nenrin-verify 0.1.0__tar.gz

nenrin_verify-0.1.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 The HORIZONs Co., Ltd.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

nenrin_verify-0.1.0/MANIFEST.in

@@ -0,0 +1,3 @@
+include README.md LICENSE
+recursive-include tests *.py *.mjs *.json
+include tools/vendor.py

nenrin_verify-0.1.0/PKG-INFO

@@ -0,0 +1,110 @@
+Metadata-Version: 2.4
+Name: nenrin-verify
+Version: 0.1.0
+Summary: Recompute NENRIN evidence yourself, offline: A2A task provenance and two-party agreement records. Same reports as the npm nenrin-verify.
+Author: The HORIZONs Co., Ltd.
+License-Expression: MIT
+Project-URL: Homepage, https://github.com/ogasurfproject-jpg/horizon-shield/tree/main/workers/hs-ledger/nenrin/sdk-python
+Project-URL: Source, https://github.com/ogasurfproject-jpg/horizon-shield
+Project-URL: JavaScript twin, https://www.npmjs.com/package/nenrin-verify
+Keywords: a2a,provenance,verification,did-key,ed25519,nenrin,agent,evidence,horizon-shield
+Classifier: Programming Language :: Python :: 3
+Classifier: Operating System :: OS Independent
+Classifier: Topic :: Security :: Cryptography
+Classifier: Intended Audience :: Developers
+Requires-Python: >=3.9
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: cryptography>=41
+Dynamic: license-file
+
+# nenrin-verify (Python)
+
+Recompute NENRIN evidence yourself, offline, in your own Python process. The Python twin of the npm package
+[`nenrin-verify`](https://www.npmjs.com/package/nenrin-verify): same input, same report (the two limits are listed
+under "Where the claim stops").
+
+    pip install nenrin-verify
+    nenrin-verify --selftest          # 31/31 frozen bundles give the same report as npm nenrin-verify
+    nenrin-verify bundle.json         # the provenance report; exit 0 accepted, 1 refused
+
+```python
+import json, nenrin_verify as nv
+
+bundle = nv.js_loads(open("bundle.json", "rb").read())   # parsed the way JSON.parse parses it
+report = nv.verify_bundle(bundle)             # did:key resolution, no network, no clock
+print(report["verdict"], report["does_not_establish"])
+print(nv.report_json(report))                 # JSON text as the JavaScript CLI prints it (not json.dumps)
+print(nv.report_sha256(report))               # compare with the JavaScript run, byte for byte
+```
+
+One dependency, `cryptography`, for Ed25519. Nothing here opens a socket.
+
+## What it verifies
+
+| module | what | held to |
+|---|---|---|
+| `verify_provenance`, `consume_evidence`, `posture_line`, `candidate_evidence_set`, `preflight_report` | one A2A task's provenance graph: the delegation chain observed by third-party witnesses (R1 to R4, witness and edge signatures), the caller's grant and the provider's execution receipt (E1 to E3, caller and provider signatures), the provider's pre-execution intent, the outcome's evidence pointer, and the digest link between the layers | npm nenrin-verify 0.2.3 (`nenrin_verify.mjs`, verifier 0.1.3): the same report, key for key |
+| `agreement_verify.verify`, `nenrin-agreement-verify` | a two-party agreement record (`a2a-agreement-v1`, `v1.1`), including key succession across a rotation | the repository's own Python verifier, unchanged but for one import line and a header comment; it and the JavaScript verifier return the same report on 5,286 frozen cases |
+
+## How "same report" is checked
+
+The JavaScript file is the reference. The port reads it line for line, and every place where Python and
+JavaScript disagree by default (`x or y` on `{}`, `==` on `True` and `1`, `Date.parse` accepting February 31st,
+Node's lenient base64, an own `__proto__` key that Object.assign turns into a prototype, the order V8's sort
+gives values a numeric comparator cannot order) goes through one file,
