crawlcheck 1.0.1__tar.gz

crawlcheck-1.0.1/PKG-INFO

@@ -0,0 +1,36 @@
+Metadata-Version: 2.4
+Name: crawlcheck
+Version: 1.0.1
+Summary: CrawlCheck client: resolve a domain, get a signed decision for an agent action, verify CrawlCheck evidence offline. No dependencies.
+Author: VSNARY
+License: MIT
+Project-URL: Homepage, https://crawlcheck.io/sdk
+Project-URL: Documentation, https://crawlcheck.io/docs/api
+Requires-Python: >=3.8
+Description-Content-Type: text/markdown
+
+# crawlcheck (Python)
+
+Before your agent reads, cites, connects to or transacts with a domain, ask CrawlCheck. No dependencies; Python 3.8+.
+
+```
+pip install https://crawlcheck.io/sdk/crawlcheck-1.0.1-py3-none-any.whl
+```
+
+```python
+from crawlcheck import CrawlCheck
+
+cc = CrawlCheck()                      # CrawlCheck(key="cc_...") for licensed detail
+answer = cc.resolve("example.com")     # signed ResolveV1: policy, delivery, files, capabilities, entity, freshness, actions
+print(answer["actions"]["read"]["decision"])
+
+receipt = cc.preflight("example.com", action="cite", agent="GPTBot", template="safe_citation")
+print(receipt["decision"], [s["why"] for s in receipt["steps"]])
+assert cc.verify(receipt)["verified"]  # Ed25519, checked locally; the key must be in the published directory
+
+ok, receipt = cc.guard("shop.example", action="transact", confirm=lambda r: input(r["meaning"] + " y/n? ") == "y")
+```
+
+Command line: `python -m crawlcheck preflight example.com cite GPTBot`, `python -m crawlcheck verify receipt.json`.
+
+Decisions: `allow`, `warn`, `require_confirmation`, `block`, `unsupported`. A policy (`max_age_hours`, `on_warn`, `require_entity`, `human_approval`, `allow`, `deny`) can only make a decision stricter.

crawlcheck-1.0.1/README.md

@@ -0,0 +1,25 @@
+# crawlcheck (Python)
+
+Before your agent reads, cites, connects to or transacts with a domain, ask CrawlCheck. No dependencies; Python 3.8+.
+
+```
+pip install https://crawlcheck.io/sdk/crawlcheck-1.0.1-py3-none-any.whl
+```
+
+```python
+from crawlcheck import CrawlCheck
+
+cc = CrawlCheck()                      # CrawlCheck(key="cc_...") for licensed detail
+answer = cc.resolve("example.com")     # signed ResolveV1: policy, delivery, files, capabilities, entity, freshness, actions
+print(answer["actions"]["read"]["decision"])
+
+receipt = cc.preflight("example.com", action="cite", agent="GPTBot", template="safe_citation")
+print(receipt["decision"], [s["why"] for s in receipt["steps"]])
+assert cc.verify(receipt)["verified"]  # Ed25519, checked locally; the key must be in the published directory
+
+ok, receipt = cc.guard("shop.example", action="transact", confirm=lambda r: input(r["meaning"] + " y/n? ") == "y")
+```
+
+Command line: `python -m crawlcheck preflight example.com cite GPTBot`, `python -m crawlcheck verify receipt.json`.
+
+Decisions: `allow`, `warn`, `require_confirmation`, `block`, `unsupported`. A policy (`max_age_hours`, `on_warn`, `require_entity`, `human_approval`, `allow`, `deny`) can only make a decision stricter.

crawlcheck-1.0.1/crawlcheck/__init__.py

@@ -0,0 +1,6 @@
+"""CrawlCheck: resolve a domain, decide an agent action, verify the evidence. https://crawlcheck.io/docs/api"""
+from .client import CrawlCheck, CrawlCheckError, VERSION, ACTIONS
+from .verify import verify_document, canon, key_id
+
+__version__ = VERSION
+__all__ = ["CrawlCheck", "CrawlCheckError", "verify_document", "canon", "key_id", "ACTIONS", "__version__"]

