probity-verify 0.1.0__py3-none-any.whl

probity_verify/__init__.py

@@ -0,0 +1,5 @@
+"""Consumer-side claim adjudication. No network access or implicit trust roots."""
+
+from .core import CaseError, adjudicate
+
+__all__ = ["CaseError", "adjudicate"]

probity_verify/a2a_client.py

@@ -0,0 +1,110 @@
+"""Official-SDK client for the optional Verify A2A service."""
+
+from __future__ import annotations
+
+import argparse
+import asyncio
+import sys
+from pathlib import Path
+from urllib.parse import urlsplit
+from uuid import uuid4
+
+import httpx
+from a2a.client import A2ACardResolver, ClientConfig, ClientFactory
+from a2a.types import (
+    GetTaskRequest, Message, Part, Role, SendMessageConfiguration,
+    SendMessageRequest, TaskState,
+)
+from a2a.utils.errors import A2AError
+from google.protobuf.json_format import MessageToDict
+
+from .a2a_server import (
+    CASE_MIME, DECISION_MIME, LAB_QUERY_MIME, LAB_RECORD_MIME, MAX_CASE_BYTES,
+    digest, parse_raw, read_bounded,
+)
+from .core import CaseError, canonical_json
+
+
+async def request(base_url: str, raw: bytes, mime: str, pin: str) -> tuple[bytes, str]:
+    if not raw or len(raw) > MAX_CASE_BYTES:
+        raise CaseError("request bytes exceed the input limit")
+    expected_mime = DECISION_MIME if mime == CASE_MIME else LAB_RECORD_MIME
+    pin_name = "policy_sha256" if mime == CASE_MIME else "register_sha256"
+    origin = urlsplit(base_url)
+    if (origin.scheme not in {"http", "https"} or not origin.netloc or origin.path not in {"", "/"}
+            or origin.username or origin.password or origin.query or origin.fragment):
+        raise CaseError("base URL must be an HTTP origin")
+    use_environment = origin.hostname not in {"127.0.0.1", "::1", "localhost"}
+    async with httpx.AsyncClient(timeout=30, follow_redirects=False, trust_env=use_environment) as http:
+        card = await A2ACardResolver(http, base_url).get_agent_card()
+        interfaces = [i for i in card.supported_interfaces
+                      if i.protocol_binding == "JSONRPC" and i.protocol_version == "1.0"]
+        if (len(interfaces) != 1 or urlsplit(interfaces[0].url).scheme != origin.scheme
+                or urlsplit(interfaces[0].url).netloc != origin.netloc
+                or urlsplit(interfaces[0].url).path != "/a2a/jsonrpc"):
+            raise CaseError("agent card must name its own A2A 1.0 JSON-RPC route")
+        client = ClientFactory(ClientConfig(streaming=False, httpx_client=http,
+                                            supported_protocol_bindings=["JSONRPC"])).create(card)
+        message = Message(message_id=str(uuid4()), role=Role.ROLE_USER,
+                          parts=[Part(raw=raw, media_type=mime, metadata={
+                              "length": len(raw), "sha256": digest(raw), pin_name: pin})])
+        task = None
+        try:
+            async for response in client.send_message(SendMessageRequest(
+                    message=message, configuration=SendMessageConfiguration(return_immediately=False))):
+                if response.HasField("task"):
+                    task = response.task
+            if task is None or task.status.state != TaskState.TASK_STATE_COMPLETED:
+                raise CaseError("A2A request did not complete")
+            retained = await client.get_task(GetTaskRequest(id=task.id))
+            if retained != task:
+                raise CaseError("retained task differs from the completed response")
+            parts = [part for artifact in task.artifacts for part in artifact.parts
+                     if part.media_type == expected_mime]
+            if len(parts) != 1 or parts[0].WhichOneof("content") != "raw":
