techtree 0.1.0__py3-none-any.whl

techtree/publication/transport.py

@@ -0,0 +1,296 @@
+"""The one place in this package that opens a socket. Decisions document 0038.
+
+Everything else about publishing — reading a bundle, checking it, asking a
+person, writing a receipt down, recording the outcome — is local work on local
+files, and it is testable exactly as the rest of this project is. One step is
+not: the request itself. There is no public endpoint yet, and there will never
+be one a unit test may reach.
+
+So the request is a seam and nothing else is. :class:`PublicationTransport` takes
+bytes and an address and returns bytes; it knows nothing about what a submission
+is, what a receipt is, or whether either verifies. That keeps the substitutable
+part as small as a thing can be: a test replaces one method, and every decision
+the product makes about publishing is still the real code making it.
+
+Two rules hold here rather than at the call site, because they are properties of
+the transport rather than of the product.
+
+*Only ``https``.* What travels is a signed proof bundle, and sometimes an
+address somebody typed. Neither goes over a channel anybody can read or rewrite,
+and a scheme that permitted it would be a setting somebody could get wrong once.
+
+*Nothing in the address bar.* The submission is a request body. Nothing this
+module sends is ever appended to a URL or a query string, so nothing can end up
+in a proxy log, in an access log, or in a browser history.
+
+*A volunteered address travels beside the body, never inside it.* The run log
+stores the submission it was given and serves those exact bytes back at a public
+address, so anything inside the body is public by construction. An address is
+not, so it goes in a header the log reads and does not echo. This is the shape
+the receiving side settled on for the same reason, and the two halves have to
+agree or the log refuses the submission.
+
+*No redirect is followed.* This one was a docstring before it was a behaviour.
+``urlopen``'s default opener follows redirects, so an address that answered
+``302`` would have had the proof bundle — and the private contributor header —
+re-sent to whatever origin it named, with none of the checks above applying to
+the second request. The opener below is built with a redirect handler that
+declines to build a redirected request at all, so a redirect is reported as a
+refusal and nothing leaves this machine twice.
+
+*The answer has to be JSON, and it has to end.* A run log answers with a
+receipt; anything else is a misconfigured address or a captive portal, and
+parsing it would only turn one problem into a confusing one. The size cap is
+read *plus one byte*, because reading exactly the cap proves only that the cap
+was reached — the response may have continued, and a truncated document that
+parses is worse than one that does not.
+"""
+
+from __future__ import annotations
+
+import http.client
+import urllib.error
+import urllib.request
+from typing import Final, Protocol
+from urllib.parse import urlsplit
+
+from techtree.errors import TechtreeError, ValidationError
+from techtree.release.models import PublicationCoordinates
+
+__all__ = [
+    "CONTRIBUTOR_ADDRESS_HEADER",
+    "MAX_RESPONSE_BYTES",
+    "PUBLICATION_ENDPOINT_INVALID",
+    "PUBLICATION_RESPONSE_NOT_JSON",
+    "PUBLICATION_RESPONSE_TOO_LARGE",
+    "PUBLICATION_TRANSPORT_FAILED",
+    "PUBLICATION_TRANSPORT_REDIRECTED",
+    "SKILL_GITHUB_URL_HEADER",
+    "SKILL_NAME_HEADER",
+    "HttpsPublicationTransport",
+    "PublicationMetadataTransport",
+    "PublicationTransport",
+    "resolved_endpoint",
+    "validated_endpoint",
+]
+
+#: Stable error code for a configured endpoint that is not one.
+PUBLICATION_ENDPOINT_INVALID: Final = "publication_endpoint_invalid"
+
+#: Stable error code for a request that did not come back with a receipt.
+PUBLICATION_TRANSPORT_FAILED: Final = "publication_transport_failed"
+
+#: Stable error code for an address that answered by pointing somewhere else.
+PUBLICATION_TRANSPORT_REDIRECTED: Final = "publication_transport_redirected"
+
+#: Stable error code for an answer that is not a JSON document.
+PUBLICATION_RESPONSE_NOT_JSON: Final = "publication_response_not_json"
+
+#: Stable error code for an answer that did not end inside the size cap.
+PUBLICATION_RESPONSE_TOO_LARGE: Final = "publication_response_too_large"
+
+_MEDIA_TYPE: Final = "application/json"
+_TIMEOUT_SECONDS: Final = 120.0
+
+#: Where a volunteered address travels. Beside the body, never inside it: the
+#: run log serves a stored submission back at a public address.