crawlcheck-1.0.1/crawlcheck/__main__.py

@@ -0,0 +1,31 @@
+"""python -m crawlcheck resolve <domain> | preflight <domain> <action> [agent] | verify <file.json>"""
+import json
+import sys
+
+from . import CrawlCheck, verify_document
+
+
+def main(argv=None):
+    a = list(sys.argv[1:] if argv is None else argv)
+    if not a or a[0] not in ("resolve", "preflight", "verify"):
+        print(__doc__)
+        return 2
+    cc = CrawlCheck()
+    if a[0] == "verify":
+        doc = json.load(open(a[1], encoding="utf-8"))
+        r = cc.verify(doc)
+        for c in r["checks"]:
+            print({True: "PASS", False: "FAIL", None: " -- "}[c["ok"]], c["id"].ljust(16), c["why"])
+        return 0 if r["verified"] else 1
+    if a[0] == "resolve":
+        print(json.dumps(cc.resolve(a[1]), indent=1))
+        return 0
+    rc = cc.preflight(a[1], a[2] if len(a) > 2 else "read", a[3] if len(a) > 3 else None)
+    print(rc["decision"], "-", rc.get("meaning"))
+    for s in rc.get("steps", []):
+        print("  ", s["rule"].ljust(26), s["effect"].ljust(20), s["why"])
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

crawlcheck-1.0.1/crawlcheck/_ed25519.py

@@ -0,0 +1,84 @@
+"""Pure-Python Ed25519 signature verification (RFC 8032, section 5.1.7). Verify only; no secret keys are handled."""
+import hashlib
+
+_p = 2 ** 255 - 19
+_q = 2 ** 252 + 27742317777372353535851937790883648493
+_d = -121665 * pow(121666, _p - 2, _p) % _p
+_I = pow(2, (_p - 1) // 4, _p)
+
+
+def _inv(x):
+    return pow(x, _p - 2, _p)
+
+
+def _add(P, Q):
+    A = (P[1] - P[0]) * (Q[1] - Q[0]) % _p
+    B = (P[1] + P[0]) * (Q[1] + Q[0]) % _p
+    C = 2 * P[3] * Q[3] * _d % _p
+    D = 2 * P[2] * Q[2] % _p
+    E, F, G, H = B - A, D - C, D + C, B + A
+    return (E * F % _p, G * H % _p, F * G % _p, E * H % _p)
+
+
+def _mul(s, P):
+    Q = (0, 1, 1, 0)
+    while s > 0:
+        if s & 1:
+            Q = _add(Q, P)
+        P = _add(P, P)
+        s >>= 1
+    return Q
+
+
+def _equal(P, Q):
+    return (P[0] * Q[2] - Q[0] * P[2]) % _p == 0 and (P[1] * Q[2] - Q[1] * P[2]) % _p == 0
+
+
+def _recover_x(y, sign):
+    if y >= _p:
+        return None
+    x2 = (y * y - 1) * _inv(_d * y * y + 1)
+    if x2 == 0:
+        return None if sign else 0
+    x = pow(x2, (_p + 3) // 8, _p)
+    if (x * x - x2) % _p != 0:
+        x = x * _I % _p
+    if (x * x - x2) % _p != 0:
+        return None
+    if (x & 1) != sign:
+        x = _p - x
+    return x
+
+
+_gy = 4 * _inv(5) % _p
+_gx = _recover_x(_gy, 0)
+_G = (_gx, _gy, 1, _gx * _gy % _p)
+
+
+def _decompress(s):
+    if len(s) != 32:
+        return None
+    y = int.from_bytes(s, "little")
+    sign = y >> 255
+    y &= (1 << 255) - 1
+    x = _recover_x(y, sign)
+    if x is None:
+        return None
+    return (x, y, 1, x * y % _p)
+
+
+def verify(public: bytes, msg: bytes, sig: bytes) -> bool:
+    if len(public) != 32 or len(sig) != 64:
+        return False
+    A = _decompress(public)
+    if not A:
+        return False
+    Rs = sig[:32]
+    R = _decompress(Rs)
+    if not R:
+        return False
+    s = int.from_bytes(sig[32:], "little")
+    if s >= _q:
+        return False
+    h = int.from_bytes(hashlib.sha512(Rs + public + msg).digest(), "little") % _q
+    return _equal(_mul(s, _G), _add(R, _mul(h, A)))