+`src/nenrin_verify/_js.py`, so the differences can be read in one place.
+
+- **Frozen.** 31 bundles signed with keys derived from a public phrase, covering accepted graphs, refusals of every
+  layer, witness disagreement, provider equivocation, action bindings, non-ASCII and escapes, and the date edge
+  cases. For each, the report, the `consume_evidence` projection and the CLI output are byte-identical to the
+  JavaScript's. They ship in the package; `nenrin-verify --selftest` re-runs them on your machine.
+- **Live.** Every path of every frozen bundle is broken in about twenty ways (deleted, nulled, retyped, shortened,
+  reordered, timestamps and sequence numbers bent, own `__proto__` keys added, the whole bundle replaced by an
+  array or null), 27,062 inputs in all. Each is run through the JavaScript verifier and through this port. Pass
+  means both threw, or both returned the same report and projection. 0 differ.
+- **Semantics.** The helpers in `_js.py` against Node directly: number text, Date.parse, Buffer base64, string
+  escaping and mixed-type sorting, several thousand random values each.
+- **Agreement.** The packaged agreement verifier returns every one of the 5,286 frozen reports in
+  `agreement-v0/agreement_vectors_v1.json`, the file the JavaScript verifier is scored against.
+- **Unchanged.** `VENDORED.json` pins the sha256 of the agreement files and their sources; a copy that drifts fails.
+
+`report_sha256(report)` is the sha256 of the report with keys sorted by UTF-16 code unit at every depth, no
+whitespace, strings and numbers as JSON.stringify writes them. The JavaScript side of the same hash is
+`tests/parity/js_canon.mjs` (twelve lines).
+
+## Where the claim stops
+
+- **Stack depth.** A document nested deep enough to exhaust a runtime's stack has no report in that runtime, and
+  Node and Python run out at different depths (Node threw at 3,000 nested arrays inside a signed field, Python's
+  default limit is 1,000). Real bundles are a few levels deep.
+- **Sixty-four or more non-numeric `hop.seq` values in one bundle.** The order of those keys is V8's merge sort over
+  a comparator that cannot order them; the port reproduces V8 for up to 63 keys and raises above that instead of
+  guessing.
+- Where the JavaScript throws, the port raises; the CLI then prints no report and exits 2 (Node exits 1 on an
+  uncaught throw).
+
+## What it does not establish
+
+What every report says itself, accepted or refused: a signature proves who asserted, not that the assertion is
+true; E1 compares a provider's signed claim to a caller's signed authorization and has no side-effect oracle;
+R1 proves a witness is structurally distinct from the parties, not unaffiliated with them. There is no score and
+no allow or deny anywhere in this package. The decision belongs to whoever reads the evidence.
+
+Not in this release: the TSUGI recovery-chain verifier (`tsugi_verify.mjs`) and the MUSUBI contract spine. Each
+comes in when it can carry the same guarantee as the two verifiers above: the same report as its JavaScript twin,
+checked case by case.
+
+## Reproduce
+
+    cd workers/hs-ledger/nenrin/sdk-python
+    pip install -e . pytest
+    node tests/fixtures/make_fixtures.mjs --check   # the frozen fixtures re-create byte for byte
+    python tools/vendor.py --check                  # the agreement copies are their sources
+    pytest tests -q -s                              # frozen, live differential, agreement
+
+Published from GitHub Actions with PyPI Trusted Publishing and attestations
+(`.github/workflows/pypi-publish-nenrin-verify.yml`); the parity suite runs on every change to this directory,
+to the JavaScript SDK and to the agreement verifier (`.github/workflows/nenrin-verify-py.yml`).
+
+MIT. The HORIZONs Co., Ltd.

