`. Publishing a real, working checker under the name closes
+the gap between what the docs say and what the registry has, without pretending the
+client is here.
+
+## Also on npm
+
+The JavaScript twin of the checker is `npx bluefox-verify-receipt`, and `bluefox-edge`
+on npm re-exports it.
+
+License: MIT. Author: BlueFox AI (Format Dynamics, Inc.).

bluefox_edge-0.0.1/README.md

@@ -0,0 +1,52 @@
+<!-- DRAFT-FOR-CEO-REVIEW · staged dark by ff115 (SS115/D006) · NOT PUBLISHED · every sentence below is proposed public text -->
+# bluefox-edge (Python)
+
+**0.0.1 — a first, small, genuine release.** It installs the published BlueFox Edge
+offline receipt checker so you can pin it with pip instead of fetching a file:
+
+```bash
+pip install bluefox-edge
+bluefox-edge-verify-receipt my-receipt.json
+```
+
+That command runs the exact bytes served at
+<https://api.bluefoxedge.ai/verify_receipt.py> (sha256 `50dd2124…711d8`, 24,801 B —
+compare with <https://api.bluefoxedge.ai/verify_receipt.py.sha256> any time). Same
+steps, same order, same one-sentence verdicts. Exit 0 means the check passed.
+
+## What it checks
+
+A BlueFox Edge receipt is a signed record of one API answer: the envelope is
+canonicalized (RFC 8785 / JCS), hashed (SHA-256), chained, and signed (Ed25519) with a
+published key. The checker recomputes every signed field from the file's own bytes and
+refuses — in a sentence, never a traceback — on any disagreement. It reads the key set
+from the published JWKS, or fully offline from a file you saved:
+
+```bash
+curl -sSo pinned-jwks.json https://api.bluefoxedge.ai/.well-known/jwks.json
+bluefox-edge-verify-receipt --jwks pinned-jwks.json my-receipt.json
+```
+
+The receipt never names its own key source; the `--jwks` flag is the operator's hand.
+How to read what a receipt does and does not say: <https://www.bluefoxedge.ai/docs/verify-a-receipt>.
+
+## What is coming
+
+The BlueFox Edge API client for Python (`BlueFoxClient`, sync and async) is written and
+tested in the repository at version 0.6.0. It arrives on PyPI under this name once its
+handling of the keyless x402 payment quote (HTTP 402) is cured — until then a 0.0.x
+release does not talk to the API for you. Docs: <https://www.bluefoxedge.ai/docs/sdk/python>.
+
+## Why a 0.0.1 at all
+
+Fifteen files in the repository and both SDK READMEs already print
+`pip install bluefox-edge`. Publishing a real, working checker under the name closes
+the gap between what the docs say and what the registry has, without pretending the
+client is here.
+
+## Also on npm
+
+The JavaScript twin of the checker is `npx bluefox-verify-receipt`, and `bluefox-edge`
+on npm re-exports it.
+
+License: MIT. Author: BlueFox AI (Format Dynamics, Inc.).

bluefox_edge-0.0.1/pyproject.toml

@@ -0,0 +1,39 @@
+# DRAFT-FOR-CEO-REVIEW -- staged dark by ff115 (SS115/D006), NOT published. Every public-facing string in this
+# file and in README.md is a proposal for the CEO's review before any claim ceremony.
+[build-system]
+requires = ["setuptools>=68.0", "wheel"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "bluefox-edge"
+version = "0.0.1"
+description = "BlueFox Edge for Python: today, the published offline receipt checker as an installable module; the API client follows."
+readme = "README.md"
+license = {text = "MIT"}
+requires-python = ">=3.8"
+authors = [{name = "BlueFox AI", email = "ethan@bluefoxedge.ai"}]
+keywords = ["bluefox", "receipt", "verification", "ed25519", "rfc8785", "jcs", "offline", "agents"]
+classifiers = [
+    "Development Status :: 2 - Pre-Alpha",
+    "Intended Audience :: Developers",
+    "License :: OSI Approved :: MIT License",
+    "Programming Language :: Python :: 3",
+    "Programming Language :: Python :: 3 :: Only",
+    "Operating System :: OS Independent",
+    "Topic :: Security :: Cryptography",
+]
+dependencies = []
+
+[project.urls]
+Homepage = "https://www.bluefoxedge.ai"
+Documentation = "https://www.bluefoxedge.ai/docs/sdk/python"
+"Verify a receipt" = "https://www.bluefoxedge.ai/docs/verify-a-receipt"
+"Published checker" = "https://api.bluefoxedge.ai/verify_receipt.py"
+Repository = "https://github.com/ethanholien/bluefox-edge"
+
+[project.scripts]
+bluefox-edge-verify-receipt = "bluefox_edge._cli:main"
+
+[tool.setuptools.packages.find]
+where = ["src"]
+include = ["bluefox_edge*"]