crawlcheck-1.0.1/crawlcheck/client.py

@@ -0,0 +1,115 @@
+"""HTTP client for the CrawlCheck API. Standard library only."""
+import json
+import urllib.error
+import urllib.parse
+import urllib.request
+
+from .verify import verify_document, key_id
+
+VERSION = "1.0.1"
+ACTIONS = ("read", "cite", "connect", "transact", "administer")
+
+
+class CrawlCheckError(Exception):
+    def __init__(self, status, body):
+        self.status, self.body = status, body
+        msg = body.get("error") if isinstance(body, dict) else None
+        if not msg and isinstance(body, dict) and body.get("errors"):
+            msg = "; ".join(body["errors"])
+        super().__init__("HTTP %s: %s" % (status, msg or str(body)[:200]))
+
+
+class CrawlCheck:
+    """client = CrawlCheck(key=None)   # a licence key is optional; it unlocks full findings for licensed domains"""
+
+    def __init__(self, key=None, base="https://crawlcheck.io", timeout=30):
+        self.key, self.base, self.timeout = key, base.rstrip("/"), timeout
+        self._kids = None
+
+    def _req(self, method, path, query=None, body=None):
+        url = self.base + path + ("?" + urllib.parse.urlencode({k: v for k, v in (query or {}).items() if v is not None}) if query else "")
+        h = {"user-agent": "crawlcheck-python/" + VERSION, "accept": "application/json"}
+        if self.key:
+            h["x-crawlcheck-key"] = self.key
+        data = None
+        if body is not None:
+            data = json.dumps(body).encode()
+            h["content-type"] = "application/json"
+        req = urllib.request.Request(url, data=data, headers=h, method=method)
+        try:
+            with urllib.request.urlopen(req, timeout=self.timeout) as r:
+                return json.loads(r.read().decode("utf-8"))
+        except urllib.error.HTTPError as e:
+            raw = e.read().decode("utf-8", "replace")
+            try:
+                b = json.loads(raw)
+            except ValueError:
+                b = {"error": raw[:300]}
+            raise CrawlCheckError(e.code, b) from None
+
+    # --- read before acting ---
+    def resolve(self, domain):
+        """The signed ResolveV1 answer: crawl policy, delivery, machine files, capabilities, entity, findings, freshness and a decision per action."""
+        return self._req("GET", "/api/v1/resolve", {"domain": domain})
+
+    def resolve_batch(self, domains):
+        """Up to 100 domains in one call; each answer is a full signed ResolveV1 document."""
+        return self._req("POST", "/api/v1/resolve", body={"domains": list(domains)})
+
+    def preflight(self, domain, action="read", agent=None, template=None, policy=None):
+        """The policy engine: a signed decision receipt (allow | warn | require_confirmation | block | unsupported).
+        policy keys: max_age_hours, on_warn (warn|require_confirmation|block), require_entity, human_approval[], allow[], deny[].
+        A policy can only make the decision stricter."""
+        b = {"domain": domain, "action": action}
+        if agent:
+            b["agent"] = agent
+        if template:
+            b["template"] = template
+        if policy:
+            b["policy"] = policy
+        return self._req("POST", "/api/v1/preflight", body=b)
+
+    def changes(self, since=None, domain=None, limit=100):
+        return self._req("GET", "/api/v1/changes", {"since": since, "domain": domain, "limit": limit})
+
+    def outcome(self, domain, action, status=None, blocked=None, challenged=None, agent=None, resolve_sha256=None, **extra):
+        """Report what happened after acting. Outcomes are kept apart from the signed record and never rewrite it."""
+        b = dict(extra, domain=domain, action=action)
+        for k, v in (("status", status), ("blocked", blocked), ("challenged", challenged), ("agent", agent), ("resolve_sha256", resolve_sha256)):
+            if v is not None:
+                b[k] = v
+        return self._req("POST", "/api/v1/outcome", body=b)
+
+    def domain(self, domain):
+        """The registry record (RDAP) and lifecycle of a domain."""
+        return self._req("GET", "/api/v1/domain", {"domain": domain})
+
+    def scan(self, domain):
+        return self._req("POST", "/api/scan", body={"domain": domain})
+
+    def machine_record(self, report_id, fmt=None):
+        return self._req("GET", "/api/v1/machine-record", {"id": report_id, "format": fmt})
+
+    # --- verification ---
+    def published_key_ids(self, refresh=False):
+        if self._kids is None or refresh:
+            d = self._req("GET", "/.well-known/http-message-signatures-directory")
+            self._kids = [k.get("kid") or key_id(k) for k in d.get("keys", [])]
+        return self._kids
+
+    def verify(self, doc, online_keys=True):
+        """Verify a signed document. With online_keys, the signing key must also be in the published directory."""
+        return verify_document(doc, self.published_key_ids() if online_keys else None)
+
+    def guard(self, domain, action="read", agent=None, template=None, policy=None, confirm=None, allow_warn=False):
+        """Preflight, verify the receipt, and return (proceed: bool, receipt). Proceeds on allow. warn proceeds only with
+        allow_warn=True. require_confirmation proceeds only if confirm(receipt) returns True. block and unsupported never."""
+        rc = self.preflight(domain, action, agent, template, policy)
+        if not self.verify(rc)["verified"]:
+            return False, rc
+        d = rc.get("decision")
+        if d == "allow" or (d == "warn" and allow_warn):
+            return True, rc
+        if d == "require_confirmation" and confirm is not None:
+            return bool(confirm(rc)), rc
+        return False, rc