+CONTRIBUTOR_ADDRESS_HEADER: Final = "x-techtree-contributor-address"
+
+#: Public descriptive metadata travels beside the fixed proof body. The
+#: receiving side may store these headers with the immutable log entry, while
+#: the submission document itself remains the four-member contract.
+SKILL_NAME_HEADER: Final = "x-techtree-skill-name"
+SKILL_GITHUB_URL_HEADER: Final = "x-techtree-skill-github-url"
+
+#: Enough for a proof bundle several times over, and small enough that a
+#: misconfigured address answering with something enormous is refused rather
+#: than read into memory.
+MAX_RESPONSE_BYTES: Final = 4 * 1024 * 1024
+
+
+class PublicationTransport(Protocol):
+    """Send one submission and return whatever came back."""
+
+    def submit(
+        self, *, endpoint: str, body: bytes, contributor_address: str | None
+    ) -> bytes:
+        """Return the response body, or raise a typed failure."""
+        ...
+
+
+class PublicationMetadataTransport(Protocol):
+    """Transport seam extended with optional public Skill metadata headers."""
+
+    def submit(
+        self,
+        *,
+        endpoint: str,
+        body: bytes,
+        contributor_address: str | None,
+        skill_name: str | None = None,
+        skill_github_url: str | None = None,
+    ) -> bytes:
+        """Return the response body, or raise a typed failure."""
+        ...
+
+
+class _RefuseRedirects(urllib.request.HTTPRedirectHandler):
+    """A redirect handler that builds no redirected request.
+
+    Returning ``None`` from :meth:`redirect_request` is urllib's own way of
+    saying "this redirect is not to be followed". The handler chain then falls
+    through to the default error handler, which raises the ``3xx`` as an
+    :class:`urllib.error.HTTPError`, and :class:`HttpsPublicationTransport`
+    turns that into a refusal naming the redirect rather than a bare status.
+    """
+
+    def redirect_request(
+        self,
+        req: urllib.request.Request,
+        fp: object,
+        code: int,
+        msg: str,
+        headers: object,
+        newurl: str,
+    ) -> None:
+        """Decline to build the second request."""
+        return None
+
+
+def _opener() -> urllib.request.OpenerDirector:
+    """Return the opener every publication request goes through.
+
+    Built rather than taken from :func:`urllib.request.urlopen`, whose default
+    opener follows redirects. ``build_opener`` leaves out the default handler of
+    any class an argument is an instance of, so passing the subclass above is
+    what replaces redirect-following rather than adding to it.
+    """
+    return urllib.request.build_opener(_RefuseRedirects())
+
+
+class HttpsPublicationTransport:
+    """The real request: one POST, one response, no redirects followed."""
+
+    def submit(
+        self,
+        *,
+        endpoint: str,
+        body: bytes,
+        contributor_address: str | None,
+        skill_name: str | None = None,
+        skill_github_url: str | None = None,
+    ) -> bytes:
+        """POST ``body`` to ``endpoint`` and return the response bytes."""
+        headers = {
+            "Content-Type": _MEDIA_TYPE,
+            "Accept": _MEDIA_TYPE,
+            "Content-Length": str(len(body)),
+        }
+        if contributor_address is not None:
+            headers[CONTRIBUTOR_ADDRESS_HEADER] = contributor_address
+        if skill_name is not None:
+            headers[SKILL_NAME_HEADER] = skill_name
+        if skill_github_url is not None:
+            headers[SKILL_GITHUB_URL_HEADER] = skill_github_url
+        request = urllib.request.Request(
+            validated_endpoint(endpoint),
+            data=body,
+            method="POST",
+            headers=headers,
+        )
+        try:
+            with _opener().open(request, timeout=_TIMEOUT_SECONDS) as response:
+                return _response_bytes(response)
+        except urllib.error.HTTPError as error:
+            if 300 <= error.code < 400:
+                raise TechtreeError(
+                    f"the run log answered HTTP {error.code} and pointed "
+                    "somewhere else, and a proof bundle is not re-sent to an "
+                    "address that was not the one agreed to",
+                    code=PUBLICATION_TRANSPORT_REDIRECTED,
+                    retryable=False,
+                    details={"status": error.code},
+                ) from error
+            raise TechtreeError(
+                f"the run log refused this submission: HTTP {error.code}",
+                code=PUBLICATION_TRANSPORT_FAILED,
+                retryable=error.code >= 500,
+                details={"status": error.code},
+            ) from error
+        except (urllib.error.URLError, OSError, TimeoutError) as error:
+            raise TechtreeError(
+                "the run log could not be reached, so nothing was sent",
+                code=PUBLICATION_TRANSPORT_FAILED,
+                retryable=True,
+                details={"reason": type(error).__name__},
+            ) from error
+
+
+def _response_bytes(response: http.client.HTTPResponse) -> bytes:
+    """Return the answer, having proved it is a JSON document that ended.