bluefox_edge-0.0.1/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+

bluefox_edge-0.0.1/src/bluefox_edge/__init__.py

@@ -0,0 +1,43 @@
+"""bluefox-edge 0.0.1 -- DRAFT-FOR-CEO-REVIEW, staged dark, not published.
+
+What this release IS: the published BlueFox Edge offline receipt checker
+(https://api.bluefoxedge.ai/verify_receipt.py), shipped byte-for-byte as
+``bluefox_edge.verify_receipt`` so it can be pip-installed and pinned instead of
+fetched. Run it as ``bluefox-edge-verify-receipt <receipt.json>`` or
+``python -m bluefox_edge.verify_receipt <receipt.json>``.
+
+What this release IS NOT: the API client. That client exists in the BlueFox Edge
+repository (sdk/python, version 0.6.0) and lands here under a later version once
+its keyless-402 handling is cured. Nothing in 0.0.x talks to the API on your
+behalf; the checker only fetches the published key set, and ``--jwks`` makes even
+that offline.
+"""
+import hashlib as _hashlib
+import os as _os
+
+__version__ = "0.0.1"
+
+DOCS_URL = "https://www.bluefoxedge.ai/docs/sdk/python"
+VERIFY_DOCS_URL = "https://www.bluefoxedge.ai/docs/verify-a-receipt"
+PUBLISHED_CHECKER_URL = "https://api.bluefoxedge.ai/verify_receipt.py"
+JWKS_URL = "https://api.bluefoxedge.ai/.well-known/jwks.json"
+
+#: sha256 of the checker bytes vendored in this release -- the same bytes the
+#: street served at PUBLISHED_CHECKER_URL on 2026-09-12 (24,801 B).
+CHECKER_SHA256 = "50dd2124e8023cd7e7a3d83bccfab8627b645d83f785e082fa1edf38373711d8"
+
+
+def checker_path():
+    """Absolute path of the vendored checker file."""
+    return _os.path.join(_os.path.dirname(__file__), "verify_receipt.py")
+
+
+def checker_sha256():
+    """sha256 of the vendored checker as installed -- compare with CHECKER_SHA256 and
+    with https://api.bluefoxedge.ai/verify_receipt.py.sha256 before you trust it."""
+    with open(checker_path(), "rb") as f:
+        return _hashlib.sha256(f.read()).hexdigest()
+
+
+__all__ = ["__version__", "DOCS_URL", "VERIFY_DOCS_URL", "PUBLISHED_CHECKER_URL",
+           "JWKS_URL", "CHECKER_SHA256", "checker_path", "checker_sha256"]

bluefox_edge-0.0.1/src/bluefox_edge/_cli.py

@@ -0,0 +1,27 @@
+"""Console entry for ``bluefox-edge-verify-receipt``.
+
+The vendored checker is a script, not a library: it reads ``sys.argv`` at import and
+exits with a one-sentence verdict. Running it through ``runpy`` keeps the served bytes
+untouched (so its sha256 stays comparable with the street's) while giving pip users
+a command on PATH.
+"""
+import runpy
+import sys
+
+
+def main(argv=None):
+    if argv is None:
+        argv = sys.argv[1:]
+    if argv and argv[0] in ("-h", "--help"):
+        print("usage: bluefox-edge-verify-receipt [--jwks KEYS.json|https://...] [RECEIPT.json]\n"
+              "Checks a BlueFox Edge signed receipt. With no file it checks ./specimen-receipt.json.\n"
+              "Exit 0 = the check passes; any other exit prints one sentence saying why not.\n"
+              "Same bytes as https://api.bluefoxedge.ai/verify_receipt.py (see bluefox_edge.CHECKER_SHA256).")
+        return 0
+    sys.argv = ["verify_receipt.py"] + list(argv)
+    runpy.run_module("bluefox_edge.verify_receipt", run_name="__main__", alter_sys=True)
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