crawlcheck-1.0.1/crawlcheck/verify.py

@@ -0,0 +1,100 @@
+"""Offline verification of CrawlCheck signed documents: resolve answers, decision receipts, data inventories,
+export parts and deletion records. Mirrors verifyDataDoc in crawlcheck-verify.mjs, check for check."""
+import base64
+import hashlib
+import json
+import re
+from decimal import Decimal
+
+from . import _ed25519
+
+DATA_SIG_PREFIX = "crawlcheck-data-v1\n"
+DATA_KINDS = ("crawlcheck-data-inventory", "crawlcheck-data-export-part", "crawlcheck-deletion-record", "crawlcheck-resolve", "crawlcheck-decision")
+DECISIONS = ("allow", "warn", "require_confirmation", "block", "unsupported")
+
+
+def _js_number(v):
+    if isinstance(v, bool):
+        return "true" if v else "false"
+    if isinstance(v, int):
+        return str(v)
+    if v != v or v in (float("inf"), float("-inf")):
+        return "null"
+    if v == int(v) and abs(v) < 1e21:
+        return str(int(v))
+    r = repr(v)
+    if "e" in r or "E" in r:
+        m, e = r.lower().split("e")
+        e = int(e)
+        if -7 < e < 21:
+            s = format(Decimal(r), "f")
+            return s.rstrip("0").rstrip(".") if "." in s else s
+        return m + "e" + ("+" if e > 0 else "-") + str(abs(e))
+    return r
+
+
+def canon(v):
+    """Canonical JSON exactly as the server computes it: keys sorted, no whitespace, JSON.stringify for scalars."""
+    if isinstance(v, dict):
+        return "{" + ",".join(json.dumps(k, ensure_ascii=False) + ":" + canon(v[k]) for k in sorted(v)) + "}"
+    if isinstance(v, (list, tuple)):
+        return "[" + ",".join(canon(x) for x in v) + "]"
+    if v is None:
+        return "null"
+    if isinstance(v, (bool, int, float)):
+        return _js_number(v)
+    return json.dumps(v, ensure_ascii=False)
+
+
+def _b64u_decode(s):
+    s = str(s)
+    return base64.urlsafe_b64decode(s + "=" * (-len(s) % 4))
+
+
+def _b64u(b):
+    return base64.urlsafe_b64encode(b).decode().rstrip("=")
+
+
+def key_id(jwk):
+    """RFC 7638 thumbprint of an Ed25519 JWK - the kid CrawlCheck publishes."""
+    return _b64u(hashlib.sha256(json.dumps({"crv": jwk["crv"], "kty": jwk["kty"], "x": jwk["x"]}, separators=(",", ":")).encode()).digest())
+
+
+def verify_document(doc, published_kids=None):
+    """Verify a signed CrawlCheck document offline. Returns {"verified": bool, "checks": [...]}.
+    published_kids: optional list of key ids from https://crawlcheck.io/.well-known/http-message-signatures-directory;
+    without it key_published stays None (undecided), as in the JavaScript verifier."""
+    checks = []
+
+    def C(i, ok, why):
+        checks.append({"id": i, "ok": ok, "why": why})
+
+    if not isinstance(doc, dict) or doc.get("kind") not in DATA_KINDS or not doc.get("signature"):
+        raise ValueError("not a CrawlCheck data inventory, export part, deletion record, resolve answer or decision receipt")
+    body = {k: v for k, v in doc.items() if k not in ("sha256", "signature")}
+    sha = hashlib.sha256(canon(body).encode("utf-8")).hexdigest()
+    C("document_hash", sha == doc.get("sha256"), "the document hashes to its stated digest" if sha == doc.get("sha256") else "the document hashes to %s, it states %s - a field was changed" % (sha, doc.get("sha256")))
+    sig = doc["signature"]
+    jwk = (sig.get("key") or {}).get("jwk") or {}
+    if not jwk.get("x"):
+        C("key_id", None, "no key in the document")
+        C("signature", None, "no key to check against")
+    else:
+        kid = key_id(jwk)
+        C("key_id", kid == sig.get("kid"), "public key thumbprint (RFC 7638) is the key id" if kid == sig.get("kid") else "thumbprint %s does not match key id %s" % (kid, sig.get("kid")))
+        msg = DATA_SIG_PREFIX + sha
+        ok = sig.get("message") == msg and _ed25519.verify(_b64u_decode(jwk["x"]), msg.encode(), _b64u_decode(sig.get("sig", "")))
+        C("signature", ok, "Ed25519 signature over the document digest verifies" if ok else "signature does NOT verify over this content")
+    if published_kids is None:
+        C("key_published", None, "offline this cannot be decided: compare key id %s with the published key directory" % sig.get("kid"))
+    else:
+        C("key_published", sig.get("kid") in published_kids, "the signing key is published" if sig.get("kid") in published_kids else "the signing key is NOT in the published directory - reject this document")
+    if doc.get("kind") == "crawlcheck-decision":
+        r = doc.get("resolve") or {}
+        bound = bool(re.fullmatch(r"[0-9a-f]{64}", str(r.get("sha256") or ""))) and r.get("kid") == sig.get("kid")
+        C("resolve_bound", bound, "the decision names the resolve answer it was made from, signed by the same key" if bound else "the decision does not name a resolve answer digest")
+        C("decision_known", doc.get("decision") in DECISIONS, "decision is %s" % doc.get("decision"))
+    if doc.get("kind") == "crawlcheck-deletion-record":
+        C("counts", sum((f.get("keys") or 0) for f in doc.get("deleted") or []) == doc.get("deleted_total"), "the per-family counts add up to deleted_total")
+    ran = [c for c in checks if c["ok"] is not None]
+    return {"verified": bool(ran) and all(c["ok"] for c in ran), "checks": checks}