nenrin_verify-0.1.0/README.md

@@ -0,0 +1,90 @@
+# nenrin-verify (Python)
+
+Recompute NENRIN evidence yourself, offline, in your own Python process. The Python twin of the npm package
+[`nenrin-verify`](https://www.npmjs.com/package/nenrin-verify): same input, same report (the two limits are listed
+under "Where the claim stops").
+
+    pip install nenrin-verify
+    nenrin-verify --selftest          # 31/31 frozen bundles give the same report as npm nenrin-verify
+    nenrin-verify bundle.json         # the provenance report; exit 0 accepted, 1 refused
+
+```python
+import json, nenrin_verify as nv
+
+bundle = nv.js_loads(open("bundle.json", "rb").read())   # parsed the way JSON.parse parses it
+report = nv.verify_bundle(bundle)             # did:key resolution, no network, no clock
+print(report["verdict"], report["does_not_establish"])
+print(nv.report_json(report))                 # JSON text as the JavaScript CLI prints it (not json.dumps)
+print(nv.report_sha256(report))               # compare with the JavaScript run, byte for byte
+```
+
+One dependency, `cryptography`, for Ed25519. Nothing here opens a socket.
+
+## What it verifies
+
+| module | what | held to |
+|---|---|---|
+| `verify_provenance`, `consume_evidence`, `posture_line`, `candidate_evidence_set`, `preflight_report` | one A2A task's provenance graph: the delegation chain observed by third-party witnesses (R1 to R4, witness and edge signatures), the caller's grant and the provider's execution receipt (E1 to E3, caller and provider signatures), the provider's pre-execution intent, the outcome's evidence pointer, and the digest link between the layers | npm nenrin-verify 0.2.3 (`nenrin_verify.mjs`, verifier 0.1.3): the same report, key for key |
+| `agreement_verify.verify`, `nenrin-agreement-verify` | a two-party agreement record (`a2a-agreement-v1`, `v1.1`), including key succession across a rotation | the repository's own Python verifier, unchanged but for one import line and a header comment; it and the JavaScript verifier return the same report on 5,286 frozen cases |
+
+## How "same report" is checked
+
+The JavaScript file is the reference. The port reads it line for line, and every place where Python and
+JavaScript disagree by default (`x or y` on `{}`, `==` on `True` and `1`, `Date.parse` accepting February 31st,
+Node's lenient base64, an own `__proto__` key that Object.assign turns into a prototype, the order V8's sort
+gives values a numeric comparator cannot order) goes through one file,
+`src/nenrin_verify/_js.py`, so the differences can be read in one place.
+
+- **Frozen.** 31 bundles signed with keys derived from a public phrase, covering accepted graphs, refusals of every
+  layer, witness disagreement, provider equivocation, action bindings, non-ASCII and escapes, and the date edge
+  cases. For each, the report, the `consume_evidence` projection and the CLI output are byte-identical to the
+  JavaScript's. They ship in the package; `nenrin-verify --selftest` re-runs them on your machine.
+- **Live.** Every path of every frozen bundle is broken in about twenty ways (deleted, nulled, retyped, shortened,
+  reordered, timestamps and sequence numbers bent, own `__proto__` keys added, the whole bundle replaced by an
+  array or null), 27,062 inputs in all. Each is run through the JavaScript verifier and through this port. Pass
+  means both threw, or both returned the same report and projection. 0 differ.
+- **Semantics.** The helpers in `_js.py` against Node directly: number text, Date.parse, Buffer base64, string
+  escaping and mixed-type sorting, several thousand random values each.
+- **Agreement.** The packaged agreement verifier returns every one of the 5,286 frozen reports in
+  `agreement-v0/agreement_vectors_v1.json`, the file the JavaScript verifier is scored against.
+- **Unchanged.** `VENDORED.json` pins the sha256 of the agreement files and their sources; a copy that drifts fails.
+
+`report_sha256(report)` is the sha256 of the report with keys sorted by UTF-16 code unit at every depth, no
+whitespace, strings and numbers as JSON.stringify writes them. The JavaScript side of the same hash is
+`tests/parity/js_canon.mjs` (twelve lines).
+
+## Where the claim stops
+
+- **Stack depth.** A document nested deep enough to exhaust a runtime's stack has no report in that runtime, and
+  Node and Python run out at different depths (Node threw at 3,000 nested arrays inside a signed field, Python's
+  default limit is 1,000). Real bundles are a few levels deep.
+- **Sixty-four or more non-numeric `hop.seq` values in one bundle.** The order of those keys is V8's merge sort over
+  a comparator that cannot order them; the port reproduces V8 for up to 63 keys and raises above that instead of
+  guessing.
+- Where the JavaScript throws, the port raises; the CLI then prints no report and exits 2 (Node exits 1 on an
+  uncaught throw).
+
+## What it does not establish
+
+What every report says itself, accepted or refused: a signature proves who asserted, not that the assertion is
+true; E1 compares a provider's signed claim to a caller's signed authorization and has no side-effect oracle;
+R1 proves a witness is structurally distinct from the parties, not unaffiliated with them. There is no score and
+no allow or deny anywhere in this package. The decision belongs to whoever reads the evidence.
+
+Not in this release: the TSUGI recovery-chain verifier (`tsugi_verify.mjs`) and the MUSUBI contract spine. Each
+comes in when it can carry the same guarantee as the two verifiers above: the same report as its JavaScript twin,
+checked case by case.
+
+## Reproduce
+
+    cd workers/hs-ledger/nenrin/sdk-python
+    pip install -e . pytest
+    node tests/fixtures/make_fixtures.mjs --check   # the frozen fixtures re-create byte for byte
+    python tools/vendor.py --check                  # the agreement copies are their sources
+    pytest tests -q -s                              # frozen, live differential, agreement
+
+Published from GitHub Actions with PyPI Trusted Publishing and attestations
+(`.github/workflows/pypi-publish-nenrin-verify.yml`); the parity suite runs on every change to this directory,
+to the JavaScript SDK and to the agreement verifier (`.github/workflows/nenrin-verify-py.yml`).
+
+MIT. The HORIZONs Co., Ltd.