bluefox_edge-0.0.1/src/bluefox_edge/verify_receipt.py

@@ -0,0 +1,501 @@
+import base64, hashlib, json, sys, urllib.request
+
+# DEPENDENCIES: none. Python 3.8+ standard library only. If the third-party
+# cryptography package happens to be installed, its Ed25519 verifier is used;
+# otherwise the self-contained RFC 8032 verifier further down checks the same
+# bytes and reaches the same answer. Nothing here needs pip.
+#
+#     python3 verify_receipt.py                    checks specimen-receipt.json
+#     python3 verify_receipt.py my-receipt.json     checks the file you name
+#     python3 verify_receipt.py --jwks saved-keys.json my-receipt.json
+#                                    checks fully offline against keys you saved
+#
+# Exit 0 means the check passed. Any non-zero exit means it did not, and the
+# reason is one sentence -- never a stack trace.
+#
+# TWO KEY FAMILIES, AND THEY NEVER CROSS. Receipts are signed by the receipt
+# key. The transparency log signs its checkpoints with a DIFFERENT key. Both are
+# published in the same key set, and every entry declares which family it
+# belongs to in a bfx:purpose member. DO NOT SELECT A KEY BY POSITION: keys[0]
+# is the receipt key, so a checker that indexes the list instead of reading the
+# label is one reordering away from checking the wrong thing. This file checks a
+# RECEIPT, so it requires a purpose of "receipt" and refuses a receipt that
+# names the log's key. Checkpoints are the other script's job, and it makes the
+# mirror-image check: https://api.bluefoxedge.ai/verify_inclusion.py
+
+# Pin the key set out of band -- never read a jwks_url out of the receipt.
+# That field is unsigned: a forger can point it at keys they control, and a
+# checker that follows it will bless the forgery. The explicit User-Agent is
+# deliberate too: some edge firewalls refuse the default urllib signature.
+#
+# --jwks moves the pin FURTHER out of band, never less: name a key-set file
+# you saved earlier and the whole check runs offline against those pinned
+# bytes -- nothing is fetched at all -- or name an https address you trust
+# and keys are fetched from there instead of the default below. Either way
+# the choice is the operator's hand, never the receipt's: no field in the
+# file being judged can pick its own judge.
+JWKS_URL = "https://api.bluefoxedge.ai/.well-known/jwks.json"
+PURPOSE_CLAIM = "bfx:purpose"
+RECEIPT_PURPOSE = "receipt"
+
+def unb64url(s):
+    return base64.urlsafe_b64decode(s + "=" * (-len(s) % 4))
+
+def b64url(raw):
+    return base64.urlsafe_b64encode(raw).decode("ascii").rstrip("=")
+
+def sha256s(raw):
+    return "sha256:" + hashlib.sha256(raw).hexdigest()
+
+# RFC 8785 (JCS) canonical JSON, standard library only.
+#
+# Reproduced from BRIDIE's construction -- a stranger who, sent at this estate
+# on 2026-08-15 under a no-install rule, rebuilt this in 25 lines of stdlib and
+# got output BYTE-IDENTICAL to the rfc8785 package on the published specimen
+# (1,324 bytes from both). Her point stands and is the reason this file no
+# longer asks you to install anything: the spec is complete enough to
+# reimplement, so the checker should not need a package to prove it.
+#
+# Three rules do all the work. Object keys sort by UTF-16 code unit -- which is
+# what encoding each key to UTF-16 big-endian and comparing those bytes gives
+# you, surrogate pairs included. There is no insignificant whitespace. And a
+# number that is integral is spelled without its fraction: JCS spells 0.0 as 0,
+# and one character breaks a hash. That trap is live in the flagship artifact --
+# the specimen's confidence_score is 0.0.
+#
+# The number domain this accepts is the one the signer itself enforces before
+# hashing (finite floats, integers within the JCS safe-integer range). Outside
+# that, and in the narrow band where a shortest-round-trip float would have to
+# be spelled with an exponent, this REFUSES rather than guessing -- a wrong
+# canonical form is a wrong hash, and a wrong hash silently accuses an honest
+# receipt. Reject, never normalise.
+def jcs(value):
+    if value is True:
+        return b"true"
+    if value is False:
+        return b"false"
+    if value is None:
+        return b"null"
+    if isinstance(value, str):
+        try:
+            return json.dumps(value, ensure_ascii=False,
+                              separators=(",", ":")).encode("utf-8")
+        except UnicodeEncodeError:
+            raise SystemExit("this receipt carries text that is not encodable as "
+                             "UTF-8 (a lone surrogate) -- it cannot be canonicalised")
+    if isinstance(value, int):
+        if abs(value) > 2 ** 53 - 1:
+            raise SystemExit("this receipt carries an integer outside the JCS "
+                             "safe-integer range -- refusing rather than hashing a "
+                             "value two implementations would spell differently")
+        return repr(value).encode("ascii")
+    if isinstance(value, float):
+        if value != value or value in (float("inf"), float("-inf")):