+                raise CaseError("expected one raw result artifact")
+            result = parts[0].raw
+            metadata = MessageToDict(parts[0].metadata)
+            if (metadata.get("sha256") != digest(result) or metadata.get("length") != len(result)
+                    or metadata.get(pin_name) != pin):
+                raise CaseError("result binding differs")
+            if mime == CASE_MIME and metadata.get("case_sha256") != digest(raw):
+                raise CaseError("result case binding differs")
+            parse_raw(result)
+            return result, task.id
+        finally:
+            await client.close()
+
+
+def main(argv: list[str] | None = None) -> int:
+    parser = argparse.ArgumentParser(prog="probity-a2a-client")
+    parser.add_argument("--url", default="http://127.0.0.1:41241")
+    commands = parser.add_subparsers(dest="command", required=True)
+    verify = commands.add_parser("verify")
+    verify.add_argument("case", type=Path)
+    verify.add_argument("--policy", type=Path, required=True)
+    lab = commands.add_parser("lab-record")
+    lab.add_argument("record_id")
+    lab.add_argument("--register-sha256", required=True)
+    args = parser.parse_args(argv)
+    try:
+        if args.command == "verify":
+            raw = read_bounded(args.case, MAX_CASE_BYTES)
+            policy = parse_raw(read_bounded(args.policy, 4 * 1024 * 1024))
+            pin = digest(canonical_json(policy))
+            mime = CASE_MIME
+        else:
+            raw = canonical_json({"record_id": args.record_id})
+            pin = args.register_sha256
+            mime = LAB_QUERY_MIME
+        result, _ = asyncio.run(request(args.url, raw, mime, pin))
+    except (CaseError, ValueError, OSError, RecursionError, httpx.InvalidURL,
+            httpx.HTTPError, A2AError) as exc:
+        print(f"probity-a2a-client: {exc}", file=sys.stderr)
+        return 2
+    sys.stdout.buffer.write(result)
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

probity_verify/a2a_server.py

@@ -0,0 +1,283 @@
+"""Optional A2A 1.0 transport for operator-configured Verify and Lab reads."""
+
+from __future__ import annotations
+
+import argparse
+import asyncio
+import copy
+import hashlib
+import ipaddress
+import sys
+from collections import OrderedDict
+from pathlib import Path
+from urllib.parse import urlsplit
+
+from a2a.server.agent_execution import AgentExecutor, RequestContext
+from a2a.server.events import EventQueue
+from a2a.server.request_handlers import DefaultRequestHandler
+from a2a.server.routes import create_agent_card_routes, create_jsonrpc_routes
+from a2a.server.tasks import InMemoryTaskStore, TaskUpdater
+from a2a.types import (
+    AgentCapabilities, AgentCard, AgentInterface, AgentSkill, Part,
+    Task, TaskState, TaskStatus,
+)
+from a2a.utils.errors import InvalidParamsError, UnsupportedOperationError
+from google.protobuf.json_format import MessageToDict
+from starlette.applications import Starlette
+from starlette.responses import JSONResponse, PlainTextResponse
+from starlette.routing import Route
+
+from .common import _read_input
+from .json_input import parse_json
+from .core import CaseError, adjudicate, canonical_json, render_packet
+
+CASE_MIME = "application/vnd.probity.case+json"
+DECISION_MIME = "application/vnd.probity.decision+json"
+LAB_QUERY_MIME = "application/vnd.probity.lab-query+json"
+LAB_RECORD_MIME = "application/vnd.probity.lab-record+json"
+MAX_CASE_BYTES = 256 * 1024
+MAX_REQUEST_BYTES = 384 * 1024
+MAX_RETAINED_TASKS = 128
+
+
+def digest(raw: bytes) -> str:
+    return hashlib.sha256(raw).hexdigest()
+
+
+def parse_raw(raw: bytes) -> object:
+    """Use bounded duplicate-key and non-JSON-number admission rules."""