nenrin_verify-0.1.0/pyproject.toml

@@ -0,0 +1,36 @@
+[build-system]
+requires = ["setuptools>=77"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "nenrin-verify"
+version = "0.1.0"
+description = "Recompute NENRIN evidence yourself, offline: A2A task provenance and two-party agreement records. Same reports as the npm nenrin-verify."
+readme = "README.md"
+license = "MIT"
+license-files = ["LICENSE"]
+requires-python = ">=3.9"
+authors = [{ name = "The HORIZONs Co., Ltd." }]
+dependencies = ["cryptography>=41"]
+keywords = ["a2a", "provenance", "verification", "did-key", "ed25519", "nenrin", "agent", "evidence", "horizon-shield"]
+classifiers = [
+  "Programming Language :: Python :: 3",
+  "Operating System :: OS Independent",
+  "Topic :: Security :: Cryptography",
+  "Intended Audience :: Developers",
+]
+
+[project.urls]
+Homepage = "https://github.com/ogasurfproject-jpg/horizon-shield/tree/main/workers/hs-ledger/nenrin/sdk-python"
+Source = "https://github.com/ogasurfproject-jpg/horizon-shield"
+"JavaScript twin" = "https://www.npmjs.com/package/nenrin-verify"
+
+[project.scripts]
+nenrin-verify = "nenrin_verify.cli:main"
+nenrin-agreement-verify = "nenrin_verify.cli:agreement_main"
+
+[tool.setuptools.packages.find]
+where = ["src"]
+
+[tool.setuptools.package-data]
+nenrin_verify = ["VENDORED.json", "py.typed", "selftest.json"]

nenrin_verify-0.1.0/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+

nenrin_verify-0.1.0/src/nenrin_verify/VENDORED.json

@@ -0,0 +1,12 @@
+{
+  "agreement_verify.py": {
+    "source": "workers/hs-ledger/nenrin/agreement-v0/agreement_verify.py",
+    "source_sha256": "563887cf0b5c111a37f1ad676c946ecedfe27a42058befd1e819795689f9f691",
+    "vendored_sha256": "5a143e177ee055d4e0da9c83ea5ad3901bcf9fec0a5c4cbdb7d83901247697e3"
+  },
+  "key_succession.py": {
+    "source": "workers/hs-ledger/nenrin/agreement-v0/key_succession.py",
+    "source_sha256": "0d0209b318f654d0995ac6ca40f5194064cd6e8b49459d1bbbcfdb957b61452d",
+    "vendored_sha256": "fd3601681733cc3a5a9b30a2a459f5c6e49ada7167055775283493084c48178a"
+  }
+}

nenrin_verify-0.1.0/src/nenrin_verify/__init__.py

@@ -0,0 +1,44 @@
+"""nenrin-verify: recompute NENRIN evidence yourself, offline, in your own Python process.
+
+The Python twin of the npm package nenrin-verify. Two verifiers, each held to its JavaScript counterpart:
+
+  provenance   verify_provenance / consume_evidence: one A2A task's delegation chain, execution receipt,
+               pre-execution intent and outcome evidence (port of nenrin_verify.mjs; same report, key for key)
+  agreement    agreement_verify.verify: a two-party agreement record (a2a-agreement-v1 / v1.1), the repository's
+               own Python verifier, which returns the same report as the JavaScript one on 5,286 frozen cases
+
+No network, no clock, no score. A signature proves who asserted, not that the assertion is true; every report
+says what it does not establish.
+"""
+import hashlib
+
+from ._js import assign as _assign, stringify as _stringify, loads as js_loads
+from .provenance import (VERIFIER_VERSION, candidate_evidence_set, consume_evidence, did_key_resolver,
+                         evidence_id, grant_ref, intent_id, posture_line, preflight_report,
+                         public_key_from_did_key, receipt_id, verify_provenance)
+from . import agreement_verify
+
+__version__ = "0.1.0"
+
+__all__ = ["verify_provenance", "consume_evidence", "posture_line", "candidate_evidence_set", "preflight_report",
+           "public_key_from_did_key", "did_key_resolver", "evidence_id", "grant_ref", "receipt_id", "intent_id",
+           "agreement_verify", "report_sha256", "report_json", "verify_bundle", "js_loads", "VERIFIER_VERSION", "__version__"]
+
+
+def report_sha256(report):
+    """sha256 of the report's sorted-key JSON, the same bytes the JavaScript side hashes for the parity check:
+    keys ordered by UTF-16 code unit at every depth, no whitespace, numbers as JavaScript writes them."""
+    return hashlib.sha256(_stringify(report, sort_keys=True).encode("utf-8")).hexdigest()
+
+
+def verify_bundle(bundle):
+    """What `nenrin-verify bundle.json` does: Object.assign({}, bundle, {resolve: didKeyResolver}), then verify,
+    offline. Any JSON value is accepted the way the JavaScript CLI accepts it (an array or null verifies as {})."""
+    return verify_provenance(_assign(bundle, {"resolve": did_key_resolver}))
+
+
+def report_json(report, indent=2):
+    """The report as JSON text, written the way JSON.stringify(report, null, indent) writes it. Use this rather
+    than json.dumps: a report can carry the port's stand-in for JavaScript undefined (a key the JavaScript leaves
+    out of its output), which json.dumps cannot write."""
+    return _stringify(report, indent=indent)