+            raise SystemExit("this receipt carries a non-finite number, which has "
+                             "no JSON canonical form")
+        text = repr(value)
+        if "e" in text or "E" in text:
+            raise SystemExit("this receipt carries a number whose canonical "
+                             "spelling needs an exponent, which this stdlib "
+                             "canonicaliser does not attempt -- refusing rather "
+                             "than risking a wrong hash")
+        if value.is_integer():
+            return repr(int(value)).encode("ascii")
+        return text.encode("ascii")
+    if isinstance(value, list):
+        return b"[" + b",".join(jcs(item) for item in value) + b"]"
+    if isinstance(value, dict):
+        pairs = []
+        for key in sorted(value, key=lambda k: k.encode("utf-16-be")):
+            if not isinstance(key, str):
+                raise SystemExit("this receipt has a non-text object key -- it is "
+                                 "not canonicalisable JSON")
+            pairs.append(jcs(key) + b":" + jcs(value[key]))
+        return b"{" + b",".join(pairs) + b"}"
+    raise SystemExit("this receipt carries a value of a kind JSON has no "
+                     "canonical form for -- it is not a receipt this recipe checks")
+
+def copies(node, key):  # every value a receipt's own subtree carries under key
+    if isinstance(node, dict):
+        for k, v in node.items():
+            if k == key:
+                yield v
+            yield from copies(v, key)
+    elif isinstance(node, list):
+        for item in node:
+            yield from copies(item, key)
+
+# The file to check: the one you name, or the published specimen if you name
+# nothing. Every way this can go wrong below is a sentence and a non-zero exit,
+# because handing a stranger a traceback for a missing file is not a verdict --
+# it is the vendor's stack frames in place of an answer. Flag parsing is spelled
+# out rather than imported: argparse prints its own usage paragraphs and exits 2,
+# and this file's contract is one sentence and its own exit, every time.
+jwks_source = None
+names = []
+args = list(sys.argv[1:])
+while args:
+    arg = args.pop(0)
+    if arg == "--jwks" or arg.startswith("--jwks="):
+        if jwks_source is not None:
+            raise SystemExit("--jwks is named twice -- one verdict means one "
+                             "pinned key set, so name exactly one")
+        if arg == "--jwks":
+            value = args.pop(0) if args else ""
+        else:
+            value = arg[len("--jwks="):]
+        if not value:
+            raise SystemExit("--jwks needs a value -- the path of a key-set "
+                             "file you saved earlier, or an https address to "
+                             "fetch the keys from")
+        jwks_source = value
+    else:
+        names.append(arg)
+if len(names) > 1:
+    raise SystemExit("usage: python3 verify_receipt.py [PATH-TO-RECEIPT.json] -- "
+                     "one file at a time, so one verdict means one receipt")
+path = names[0] if names else "specimen-receipt.json"
+try:
+    with open(path, encoding="utf-8") as handle:
+        specimen = json.load(handle)
+except FileNotFoundError:
+    raise SystemExit("there is no file at " + path + " -- name the receipt you "
+                     "want checked, or save it as specimen-receipt.json and pass "
+                     "nothing")
+except IsADirectoryError:
+    raise SystemExit(path + " is a directory, not a receipt file")
+except PermissionError:
+    raise SystemExit(path + " cannot be read (permission denied)")
+except UnicodeDecodeError:
+    raise SystemExit(path + " is not UTF-8 text, so it is not a receipt this "
+                     "recipe can read")
+except ValueError as exc:
+    raise SystemExit(path + " is not valid JSON (" + str(exc) + ")")
+except OSError as exc:
+    raise SystemExit(path + " could not be read (" + str(exc) + ")")
+if not isinstance(specimen, dict):
+    raise SystemExit(path + " holds a " + type(specimen).__name__ + ", not a JSON "
+                     "object -- a receipt is an object")
+
+# The signed surface is the envelope: the one dict that carries the chain
+# block. Its home differs by door -- data.receipt in an x402 mint response,
+# data.envelope in a read-API response or the published specimen, one per
+# entry of an export bundle -- so this finds it instead of indexing a path.
+#
+# WHICH envelope, when a file offers more than one, is a security question,
+# not a convenience one. Every door here answers with a "data" mapping and
+# puts the envelope inside it, so if the file HAS that mapping, ITS slot
+# decides and nothing found elsewhere in the file can speak for it. That is
+# what stops a doctored receipt at the slot you read from being excused by a
+# genuine envelope tucked somewhere else in the same file. Only a file with no
+# such mapping -- an export bundle, or something you assembled yourself --