+    return parse_json(raw, max_bytes=16 * 1024 * 1024, max_depth=32, max_nodes=32768)
+
+
+def read_bounded(path: Path, limit: int) -> bytes:
+    return _read_input(path, limit, "configured input")
+
+
+class BoundedTaskStore(InMemoryTaskStore):
+    """Retain the latest completed tasks through the SDK's public store API."""
+
+    def __init__(self, limit: int = MAX_RETAINED_TASKS) -> None:
+        super().__init__()
+        if limit < 1:
+            raise ValueError("task retention limit must be positive")
+        self.limit = limit
+        self.completed = OrderedDict()
+        self.retention_lock = asyncio.Lock()
+
+    async def save(self, task, context) -> None:
+        async with self.retention_lock:
+            await super().save(task, context)
+            if task.status.state == TaskState.TASK_STATE_COMPLETED:
+                self.completed[task.id] = context
+                self.completed.move_to_end(task.id)
+                while len(self.completed) > self.limit:
+                    expired, owner = self.completed.popitem(last=False)
+                    await super().delete(expired, owner)
+
+
+class VerifyExecutor(AgentExecutor):
+    def __init__(self, policy: bytes, artifact_root: Path,
+                 lab_register: bytes | None = None,
+                 lab_register_sha256: str | None = None) -> None:
+        self.policy = parse_raw(policy)
+        if not isinstance(self.policy, dict):
+            raise CaseError("consumer policy must be a JSON object")
+        self.policy_sha256 = digest(canonical_json(self.policy))
+        self.policy_source_sha256 = digest(policy)
+        self.artifact_root = artifact_root.absolute()
+        if not self.artifact_root.is_dir():
+            raise CaseError("artifact root must be a directory")
+        self.records: dict[str, dict] = {}
+        self.lab_register_sha256 = None
+        if lab_register is not None:
+            if digest(lab_register) != lab_register_sha256:
+                raise CaseError("Lab register digest differs from the operator pin")
+            register = parse_raw(lab_register)
+            if not isinstance(register, dict) or not isinstance(register.get("records"), list):
+                raise CaseError("Lab register must contain records")
+            for record in register["records"]:
+                if (not isinstance(record, dict) or not isinstance(record.get("id"), str)
+                        or not record["id"] or record["id"] in self.records):
+                    raise CaseError("Lab record IDs must be distinct non-empty strings")
+                self.records[record["id"]] = record
+            self.lab_register_sha256 = lab_register_sha256
+        elif lab_register_sha256 is not None:
+            raise CaseError("Lab register pin needs a configured register")
+        self.capacity = asyncio.Semaphore(4)
+
+    def assess(self, part: Part) -> tuple[bytes, str, dict, str | None]:
+        if part.WhichOneof("content") != "raw" or not part.raw or len(part.raw) > MAX_CASE_BYTES:
+            raise CaseError("supply one bounded raw JSON part")
+        metadata = MessageToDict(part.metadata)
+        raw_hash = digest(part.raw)
+        expected = {"sha256", "length", "policy_sha256" if part.media_type == CASE_MIME
+                    else "register_sha256"}
+        if (set(metadata) != expected or metadata.get("sha256") != raw_hash
+                or isinstance(metadata.get("length"), bool)
+                or metadata.get("length") != len(part.raw)):
+            raise CaseError("raw part binding is missing or differs")
+        value = parse_raw(part.raw)
+        if part.media_type == CASE_MIME:
+            if metadata["policy_sha256"] != self.policy_sha256:
+                raise CaseError("consumer policy digest differs")
+            result = adjudicate(value, copy.deepcopy(self.policy), self.artifact_root)
+            bindings = {"case_sha256": raw_hash, "policy_sha256": self.policy_sha256,
+                        "policy_source_sha256": self.policy_source_sha256}
+            return canonical_json(result), DECISION_MIME, bindings, render_packet(result)
+        if part.media_type == LAB_QUERY_MIME:
+            if (not self.lab_register_sha256
+                    or metadata["register_sha256"] != self.lab_register_sha256):
+                raise CaseError("Lab register digest differs")