+
+    Both refusals are here rather than at the call site because both are
+    properties of the exchange rather than of what the document turns out to
+    say. A receipt is refused later for being the wrong receipt; this is refused
+    now for not being an answer at all.
+    """
+    media_type = response.headers.get_content_type()
+    if media_type != _MEDIA_TYPE:
+        raise TechtreeError(
+            f"the run log answered with {media_type} rather than {_MEDIA_TYPE}, "
+            "so what came back is not a publication receipt",
+            code=PUBLICATION_RESPONSE_NOT_JSON,
+            retryable=False,
+            details={"content_type": media_type},
+        )
+
+    # One byte past the cap. Reading exactly the cap and getting exactly the cap
+    # back says the answer reached the limit, not that it stopped there.
+    raw = bytes(response.read(MAX_RESPONSE_BYTES + 1))
+    if len(raw) > MAX_RESPONSE_BYTES:
+        raise TechtreeError(
+            f"the run log's answer is longer than {MAX_RESPONSE_BYTES} bytes, "
+            "which no publication receipt is, so none of it was read further",
+            code=PUBLICATION_RESPONSE_TOO_LARGE,
+            retryable=False,
+            details={"limit": MAX_RESPONSE_BYTES},
+        )
+    return raw
+
+
+def resolved_endpoint(coordinates: PublicationCoordinates, override: str | None) -> str:
+    """Return the address a publication or a withdrawal is sent to.
+
+    The override first, then the release coordinate. A stable release publishes
+    with nothing configured, because the address is pinned in the ReleaseCore
+    the wheel carries (decisions 0038's founder ruling of 2026-08-27): a wheel
+    somebody installed can publish the moment it is installed, and nobody has to
+    be told to set a variable they could set wrongly.
+
+    The override stays for development, where a throwaway local instance stands
+    in for the deployed one. It is checked as an address and the pinned one is
+    not, because the pinned one was already checked when the release document
+    was validated and the override is the one a person can get wrong today.
+    """
+    if override is not None:
+        return validated_endpoint(override)
+    return coordinates.submission_endpoint
+
+
+def validated_endpoint(endpoint: str) -> str:
+    """Return the endpoint, or refuse an address nothing may be sent to."""
+    parts = urlsplit(endpoint)
+    if parts.scheme != "https" or not parts.netloc:
+        raise ValidationError(
+            "a run log address is an https URL, and this one is not",
+            code=PUBLICATION_ENDPOINT_INVALID,
+            details={"scheme": parts.scheme},
+        )
+    if parts.query or parts.fragment:
+        raise ValidationError(
+            "a run log address carries no query string: a submission travels "
+            "in the request body and never in a URL",
+            code=PUBLICATION_ENDPOINT_INVALID,
+            details={"scheme": parts.scheme},
+        )
+    return endpoint

techtree/publication/verify.py

@@ -0,0 +1,242 @@
+"""Checking what the run log answered. Decisions document 0038.
+
+A countersignature is only worth the prior knowledge of which key made it. A
+receipt that carries a key and a signature and is checked against *itself*
+proves nothing at all: a server that wanted to lie would generate a key, sign
+its own invention with it, and hand a participant both halves of a consistent
+fiction. So the key is not learned from the answer. It is pinned in the release
+(:class:`~techtree.release.models.PublicationCoordinates`), and everything below
+is checked against the pin.
+
+Six things have to hold before a receipt is written into a run directory, and
+they are six rather than one because each closes a different way of being lied
+to.
+
+*The digest matches the payload.* An envelope carries the digest it was signed
+under and never recomputes it while parsing, so a payload edited after signing
+keeps a digest that no longer describes it. Recomputing here is what catches
+that, and it is the same check every other signed document in this protocol
+gets.
+
+*The signature names the pinned key.* Not a key, the key. A different identifier
+is a different key, including a rotated one: rotation is a new key and a new
+release that pins it.
+
+*The receipt carries the key it names.* The identifier is the digest of the
+public key, so a receipt whose carried key does not hash to the identifier it
+names is inconsistent with itself, and it is caught without a rule of its own.