+# falls back to searching, and then you are reading whatever the search found:
+# run this once per entry and read each answer. Either way a pass is a
+# statement about ONE envelope, never about the file. And a file that HAS a
+# data block but names no receipt in it is refused outright rather than
+# searched, because that is not a shape any of these doors answers with.
+#
+# Both routes also return the dict CARRYING the envelope -- data, or the entry
+# an envelope was found under -- because that is where the unsigned convenience
+# copies live, and it is the fence that keeps the copy check inside ONE receipt,
+# so a two-receipt bundle never compares entry A's hashes against entry B's.
+# An envelope found directly inside a list has no carrier to name, and then the
+# envelope fences itself: only its own copies are checked.
+def signed(node):
+    chain = node.get("chain") if isinstance(node, dict) else None
+    return isinstance(chain, dict) and "signature" in chain
+
+def slot_in_data(doc):
+    data = doc.get("data") if isinstance(doc, dict) else None
+    if not isinstance(data, dict):
+        return None                       # no data mapping: search, below
+    named = [s for s in ("receipt", "envelope") if s in data]
+    if not named:
+        # A "data" mapping is how these doors answer, so a file that has one
+        # and names no receipt inside it is not a receipt response -- and the
+        # rest of the file does not get to volunteer a substitute.
+        raise SystemExit("this file has a data block with no receipt in it -- "
+                         "refusing to hunt elsewhere for something to check")
+    # From here the file HAS named a receipt, so that name binds and the
+    # search never runs. Naming one and then failing to be one is a refusal,
+    # not a licence to go looking for something else in the file to bless.
+    if len(named) > 1:
+        raise SystemExit("this file fills both data.receipt and data.envelope "
+                         "-- name one receipt, or check them one at a time")
+    slot = named[0]
+    if not signed(data[slot]):
+        raise SystemExit("data." + slot + " is not a signed envelope -- "
+                         "refusing to check something else in its place")
+    return data, data[slot]               # data is the carrier, as below
+
+def find_envelope(node, parent=None):
+    if isinstance(node, dict):
+        if signed(node):
+            return parent, node
+        for child in node.values():
+            hit = find_envelope(child, node)
+            if hit is not None:
+                return hit
+    elif isinstance(node, list):
+        for child in node:
+            hit = find_envelope(child, None)
+            if hit is not None:
+                return hit
+    return None
+
+found = slot_in_data(specimen) or find_envelope(specimen)
+if found is None:
+    raise SystemExit("no signed envelope found -- not a signed receipt (yet?)")
+scope, envelope = found
+if scope is None:
+    scope = envelope
+chain = envelope["chain"]
+
+# Everything the recipe is about to read, present AND of the right kind
+# before it is read. A receipt missing one of these -- or carrying null or a
+# number where text belongs -- is refused in a sentence, never with a
+# traceback: handing a stranger a stack trace is the failure this whole
+# recipe was rewritten to stop. (key_id must only be PRESENT: a keyless
+# receipt carries it as null and reaches its own honest exit further down.)
+def needs(field, home, text=True):
+    if field not in home:
+        raise SystemExit("this envelope has no " + field + " -- it is not a "
+                         "receipt of the shape this recipe checks")
+    if text and not isinstance(home[field], str):
+        raise SystemExit("this envelope's " + field + " is not text -- it is "
+                         "not a receipt of the shape this recipe checks")
+
+needs("chain_prev", chain)
+needs("key_id", chain, text=False)
+needs("schema_version", envelope)
+
+# 1. content_digest recomputes from the envelope's own bytes: sha256 over the
+#    RFC 8785 canonical form of the envelope with the whole chain block
+#    removed. JCS, not json.dumps -- JCS spells 0.0 as 0, and one character
+#    breaks a hash.
+body = {k: v for k, v in envelope.items() if k != "chain"}
+digest = sha256s(jcs(body))
+
+# 2. chain_self recomputes: sha256 over digest|chain_prev|schema_version,
+#    joined with literal pipes, hashed as UTF-8. chain_prev is the previous
+#    receipt's chain_self, or the literal "GENESIS" at a chain head.
+head = sha256s("|".join(
+    (digest, chain["chain_prev"], body["schema_version"])).encode("utf-8"))
+
+# 3. Every copy of the two hashes in THIS receipt's subtree agrees with the
+#    recomputation -- the chain block's and the top-level mirrors' alike.
+#    Presence is checked before agreement: all() is True over an empty
+#    iterator, so a receipt carrying NO copy of a hash would otherwise sail
+#    through this step without it ever being compared to anything. A detected