+            if (not isinstance(value, dict) or set(value) != {"record_id"}
+                    or not isinstance(value["record_id"], str)
+                    or value["record_id"] not in self.records):
+                raise CaseError("unknown Lab record ID")
+            result = {"schema_version": "probity-lab-record/v1",
+                      "register_sha256": self.lab_register_sha256,
+                      "record": self.records[value["record_id"]]}
+            return canonical_json(result), LAB_RECORD_MIME, {
+                "register_sha256": self.lab_register_sha256}, None
+        raise CaseError("unsupported input media type")
+
+    async def execute(self, context: RequestContext, event_queue: EventQueue) -> None:
+        message = context.message
+        if (not message or len(message.parts) != 1
+                or not context.task_id or not context.context_id):
+            raise InvalidParamsError(message="Supply a new request with one raw JSON part")
+        try:
+            async with self.capacity:
+                raw, mime, bindings, packet = await asyncio.to_thread(self.assess, message.parts[0])
+        except (CaseError, ValueError, OSError, RecursionError) as exc:
+            raise InvalidParamsError(message=str(exc)) from exc
+        await event_queue.enqueue_event(Task(
+            id=context.task_id, context_id=context.context_id,
+            status=TaskStatus(state=TaskState.TASK_STATE_SUBMITTED), history=[message]))
+        updater = TaskUpdater(event_queue, context.task_id, context.context_id)
+        parts = [Part(raw=raw, media_type=mime,
+                      metadata={**bindings, "sha256": digest(raw), "length": len(raw)})]
+        if packet is not None:
+            parts.append(Part(text=packet, media_type="text/plain"))
+        await updater.add_artifact(parts, name="probity-result", last_chunk=True)
+        await updater.complete()
+
+    async def cancel(self, context: RequestContext, event_queue: EventQueue) -> None:
+        raise UnsupportedOperationError(message="Assessments complete in one request")
+
+
+class BoundedJSON:
+    """Admit bounded raw HTTP JSON before the SDK's protocol parsing."""
+
+    def __init__(self, app: Starlette) -> None:
+        self.app = app
+
+    async def __call__(self, scope, receive, send) -> None:
+        if scope["type"] != "http" or scope["method"] != "POST":
+            await self.app(scope, receive, send)
+            return
+        body = bytearray()
+        while True:
+            event = await receive()
+            if event["type"] == "http.disconnect":
+                return
+            body.extend(event.get("body", b""))
+            if len(body) > MAX_REQUEST_BYTES:
+                response = JSONResponse({"error": "request exceeds the byte limit"}, status_code=413)
+                await response(scope, receive, send)
+                return
+            if not event.get("more_body", False):
+                break
+        try:
+            value = parse_raw(bytes(body))
+        except (CaseError, ValueError, RecursionError) as exc:
+            response = JSONResponse({"jsonrpc": "2.0", "id": None,
+                                     "error": {"code": -32600, "message": str(exc)}})
+            await response(scope, receive, send)
+            return
+        if isinstance(value, dict) and isinstance(value.get("params"), dict):
+            message = value["params"].get("message")
+            if isinstance(message, dict) and (message.get("taskId") or message.get("task_id")):
+                response = JSONResponse({"jsonrpc": "2.0", "id": value.get("id"),
+                                         "error": {"code": -32602,
+                                                   "message": "Supply a new assessment request"}})
+                await response(scope, receive, send)
+                return
+
+        async def replay():
+            return {"type": "http.request", "body": bytes(body), "more_body": False}
+
+        await self.app(scope, replay, send)
+
+
+def create_app(policy: bytes, artifact_root: Path, base_url: str,
+               lab_register: bytes | None = None,
+               lab_register_sha256: str | None = None):
+    url = urlsplit(base_url)
+    if url.scheme not in {"http", "https"} or not url.netloc or url.path not in {"", "/"}:
+        raise CaseError("base URL must be an HTTP origin")
+    if url.username or url.password or url.query or url.fragment:
+        raise CaseError("base URL must be an HTTP origin")
+    base_url = base_url.rstrip("/")
+    executor = VerifyExecutor(policy, artifact_root, lab_register, lab_register_sha256)
+    skills = [AgentSkill(id="verify_case", name="Verify a pinned case",
+                        description="Assess raw case bytes against operator-held policy and artifacts.",
+                        tags=["evidence", "verification"], input_modes=[CASE_MIME],
+                        output_modes=[DECISION_MIME, "text/plain"])]
+    if executor.lab_register_sha256:
+        skills.append(AgentSkill(id="read_lab_record", name="Read a pinned Lab record",
+                                 description="Return one retained publisher record from the configured register.",
+                                 tags=["evidence", "research"], input_modes=[LAB_QUERY_MIME],
+                                 output_modes=[LAB_RECORD_MIME]))
+    card = AgentCard(name="Probity Verify", version="0.1.0",
+                     description="Consumer-policy assessments and pinned Lab record reads.",
+                     documentation_url="https://github.com/probityai/probity-verify/blob/main/docs/a2a.md",
+                     capabilities=AgentCapabilities(streaming=False, push_notifications=False),
+                     default_input_modes=[skill.input_modes[0] for skill in skills],
+                     default_output_modes=list(dict.fromkeys(mode for skill in skills
+                                                              for mode in skill.output_modes)), skills=skills,
+                     supported_interfaces=[AgentInterface(protocol_binding="JSONRPC", protocol_version="1.0",
+                                                           url=base_url + "/a2a/jsonrpc")])
+    handler = DefaultRequestHandler(executor, BoundedTaskStore(), card)
+    discovery = ("# Probity Verify\n\nA2A 1.0 JSON-RPC.\n"
+                 f"Agent card: {base_url}/.well-known/agent-card.json\n"
+                 f"POST: {base_url}/a2a/jsonrpc\n"
+                 f"Consumer policy SHA-256: {executor.policy_sha256}\n"
+                 f"Policy source SHA-256: {executor.policy_source_sha256}\n"
+                 "Send raw JSON case bytes with length, SHA-256 and consumer policy digest.\n"
+                 "Results are byte-bound Verify decision packets. The latest 128 tasks last for this process.\n")
+    if executor.lab_register_sha256:
+        discovery += f"Lab register SHA-256: {executor.lab_register_sha256}\n"
+
+    async def llms(request):
+        return PlainTextResponse(discovery)
+
+    routes = create_agent_card_routes(card) + create_jsonrpc_routes(handler, "/a2a/jsonrpc")
+    routes.append(Route("/llms.txt", llms))
+    return BoundedJSON(Starlette(routes=routes))
+
+
+def main(argv: list[str] | None = None) -> int:
+    parser = argparse.ArgumentParser(prog="probity-a2a")
+    parser.add_argument("--policy", type=Path, required=True)
+    parser.add_argument("--artifact-root", type=Path, required=True)
+    parser.add_argument("--lab-register", type=Path)
+    parser.add_argument("--lab-register-sha256")
+    parser.add_argument("--host", default="127.0.0.1")
+    parser.add_argument("--port", type=int, default=41241)
+    args = parser.parse_args(argv)
+    try:
+        if not ipaddress.ip_address(args.host).is_loopback or not 1 <= args.port <= 65535:
+            raise CaseError("bind to a loopback address and a valid port")
+        origin = f"http://[{args.host}]:{args.port}" if ":" in args.host else f"http://{args.host}:{args.port}"
+        app = create_app(read_bounded(args.policy, 4 * 1024 * 1024), args.artifact_root, origin,
+                         read_bounded(args.lab_register, 16 * 1024 * 1024) if args.lab_register else None,
+                         args.lab_register_sha256)
+    except (CaseError, ValueError, OSError, RecursionError) as exc:
+        print(f"probity-a2a: {exc}", file=sys.stderr)
+        return 2
+    import uvicorn
+    uvicorn.run(app, host=args.host, port=args.port, access_log=False, limit_concurrency=16)
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

probity_verify/adapters/__init__.py

@@ -0,0 +1 @@
+"""Versioned claim adapters. Each returns the common decision envelope."""