crawlcheck-1.0.1/crawlcheck.egg-info/PKG-INFO

@@ -0,0 +1,36 @@
+Metadata-Version: 2.4
+Name: crawlcheck
+Version: 1.0.1
+Summary: CrawlCheck client: resolve a domain, get a signed decision for an agent action, verify CrawlCheck evidence offline. No dependencies.
+Author: VSNARY
+License: MIT
+Project-URL: Homepage, https://crawlcheck.io/sdk
+Project-URL: Documentation, https://crawlcheck.io/docs/api
+Requires-Python: >=3.8
+Description-Content-Type: text/markdown
+
+# crawlcheck (Python)
+
+Before your agent reads, cites, connects to or transacts with a domain, ask CrawlCheck. No dependencies; Python 3.8+.
+
+```
+pip install https://crawlcheck.io/sdk/crawlcheck-1.0.1-py3-none-any.whl
+```
+
+```python
+from crawlcheck import CrawlCheck
+
+cc = CrawlCheck()                      # CrawlCheck(key="cc_...") for licensed detail
+answer = cc.resolve("example.com")     # signed ResolveV1: policy, delivery, files, capabilities, entity, freshness, actions
+print(answer["actions"]["read"]["decision"])
+
+receipt = cc.preflight("example.com", action="cite", agent="GPTBot", template="safe_citation")
+print(receipt["decision"], [s["why"] for s in receipt["steps"]])
+assert cc.verify(receipt)["verified"]  # Ed25519, checked locally; the key must be in the published directory
+
+ok, receipt = cc.guard("shop.example", action="transact", confirm=lambda r: input(r["meaning"] + " y/n? ") == "y")
+```
+
+Command line: `python -m crawlcheck preflight example.com cite GPTBot`, `python -m crawlcheck verify receipt.json`.
+
+Decisions: `allow`, `warn`, `require_confirmation`, `block`, `unsupported`. A policy (`max_age_hours`, `on_warn`, `require_entity`, `human_approval`, `allow`, `deny`) can only make a decision stricter.