+#    forgery is a verdict, so it exits in a sentence, never a stack trace.
+for key, want in (("content_digest", digest), ("chain_self", head)):
+    carried = list(copies(scope, key))
+    if not carried:
+        raise SystemExit(key + " is absent -- there is nothing here to check")
+    if not all(got == want for got in carried):
+        raise SystemExit(
+            key + " does not recompute from the receipt's own bytes")
+
+if not chain.get("signature"):
+    raise SystemExit("keyless receipt: steps 1-3 hold, but with key_id and "
+                     "signature null there is no signature to check")
+
+# 4. The signing key is published, and its name is a derived fact:
+#    kid = sha256 of the raw 32-byte Ed25519 public key. The key is selected by
+#    kid and then checked against its declared family -- selecting by kid alone
+#    would let a checkpoint key verify a receipt if the two ever crossed, and
+#    the whole reason there are two keys is that they must not.
+#
+#    With --jwks the same selection runs against the keys YOU pinned. A saved
+#    file is read here with no network at all; an https address you named is
+#    fetched in place of the default. The kid check below is what makes a
+#    pinned file trustworthy to hold: the key's name is derived from the key's
+#    own bytes, so a swapped key cannot keep its old name.
+key_set_word = "published" if jwks_source is None else "pinned"
+if jwks_source is None or jwks_source.startswith("https://"):
+    key_set_url = JWKS_URL if jwks_source is None else jwks_source
+    req = urllib.request.Request(key_set_url, headers={"User-Agent": "bluefox-verify/1"})
+    try:
+        jwks = json.load(urllib.request.urlopen(req, timeout=30))
+    except Exception as exc:
+        raise SystemExit("the " + key_set_word + " key set at " + key_set_url +
+                         " could not be "
+                         "fetched (" + type(exc).__name__ + ") -- this checker will "
+                         "not fall back to any address inside the receipt, so it "
+                         "stops here")
+elif jwks_source.startswith("http://"):
+    raise SystemExit("--jwks " + jwks_source + " is plaintext http -- keys "
+                     "fetched without TLS can be swapped in flight, so save the "
+                     "key set to a file and name that instead, or use https")
+else:
+    try:
+        with open(jwks_source, encoding="utf-8") as handle:
+            jwks = json.load(handle)
+    except FileNotFoundError:
+        raise SystemExit("there is no key-set file at " + jwks_source + " -- "
+                         "save the published keys first (curl -sSo "
+                         "pinned-jwks.json " + JWKS_URL + ") and name that file")
+    except IsADirectoryError:
+        raise SystemExit(jwks_source + " is a directory, not a key-set file")
+    except PermissionError:
+        raise SystemExit(jwks_source + " cannot be read (permission denied)")
+    except UnicodeDecodeError:
+        raise SystemExit(jwks_source + " is not UTF-8 text, so it is not a key "
+                         "set this recipe can read")
+    except ValueError:
+        raise SystemExit(jwks_source + " is not valid JSON, so no key can be "
+                         "pinned from it")
+    except OSError:
+        raise SystemExit(jwks_source + " could not be read, so no key can be "
+                         "pinned from it")
+if not isinstance(jwks, dict) or not isinstance(jwks.get("keys"), list):
+    raise SystemExit("the " + key_set_word + " key set has no keys array, so no "
+                     "key can be pinned")
+key = next((k for k in jwks["keys"]
+            if isinstance(k, dict) and k.get("kid") == chain["key_id"]), None)
+if key is None:
+    if jwks_source is None:
+        raise SystemExit("key_id is not in the published key set")
+    raise SystemExit("key_id is not in the pinned key set at " + jwks_source +
+                     " -- if that copy predates this receipt, refresh it from " +
+                     JWKS_URL + " and pin the new file")
+purpose = key.get(PURPOSE_CLAIM)
+# ABSENT is tolerated on purpose; only a POSITIVE wrong designation refuses.
+# The published set gained bfx:purpose at the 2026-08-18 FIRE, so every key-set
+# file pinned before that day lacks the member -- and the --jwks door exists
+# precisely for files saved earlier. Same philosophy as the settlement lane's
+# network guard: refuse a wrong answer, never punish an absent one. (H98 read
+# the fail-closed suggestion and refuted it against the repo's own genuine
+# 2026-08-08 pinned fixture; a stricter world needs a worded tolerance-sunset.)
+if isinstance(purpose, str) and purpose != RECEIPT_PURPOSE:
+    raise SystemExit("this receipt names the " + key_set_word + " key " + chain["key_id"] +
+                     ", which is designated " + repr(purpose) + " and not a "
+                     "receipt signer -- the two key families never cross, so "
+                     "this is refused rather than verified")
+raw_key = unb64url(key["x"])