probity_verify/adapters/authority_anchor.py

@@ -0,0 +1,148 @@
+"""Match an identity claim against a consumer-pinned authority capture."""
+
+from __future__ import annotations
+
+import json
+from pathlib import Path
+from typing import Any
+from urllib.parse import urlsplit
+
+from ..common import CaseError, _artifact, _digest, _instant, _object, _string
+
+CLAIM_TYPE = "authority_anchor/v1"
+
+
+def _https_url(value: Any, label: str) -> str:
+    url = _string(value, label)
+    try:
+        parsed = urlsplit(url)
+        if (parsed.scheme != "https" or not parsed.hostname or parsed.username or
+                parsed.password or parsed.fragment):
+            raise ValueError()
+        parsed.port
+    except ValueError as exc:
+        raise CaseError(f"{label}: expected HTTPS URL without credentials or fragment") from exc
+    return url
+
+
+def _capture(data: bytes) -> dict:
+    """Read a bound JSON capture without accepting ambiguous object keys."""
+    def unique(pairs: list[tuple[str, Any]]) -> dict:
+        value: dict = {}
+        for key, item in pairs:
+            if key in value:
+                raise ValueError("duplicate JSON key")
+            value[key] = item
+        return value
+
+    try:
+        value = json.loads(data.decode("utf-8"), object_pairs_hook=unique,
+                           parse_constant=lambda _: (_ for _ in ()).throw(ValueError()))
+    except (UnicodeDecodeError, ValueError) as exc:
+        raise CaseError("capture is not unambiguous UTF-8 JSON") from exc
+    return _object(value, "capture", {"schema_version", "request_url", "captured_at",
+                                      "status", "body"})
+
+
+def _pointer(body: Any, pointer: str) -> str | None:
+    """Resolve an RFC 6901 pointer. A missing or non-string field is unavailable."""
+    current = body
+    for part in pointer.split("/")[1:]:
+        key = part.replace("~1", "/").replace("~0", "~")
+        if isinstance(current, dict):
+            if key not in current:
+                return None
+            current = current[key]
+        elif (isinstance(current, list) and key.isascii() and key.isdecimal() and
+              len(key) <= 19 and (key == "0" or not key.startswith("0")) and
+              int(key) < len(current)):
+            current = current[int(key)]
+        else:
+            return None
+    return current if isinstance(current, str) else None
+
+
+def adjudicate(case: Any, policy: Any, artifact_root: Path) -> dict:
+    """Decide an exact JSON field in a bound capture, within a policy time window.
+
+    The consumer must establish the capture's provenance outside this program.
+    The program neither contacts the authority nor authenticates its transport.