+
+*The signature verifies.* Against the pinned public key and the digest, which is
+the only step that involves any cryptography and the only one that would be
+sufficient if the five around it were not needed to make it mean something.
+
+*The receipt is for what was sent.* A receipt naming another run or another
+bundle is somebody else's evidence, and filing it in this run's directory would
+put a false record beside a true one.
+
+*The entry is on the log this release pins, and every reported check passed.* An
+address on another origin is a link somebody else chose. A receipt that reports
+a check it did not pass has not accepted the submission, whatever else it says.
+
+Nothing here contacts anything, and nothing here writes anything. It answers one
+question — is this the run log's own word about the thing I sent — and the caller
+decides what to do about the answer.
+"""
+
+from __future__ import annotations
+
+from base64 import b64decode
+from typing import Final, NoReturn
+from urllib.parse import urlsplit
+
+from techtree.canonical import digest_object
+from techtree.crypto import load_public_key, verify_signature
+from techtree.errors import ValidationError
+from techtree.models.base import Digest, JsonValue, ObjectEnvelope, PublicKeyRef
+from techtree.publication.models import (
+    PublicationReceiptPayload,
+    WithdrawalReceiptPayload,
+)
+from techtree.release.models import PublicationCoordinates
+
+__all__ = [
+    "PUBLICATION_RECEIPT_INVALID",
+    "verify_publication_receipt",
+    "verify_withdrawal_receipt",
+]
+
+#: Stable error code for every way an answer fails to be the run log's own word
+#: about what was sent. One code with a named check in its details, rather than
+#: six codes: a caller acts on all of them the same way — it writes nothing down
+#: — and the detail is what a person needs to understand which one it was.
+PUBLICATION_RECEIPT_INVALID: Final = "publication_receipt_invalid"
+
+
+def verify_publication_receipt(
+    envelope: ObjectEnvelope[PublicationReceiptPayload],
+    *,
+    coordinates: PublicationCoordinates,
+    run_id: str,
+    bundle_digest: Digest,
+) -> None:
+    """Raise unless this is the pinned run log's receipt for what was sent.
+
+    Args:
+        envelope: what the run log answered, already parsed.
+        coordinates: the endpoint, public log origin and network key this
+            release pins.
+        run_id: the run whose proof was submitted.
+        bundle_digest: the bundle digest that was submitted.
+
+    Raises:
+        ValidationError: on the first check that does not hold, naming it.
+    """
+    receipt = envelope.payload
+    _check_countersignature(envelope, coordinates, subject=run_id)
+
+    if receipt.run_id != run_id or receipt.bundle_digest != bundle_digest:
+        _refuse(
+            "receipt.subject",
+            "the run log's receipt is for a different submission than the one "
+            "that was sent",
+            run_id=run_id,
+            receipt_run_id=receipt.run_id,
+            receipt_bundle_digest=receipt.bundle_digest,
+        )
+
+    _check_entry_url(receipt.entry_url, coordinates, subject=run_id)
+
+    if receipt.failed_checks:
+        _refuse(
+            "receipt.checks",
+            f"the run log accepted nothing: {receipt.failed_checks[0].detail}",
+            run_id=run_id,
+            failed_checks=[check.id for check in receipt.failed_checks],
+        )
+
+
+def verify_withdrawal_receipt(
+    envelope: ObjectEnvelope[WithdrawalReceiptPayload],
+    *,
+    coordinates: PublicationCoordinates,
+    bundle_digest: Digest,
+) -> None:
+    """Raise unless this is the pinned run log's record of this withdrawal.
+
+    The same countersignature and the same origin rule as a publication
+    receipt, because it is the same key making the same kind of statement. What
+    it does not check is a list of checks: a withdrawal is a request the network
+    either honoured or refused, and a refusal is a status rather than a document.
+
+    Args:
+        envelope: what the run log answered, already parsed.
+        coordinates: the endpoint, public log origin and network key this
+            release pins.
+        bundle_digest: the entry the withdrawal was asked for.
+
+    Raises:
+        ValidationError: on the first check that does not hold, naming it.