+if hashlib.sha256(raw_key).hexdigest() != chain["key_id"]:
+    raise SystemExit("kid is not sha256 of the raw public key")
+
+# 5. The carried signature string is the one canonical spelling of its bytes
+#    (base64url, padding stripped) -- flip even a slack bit and this fails.
+needs("signature", chain)
+try:
+    sig = unb64url(chain["signature"])
+except Exception:
+    raise SystemExit("this envelope's signature is not base64url text -- it "
+                     "is not a receipt of the shape this recipe checks")
+if b64url(sig) != chain["signature"]:
+    raise SystemExit("signature encoding is not canonical")
+
+# Ed25519 verification (RFC 8032), self-contained, so this file runs on a bare
+# Python. You never need to read this block: it is the arithmetic, not the
+# recipe. It is here only so that "no install required" is literally true, and
+# it is skipped entirely when the cryptography package is present.
+P = 2 ** 255 - 19
+L = 2 ** 252 + 27742317777372353535851937790883648493
+
+def inv(x):
+    return pow(x, P - 2, P)
+
+D = (-121665 * inv(121666)) % P
+SQRT_M1 = pow(2, (P - 1) // 4, P)
+
+def x_recover(y):
+    xx = ((y * y - 1) * inv(D * y * y + 1)) % P
+    x = pow(xx, (P + 3) // 8, P)
+    if (x * x - xx) % P != 0:
+        x = (x * SQRT_M1) % P
+    if (x * x - xx) % P != 0:
+        return None
+    return P - x if x % 2 != 0 else x
+
+def point_add(pt1, pt2):
+    x1, y1 = pt1
+    x2, y2 = pt2
+    prod = (D * x1 * x2 * y1 * y2) % P
+    return (((x1 * y2 + x2 * y1) * inv(1 + prod)) % P,
+            ((y1 * y2 + x1 * x2) * inv(1 - prod)) % P)
+
+def scalar_mult(pt, scalar):
+    acc = (0, 1)
+    while scalar > 0:
+        if scalar & 1:
+            acc = point_add(acc, pt)
+        pt = point_add(pt, pt)
+        scalar >>= 1
+    return acc
+
+BASE_Y = (4 * inv(5)) % P
+BASE = (x_recover(BASE_Y), BASE_Y)
+
+def on_curve(pt):
+    x, y = pt
+    return (-x * x + y * y - 1 - D * x * x * y * y) % P == 0
+
+def decode_point(blob):
+    value = int.from_bytes(blob, "little")
+    y = value & ((1 << 255) - 1)
+    sign = value >> 255
+    if y >= P:
+        return None
+    x = x_recover(y)
+    if x is None:
+        return None
+    if x & 1 != sign:
+        x = P - x
+    pt = (x, y)
+    return pt if on_curve(pt) else None
+
+def ed25519_verify_pure(public_raw, signature, message):
+    if len(public_raw) != 32 or len(signature) != 64:
+        return False
+    point_a = decode_point(public_raw)
+    point_r = decode_point(signature[:32])
+    if point_a is None or point_r is None:
+        return False
+    scalar_s = int.from_bytes(signature[32:], "little")
+    if scalar_s >= L:
+        return False
+    challenge = int.from_bytes(
+        hashlib.sha512(signature[:32] + public_raw + message).digest(),
+        "little") % L
+    return scalar_mult(BASE, scalar_s) == point_add(
+        point_r, scalar_mult(point_a, challenge))
+
+def ed25519_verify(public_raw, signature, message):
+    try:
+        from cryptography.hazmat.primitives.asymmetric.ed25519 import (
+            Ed25519PublicKey)
+    except ImportError:
+        return ed25519_verify_pure(public_raw, signature, message)
+    try:
+        Ed25519PublicKey.from_public_bytes(public_raw).verify(signature, message)
+        return True
+    except Exception:
+        return False
+
+# 6. The Ed25519 signature verifies over the RECOMPUTED chain head -- so the
+#    signature commits to every envelope byte hashed in step 1, not merely to
+#    a hash string the file happened to carry. A failure HERE is the verdict
+#    this whole recipe exists to deliver, so it too is a sentence.
+if not ed25519_verify(raw_key, sig, head.encode("utf-8")):
+    raise SystemExit("the signature does not verify over the recomputed chain "
+                     "head -- these are not the bytes the published key signed")
+
+# 7. Unsigned convenience mirrors: the dict carrying the envelope repeats some
+#    signed fields for readers, and nothing above checked those copies -- they
+#    sit outside the signature. Mirrors spell the exact bytes of the envelope's
+#    values (produced_at included: same Z-form, same instant), so a copy that
+#    disagrees is a REFUSAL, not a warning. The signature held -- but the file
+#    in your hand is showing a reader different bytes than the ones it signed,
+#    and a disagreeing mirror is exactly how a doctored copy rides a check
+#    that reads only the envelope. A warning here asked you to notice what
+#    this script exists to notice for you, so it stops instead.
+if scope is not envelope:
+    for key, value in body.items():
+        if key in scope and scope[key] != value:
+            raise SystemExit("unsigned top-level " + key + " does not match the "
+                             "signed envelope's " + key + " -- the signature held, "
+                             "but this file presents altered bytes where a reader "
+                             "reads, and that is a tampered file, not a footnote")
+print("the check passes: every signed field recomputed from the file's own bytes")