+    """
+    case = _object(case, "case", {"schema_version", "case_id", "artifacts"})
+    policy = _object(policy, "policy", {"schema_version", "witnesses", "assessments"})
+    if case["schema_version"] != "probity-case/v1" or policy["schema_version"] != "probity-policy/v1":
+        raise CaseError("unsupported schema_version")
+    case_id = _string(case["case_id"], "case_id")
+    artifacts = case["artifacts"]
+    witnesses = policy["witnesses"]
+    assessments = policy["assessments"]
+    if not isinstance(artifacts, dict) or not isinstance(witnesses, dict) or not isinstance(assessments, dict):
+        raise CaseError("artifacts, witnesses, and assessments: expected objects")
+    if case_id not in assessments:
+        raise CaseError("case_id has no consumer assessment")
+    assessment = _object(assessments[case_id], "assessment", {
+        "claim_type", "capture_witness", "request_url", "json_pointer",
+        "expected_value", "capture_window"
+    })
+    if assessment["claim_type"] != CLAIM_TYPE:
+        raise CaseError("unsupported claim_type")
+    witness_id = _string(assessment["capture_witness"], "capture_witness")
+    request_url = _https_url(assessment["request_url"], "request_url")
+    expected = _string(assessment["expected_value"], "expected_value")
+    pointer = _string(assessment["json_pointer"], "json_pointer")
+    if not pointer.startswith("/") or any(
+        pointer[i + 1:i + 2] not in {"0", "1"}
+        for i, char in enumerate(pointer) if char == "~"
+    ):
+        raise CaseError("json_pointer: expected nonempty RFC 6901 pointer")
+    window = _object(assessment["capture_window"], "capture_window", {"start", "end"})
+    start = _instant(window["start"], "capture_window.start")
+    end = _instant(window["end"], "capture_window.end")
+    if end < start:
+        raise CaseError("capture_window.end precedes start")
+    if witness_id not in witnesses:
+        raise CaseError("capture_witness has no consumer pin")
+    witness = _object(witnesses[witness_id], "witness", {"artifact", "sha256", "authority"})
+    artifact_id = _string(witness["artifact"], "witness.artifact")
+    pinned = _digest(witness["sha256"], "witness.sha256")
+    authority = _string(witness["authority"], "witness.authority")
+    if artifact_id not in artifacts:
+        raise CaseError("capture_witness names no case artifact")
+    data, binding = _artifact(artifact_root, artifacts[artifact_id], f"artifacts.{artifact_id}")
+    scope = {
+        "claim_type": CLAIM_TYPE, "request_url": request_url,
+        "capture_window": window, "json_pointer": pointer, "expected_value": expected,
+        "witness": {"id": witness_id, "authority": authority,
+                    "consumer_pinned_sha256": pinned, "artifact": binding},
+        "limit": "The consumer pinned these capture bytes. This program does not authenticate the authority, transport, or capture time, or infer that a class-level detection stamp proves this particular observation.",
+    }
+    result = {"schema_version": "probity-decision/v1", "case_id": case_id,
+              "claim_type": CLAIM_TYPE, "scope": scope, "checks": []}
+    if data is None or binding["sha256"] != pinned:
+        return {**result, "decision": "not_established", "reason": "witness_unavailable_or_unbound"}
+    try:
+        capture = _capture(data)
+        if capture["schema_version"] != "probity-http-capture/v1":
+            raise CaseError("unsupported capture schema_version")
+        observed_at = _instant(capture["captured_at"], "capture.captured_at")
+        if type(capture["status"]) is not int or not 100 <= capture["status"] <= 599:
+            raise CaseError("capture.status: expected HTTP status")
+        _https_url(capture["request_url"], "capture.request_url")
+    except CaseError:
+        return {**result, "decision": "not_established", "reason": "capture_unreadable"}
+    scope["witness"]["captured_at"] = capture["captured_at"]
+    scope["witness"]["status"] = capture["status"]
+    if capture["request_url"] != request_url:
+        return {**result, "decision": "not_established", "reason": "capture_target_mismatch"}
+    if not start <= observed_at <= end:
+        return {**result, "decision": "not_established", "reason": "capture_outside_window"}
+    if capture["status"] != 200:
+        return {**result, "decision": "not_established", "reason": "authority_response_unavailable"}
+    observed = _pointer(capture["body"], pointer)
+    result["checks"] = [{"id": "anchor", "status": "unavailable" if observed is None else
+                         "met" if observed == expected else "failed", "observed": observed}]
+    if observed is None:
+        return {**result, "decision": "not_established", "reason": "field_unavailable"}
+    if observed != expected:
+        return {**result, "decision": "contradicted", "reason": "anchor_mismatch"}
+    return {**result, "decision": "supported", "reason": "anchor_matches"}