+    """
+    receipt = envelope.payload
+    _check_countersignature(envelope, coordinates, subject=bundle_digest)
+
+    if receipt.bundle_digest != bundle_digest:
+        _refuse(
+            "withdrawal.subject",
+            "the run log's answer withdraws a different entry than the one "
+            "that was asked for",
+            bundle_digest=bundle_digest,
+            receipt_bundle_digest=receipt.bundle_digest,
+        )
+
+    _check_entry_url(receipt.entry_url, coordinates, subject=bundle_digest)
+
+
+# ---------------------------------------------------------------------------
+# The checks both answers get
+# ---------------------------------------------------------------------------
+
+
+def _check_countersignature(
+    envelope: ObjectEnvelope[PublicationReceiptPayload]
+    | ObjectEnvelope[WithdrawalReceiptPayload],
+    coordinates: PublicationCoordinates,
+    *,
+    subject: str,
+) -> None:
+    """Raise unless the pinned network key signed exactly these payload bytes."""
+    computed = digest_object(envelope.payload)
+    if computed != envelope.payload_digest:
+        _refuse(
+            "receipt.payload_digest",
+            "the run log's answer no longer matches the digest it was signed "
+            f"under: sealed {envelope.payload_digest}, computed {computed}",
+            subject=subject,
+        )
+
+    signature = envelope.signature
+    if signature is None:
+        _refuse(
+            "receipt.signature_present",
+            "the run log's answer carries no signature, so nothing countersigns it",
+            subject=subject,
+        )
+
+    pinned = coordinates.network_key
+    if signature.key_id != pinned.key_id:
+        _refuse(
+            "receipt.signature_key",
+            f"the run log's answer is signed by key {signature.key_id}, which "
+            f"is not the key {pinned.key_id} this release publishes to",
+            subject=subject,
+        )
+
+    if not _same_key(envelope.payload.public_key, pinned):
+        _refuse(
+            "receipt.carried_key",
+            "the run log's answer names the pinned key and carries a different one",
+            subject=subject,
+        )
+
+    public_key = load_public_key(b64decode(pinned.public_key, validate=True))
+    if not verify_signature(public_key, envelope.payload_digest, signature):
+        _refuse(
+            "receipt.signature",
+            "the run log's answer does not verify against the public key this "
+            "release pins",
+            subject=subject,
+        )
+
+
+def _check_entry_url(
+    entry_url: str, coordinates: PublicationCoordinates, *, subject: str
+) -> None:
+    """Raise unless the entry lives on the public log this release pins."""
+    pinned = urlsplit(coordinates.public_log_url)
+    entry = urlsplit(entry_url)
+    if entry.scheme != "https" or entry.netloc != pinned.netloc:
+        _refuse(
+            "receipt.entry_url",
+            f"the run log says this entry lives at {entry_url}, which is not on "
+            f"{coordinates.public_log_url}",
+            subject=subject,
+            entry_url=entry_url,
+        )
+
+
+def _same_key(carried: PublicKeyRef, pinned: PublicKeyRef) -> bool:
+    """Return whether two key references describe the same key, field for field."""
+    return (
+        carried.algorithm == pinned.algorithm
+        and carried.key_id == pinned.key_id
+        and carried.public_key == pinned.public_key
+    )
+
+
+def _refuse(check: str, message: str, **details: JsonValue) -> NoReturn:
+    """Raise the one refusal, naming which check did not hold."""
+    raise ValidationError(
+        message,
+        code=PUBLICATION_RECEIPT_INVALID,
+        details={"check": check, **details},
+    )

techtree/publication/withdraw.py

@@ -0,0 +1,156 @@
+"""Withdrawing one published entry. Decisions document 0038.
+
+The founder settled two things about withdrawal on 2026-08-27 and this module
+is both of them.
+
+*A published entry is withdrawn, never deleted.* Withdrawal is an appended
+event: the entry stays where it is, marked, and the address it lives at goes on
+answering. Nothing here asks for removal, and what comes back names where the
+entry still is rather than reporting that it is gone.
+
+*It is implemented rather than promised.* A public promise with no executable
+path would be worse than neither, so this is the executable path. The
+participant signs a canonical request with the same key that signed the run —
+the identity store already holds it, and it is the only key this machine has —
+and the network verifies that signature against the participant key inside the
+publication it already accepted. That is why the request carries no public key
+of its own: a key that arrived with the request would be a key the requester
+chose, and looking it up in the accepted bundle instead is the whole of the
+authorisation.
+
+Two things are deliberately absent.
+
+*No reason.* Nothing a submitter writes appears on the site, and a free-text
+reason attached to a public entry is the one string that would. There is no
+field for one and there will not be one.
+
+*No local record.* The public log is the record of a withdrawal, because that is
+where the appended event lives. Writing a second one beside the run would make
+this machine a source of truth about a public log's contents that it cannot
+keep current, and a run directory is addressed by run and a withdrawal by bundle
+digest — a person withdrawing an entry may not have the run on this machine at
+all.