bluefox_edge-0.0.1/src/bluefox_edge.egg-info/PKG-INFO

@@ -0,0 +1,76 @@
+Metadata-Version: 2.4
+Name: bluefox-edge
+Version: 0.0.1
+Summary: BlueFox Edge for Python: today, the published offline receipt checker as an installable module; the API client follows.
+Author-email: BlueFox AI <ethan@bluefoxedge.ai>
+License: MIT
+Project-URL: Homepage, https://www.bluefoxedge.ai
+Project-URL: Documentation, https://www.bluefoxedge.ai/docs/sdk/python
+Project-URL: Verify a receipt, https://www.bluefoxedge.ai/docs/verify-a-receipt
+Project-URL: Published checker, https://api.bluefoxedge.ai/verify_receipt.py
+Project-URL: Repository, https://github.com/ethanholien/bluefox-edge
+Keywords: bluefox,receipt,verification,ed25519,rfc8785,jcs,offline,agents
+Classifier: Development Status :: 2 - Pre-Alpha
+Classifier: Intended Audience :: Developers
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3 :: Only
+Classifier: Operating System :: OS Independent
+Classifier: Topic :: Security :: Cryptography
+Requires-Python: >=3.8
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Dynamic: license-file
+
+<!-- DRAFT-FOR-CEO-REVIEW · staged dark by ff115 (SS115/D006) · NOT PUBLISHED · every sentence below is proposed public text -->
+# bluefox-edge (Python)
+
+**0.0.1 — a first, small, genuine release.** It installs the published BlueFox Edge
+offline receipt checker so you can pin it with pip instead of fetching a file:
+
+```bash
+pip install bluefox-edge
+bluefox-edge-verify-receipt my-receipt.json
+```
+
+That command runs the exact bytes served at
+<https://api.bluefoxedge.ai/verify_receipt.py> (sha256 `50dd2124…711d8`, 24,801 B —
+compare with <https://api.bluefoxedge.ai/verify_receipt.py.sha256> any time). Same
+steps, same order, same one-sentence verdicts. Exit 0 means the check passed.
+
+## What it checks
+
+A BlueFox Edge receipt is a signed record of one API answer: the envelope is
+canonicalized (RFC 8785 / JCS), hashed (SHA-256), chained, and signed (Ed25519) with a
+published key. The checker recomputes every signed field from the file's own bytes and
+refuses — in a sentence, never a traceback — on any disagreement. It reads the key set
+from the published JWKS, or fully offline from a file you saved:
+
+```bash
+curl -sSo pinned-jwks.json https://api.bluefoxedge.ai/.well-known/jwks.json
+bluefox-edge-verify-receipt --jwks pinned-jwks.json my-receipt.json
+```
+
+The receipt never names its own key source; the `--jwks` flag is the operator's hand.
+How to read what a receipt does and does not say: <https://www.bluefoxedge.ai/docs/verify-a-receipt>.
+
+## What is coming
+
+The BlueFox Edge API client for Python (`BlueFoxClient`, sync and async) is written and
+tested in the repository at version 0.6.0. It arrives on PyPI under this name once its
+handling of the keyless x402 payment quote (HTTP 402) is cured — until then a 0.0.x
+release does not talk to the API for you. Docs: <https://www.bluefoxedge.ai/docs/sdk/python>.
+
+## Why a 0.0.1 at all
+
+Fifteen files in the repository and both SDK READMEs already print
+`pip install bluefox-edge`. Publishing a real, working checker under the name closes
+the gap between what the docs say and what the registry has, without pretending the
+client is here.
+
+## Also on npm
+
+The JavaScript twin of the checker is `npx bluefox-verify-receipt`, and `bluefox-edge`
+on npm re-exports it.
+
+License: MIT. Author: BlueFox AI (Format Dynamics, Inc.).

bluefox_edge-0.0.1/src/bluefox_edge.egg-info/SOURCES.txt

@@ -0,0 +1,11 @@
+LICENSE
+README.md
+pyproject.toml
+src/bluefox_edge/__init__.py
+src/bluefox_edge/_cli.py
+src/bluefox_edge/verify_receipt.py
+src/bluefox_edge.egg-info/PKG-INFO
+src/bluefox_edge.egg-info/SOURCES.txt
+src/bluefox_edge.egg-info/dependency_links.txt
+src/bluefox_edge.egg-info/entry_points.txt
+src/bluefox_edge.egg-info/top_level.txt

bluefox_edge-0.0.1/src/bluefox_edge.egg-info/dependency_links.txt

@@ -0,0 +1 @@
+

bluefox_edge-0.0.1/src/bluefox_edge.egg-info/entry_points.txt

@@ -0,0 +1,2 @@
+[console_scripts]
+bluefox-edge-verify-receipt = bluefox_edge._cli:main

bluefox_edge-0.0.1/src/bluefox_edge.egg-info/top_level.txt

@@ -0,0 +1 @@
+bluefox_edge