crawlcheck-1.0.1/crawlcheck.egg-info/SOURCES.txt

@@ -0,0 +1,12 @@
+README.md
+pyproject.toml
+crawlcheck/__init__.py
+crawlcheck/__main__.py
+crawlcheck/_ed25519.py
+crawlcheck/client.py
+crawlcheck/verify.py
+crawlcheck.egg-info/PKG-INFO
+crawlcheck.egg-info/SOURCES.txt
+crawlcheck.egg-info/dependency_links.txt
+crawlcheck.egg-info/top_level.txt
+tests/test_live.py

crawlcheck-1.0.1/crawlcheck.egg-info/dependency_links.txt

@@ -0,0 +1 @@
+

crawlcheck-1.0.1/crawlcheck.egg-info/top_level.txt

@@ -0,0 +1 @@
+crawlcheck

crawlcheck-1.0.1/pyproject.toml

@@ -0,0 +1,16 @@
+[build-system]
+requires = ["setuptools>=61"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "crawlcheck"
+version = "1.0.1"
+description = "CrawlCheck client: resolve a domain, get a signed decision for an agent action, verify CrawlCheck evidence offline. No dependencies."
+readme = "README.md"
+requires-python = ">=3.8"
+license = { text = "MIT" }
+authors = [{ name = "VSNARY" }]
+urls = { Homepage = "https://crawlcheck.io/sdk", Documentation = "https://crawlcheck.io/docs/api" }
+
+[tool.setuptools]
+packages = ["crawlcheck"]

crawlcheck-1.0.1/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+

crawlcheck-1.0.1/tests/test_live.py

@@ -0,0 +1,65 @@
+"""Live tests against production plus offline tamper tests. python -m unittest discover -s tests"""
+import copy
+import unittest
+
+from crawlcheck import CrawlCheck, CrawlCheckError, canon, verify_document
+
+
+class T(unittest.TestCase):
+    cc = CrawlCheck()
+
+    def test_canon_matches_js(self):
+        self.assertEqual(canon({"b": 1, "a": [True, None, 1.5, 1.0, "é\n"], "c": {"z": 1e-7, "y": 1e21, "x": 1e16}}),
+                         '{"a":[true,null,1.5,1,"é\\n"],"b":1,"c":{"x":10000000000000000,"y":1e+21,"z":1e-7}}')
+
+    def test_resolve_verifies(self):
+        a = self.cc.resolve("supremefencingdenver.com")
+        self.assertEqual(a["kind"], "crawlcheck-resolve")
+        r = self.cc.verify(a)
+        self.assertTrue(r["verified"], r)
+        self.assertIn("read", a["actions"])
+        self.assertIn("fresh_until", a["freshness"])
+
+    def test_tampered_resolve_fails(self):
+        a = copy.deepcopy(self.cc.resolve("github.com"))
+        a["actions"]["read"]["decision"] = "allow" if a["actions"]["read"]["decision"] != "allow" else "block"
+        self.assertFalse(verify_document(a)["verified"])
+
+    def test_preflight_receipt(self):
+        rc = self.cc.preflight("amazon.com", "read", agent="GPTBot")
+        self.assertEqual(rc["decision"], "block")
+        self.assertTrue(self.cc.verify(rc)["verified"])
+        ids = {c["id"]: c["ok"] for c in self.cc.verify(rc)["checks"]}
+        self.assertTrue(ids["resolve_bound"] and ids["key_published"])
+
+    def test_policy_cannot_loosen(self):
+        with self.assertRaises(CrawlCheckError) as e:
+            self.cc.preflight("example.com", "read", policy={"on_warn": "allow"})
+        self.assertEqual(e.exception.status, 422)
+
+    def test_guard_requires_confirmation(self):
+        ok, rc = self.cc.guard("supremefencingdenver.com", "transact")
+        self.assertFalse(ok)
+        ok, rc = self.cc.guard("supremefencingdenver.com", "transact", confirm=lambda r: True)
+        self.assertTrue(ok)
+
+    def test_foreign_key_rejected_online(self):
+        a = self.cc.resolve("supremefencingdenver.com")
+        r = verify_document(a, published_kids=["someone-else"])
+        self.assertFalse(r["verified"])
+
+    def test_guard_warn_needs_opt_in(self):
+        rc = self.cc.preflight("github.com", "read")
+        if rc["decision"] == "warn":
+            self.assertFalse(self.cc.guard("github.com", "read")[0])
+            self.assertTrue(self.cc.guard("github.com", "read", allow_warn=True)[0])
+
+    def test_batch(self):
+        b = self.cc.resolve_batch(["github.com", "supremefencingdenver.com"])
+        self.assertEqual(b["count"], 2)
+        for x in b["answers"]:
+            self.assertTrue(self.cc.verify(x["answer"])["verified"])
+
+
+if __name__ == "__main__":
+    unittest.main()