+
+The request goes to the same address a submission goes to. Decisions 0038 gives
+the site exactly one write address, and discriminating on ``schema_version``
+inside one address is what keeps that true.
+"""
+
+from __future__ import annotations
+
+from collections.abc import Callable
+from dataclasses import dataclass
+from datetime import datetime
+
+from pydantic import ValidationError as PydanticValidationError
+
+from techtree.canonical import canonical_json_bytes
+from techtree.constants import PUBLICATION_WITHDRAWAL_SCHEMA_VERSION
+from techtree.errors import ValidationError
+from techtree.identity.service import IdentityService
+from techtree.models.base import Digest, ObjectEnvelope
+from techtree.publication.models import WithdrawalReceiptPayload, WithdrawalRequest
+from techtree.publication.transport import PublicationTransport
+from techtree.publication.verify import (
+    PUBLICATION_RECEIPT_INVALID,
+    verify_withdrawal_receipt,
+)
+from techtree.release.models import PublicationCoordinates
+
+__all__ = [
+    "WithdrawalOutcome",
+    "WithdrawalService",
+]
+
+
+@dataclass(frozen=True)
+class WithdrawalOutcome:
+    """What the run log said when it marked one entry withdrawn."""
+
+    bundle_digest: Digest
+    entry_url: str
+    withdrawn_at: datetime
+    #: The participant key the request was signed with, so a person can see that
+    #: the entry was withdrawn by the identity that published it.
+    key_id: str
+
+
+class WithdrawalService:
+    """Builds, signs and sends one withdrawal, and checks what came back."""
+
+    def __init__(
+        self,
+        *,
+        coordinates: PublicationCoordinates,
+        endpoint: str,
+        identity: IdentityService,
+        transport: PublicationTransport,
+        clock: Callable[[], datetime],
+    ) -> None:
+        self._coordinates = coordinates
+        self._endpoint = endpoint
+        self._identity = identity
+        self._transport = transport
+        self._clock = clock
+
+    @property
+    def endpoint(self) -> str:
+        """Return the address this withdrawal is sent to."""
+        return self._endpoint
+
+    def request(self, bundle_digest: Digest) -> ObjectEnvelope[WithdrawalRequest]:
+        """Return the signed request this withdrawal would send.
+
+        Separate from :meth:`withdraw` so that what is signed can be shown to a
+        person, and inspected by a test, without anything being sent. Signing is
+        local work; only :meth:`withdraw` opens a socket.
+        """
+        return self._identity.sign_object(
+            WithdrawalRequest(
+                schema_version=PUBLICATION_WITHDRAWAL_SCHEMA_VERSION,
+                bundle_digest=bundle_digest,
+                requested_at=self._clock(),
+            )
+        )
+
+    def withdraw(self, bundle_digest: Digest) -> WithdrawalOutcome:
+        """Send the signed withdrawal and return what the run log answered.
+
+        No volunteered address travels with a withdrawal. There is nothing to
+        volunteer: the request is about an entry that already exists, and the
+        header exists for a submission's optional contributor address alone.
+        """
+        signed = self.request(bundle_digest)
+        response = self._transport.submit(
+            endpoint=self.endpoint,
+            body=canonical_json_bytes(signed),
+            contributor_address=None,
+        )
+        receipt = self._receipt(response, bundle_digest)
+        return WithdrawalOutcome(
+            bundle_digest=receipt.bundle_digest,
+            entry_url=receipt.entry_url,
+            withdrawn_at=receipt.withdrawn_at,
+            key_id=self._identity.store.load_public().key_id,
+        )
+
+    def _receipt(
+        self, response: bytes, bundle_digest: Digest
+    ) -> WithdrawalReceiptPayload:
+        """Parse the answer and refuse anything that is not this withdrawal's."""
+        try:
+            envelope = ObjectEnvelope[WithdrawalReceiptPayload].model_validate_json(
+                response
+            )
+        except PydanticValidationError as error:
+            raise ValidationError(
+                "the run log answered with something that is not a withdrawal "
+                "receipt, so nothing is known about what it did",
+                code=PUBLICATION_RECEIPT_INVALID,
+                details={"bundle_digest": bundle_digest},
+            ) from error
+
+        verify_withdrawal_receipt(
+            envelope, coordinates=self._coordinates, bundle_digest=bundle_digest
+        )
+        return envelope.payload