vitnify 0.2.0__tar.gz → 0.2.2__tar.gz

{vitnify-0.2.0/src/vitnify.egg-info → vitnify-0.2.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: vitnify
-Version: 0.2.0
+Version: 0.2.2
 Summary: Execution receipts for AI agents: contain, deterministically reconstruct, and cryptographically certify a run.
 Author: vitnify
 License: Apache-2.0

{vitnify-0.2.0 → vitnify-0.2.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "vitnify"
-version = "0.2.0"
+version = "0.2.2"
 description = "Execution receipts for AI agents: contain, deterministically reconstruct, and cryptographically certify a run."
 readme = "README.md"
 requires-python = ">=3.10"

{vitnify-0.2.0 → vitnify-0.2.2}/src/vitnify/certificate.py

@@ -27,6 +27,10 @@ from .events import EventLog, Kind
 from ._vendor.pck.cas import MerkleCAS  # noqa: E402
 
 FORMAT = "vitnify-receipt v2"
+# A published receipt format is frozen; older receipts must stay verifiable across a
+# verifier upgrade. The verifier accepts every version it has ever issued and
+# reconstructs each receipt's signed body per its own `v` (see body()).
+SUPPORTED_FORMATS = frozenset({"vitnify-receipt v1", FORMAT})
 
 
 def _now_iso() -> str:
@@ -78,14 +82,20 @@ class ExecutionCertificate:
     pubkey: str | None = None       # ed25519 public key (hex) -- verifier needs no secret
 
     def body(self) -> dict:
-        # Everything here is signed. issued_at/nonce/run_id place the receipt in
-        # time and make it unique, so a receipt from one run cannot be presented as
-        # evidence for another.
-        return {"v": self.v, "program_hash": self.program_hash,
-                "capabilities": sorted(self.capabilities), "event_root": self.event_root,
-                "n_events": self.n_events, "head_hash": self.head_hash,
-                "model_digests": list(self.model_digests),
-                "issued_at": self.issued_at, "nonce": self.nonce, "run_id": self.run_id}
+        # Everything here is signed, and the body is VERSIONED: v2+ additionally
+        # binds issued_at/nonce/run_id (which place the receipt in time and make it
+        # unique). Reconstructing the body per the receipt's OWN `v` is what lets a
+        # v2 verifier still verify a receipt signed under v1 -- a published format is
+        # frozen, so older receipts must remain verifiable.
+        b = {"v": self.v, "program_hash": self.program_hash,
+             "capabilities": sorted(self.capabilities), "event_root": self.event_root,
+             "n_events": self.n_events, "head_hash": self.head_hash,
+             "model_digests": list(self.model_digests)}
+        if self.v != "vitnify-receipt v1":
+            b["issued_at"] = self.issued_at
+            b["nonce"] = self.nonce
+            b["run_id"] = self.run_id
+        return b
 
     def digest(self) -> str:
         return _digest32(_canon(self.body()).encode())
@@ -149,7 +159,7 @@ def verify_certificate(cert: ExecutionCertificate, log: EventLog, key: bytes | N
     """
     cas = MerkleCAS(log.chunks())
     checks = {
-        "format": cert.v == FORMAT,
+        "format": cert.v in SUPPORTED_FORMATS,
         "root_matches": cas.root == cert.event_root,
         "head_matches": log.head() == cert.head_hash,
         "count_matches": len(log) == cert.n_events,
@@ -185,6 +195,14 @@ def verify_certificate(cert: ExecutionCertificate, log: EventLog, key: bytes | N
         and str(e.payload.get("decision", "")).lower() == "allow"
     )
 
+    # A verified receipt must carry NO data field its version does not sign. The v1
+    # body binds none of the v2 issuance fields, so a v1 receipt with issued_at /
+    # nonce / run_id set is carrying an unsigned, forgeable value (e.g. a backdated
+    # issued_at) -- reject it, so ok=True never blesses data outside the signature.
+    checks["fields_match_version"] = not (
+        cert.v == "vitnify-receipt v1"
+        and any(x is not None for x in (cert.issued_at, cert.nonce, cert.run_id)))
+
     # Optional signer pinning -- an embedded key proves continuity, not authority.
     # When an allow-list is supplied, the signer must be ed25519 and on the list.
     if pinned_pubkeys is not None:

{vitnify-0.2.0 → vitnify-0.2.2}/src/vitnify/replayer.py

@@ -12,28 +12,39 @@ from .capability import Broker, recorded_tool_results
 from .certificate import issue_certificate
 
 class Session:
-    def __init__(self, lm, caps, tools, invariant, recorded: EventLog | None = None, prod_load=0):
+    def __init__(self, lm, caps, tools, invariant, recorded: EventLog | None = None, prod_load=0,
+                 provider: dict | None = None):
         self.lm = lm
         self.invariant = invariant
         self.recorded = recorded
         self.prod_load = prod_load
+        # Hosted-provider identity to bind on every llm_call (see receipt-spec: for a
+        # hosted model, recording provider/model_version/system_fingerprint/response_id
+        # is what makes provider drift distinguishable from tampering). None for a
+        # local, recomputable model.
+        self.provider = provider
         self.log = EventLog()
         rr = recorded_tool_results(recorded) if recorded is not None else None
         self.broker = Broker(caps, tools, self.log, replay=rr)
 
-    def llm(self, prompt: str, n_new=8):
+    def llm(self, prompt: str, n_new=8, provider: dict | None = None):
         load = 0 if self.recorded is not None else self.prod_load   # replay runs alone
         toks, hashes = self.lm.generate(prompt, n_new=n_new, batch_load=load, invariant=self.invariant)
         text = self.lm.tok.decode(toks, skip_special_tokens=True)
-        self.log.append(Kind.LLM_CALL, {"prompt_hash": hash_text(prompt), "tokens": toks,
-                                        "logit_hashes": hashes, "text": text})
+        payload = {"prompt_hash": hash_text(prompt), "tokens": toks,
+                   "logit_hashes": hashes, "text": text}
+        prov = {**(self.provider or {}), **(provider or {})}   # per-call overrides session default
+        if prov:
+            payload["provider"] = prov
+        self.log.append(Kind.LLM_CALL, payload)
         return text
 
     def tool(self, name: str, *args):
         return self.broker.call(name, *args)
 
-def record_run(agent_fn, lm, caps, tools, key, prog_hash, prod_load=8, invariant=True, priv=None):
-    s = Session(lm, caps, tools, invariant, recorded=None, prod_load=prod_load)
+def record_run(agent_fn, lm, caps, tools, key, prog_hash, prod_load=8, invariant=True, priv=None,
+               provider: dict | None = None):
+    s = Session(lm, caps, tools, invariant, recorded=None, prod_load=prod_load, provider=provider)
     agent_fn(s)
     cert, _ = issue_certificate(prog_hash, caps, s.log, priv=priv, key=(None if priv else key))
     return s.log, cert

{vitnify-0.2.0 → vitnify-0.2.2/src/vitnify.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: vitnify
-Version: 0.2.0
+Version: 0.2.2
 Summary: Execution receipts for AI agents: contain, deterministically reconstruct, and cryptographically certify a run.
 Author: vitnify
 License: Apache-2.0

vitnify-0.2.2/tests/test_receipt_v2.py

@@ -0,0 +1,132 @@
+"""vitnify-receipt v2 -- issuance identity (F4) and hosted-provider binding (F7).
+
+v2 adds `issued_at`, `nonce`, and `run_id` to the signed body so a receipt can be
+placed in time and one run's receipt can't stand in for another's, and supports
+recording hosted-provider identity on the model step so provider drift is
+distinguishable from tampering.
+"""
+import copy
+
+from vitnify.events import EventLog, Kind
+from vitnify.certificate import issue_certificate, verify_certificate, gen_ed25519, FORMAT
+
+
+def _run():
+    log = EventLog()
+    log.append(Kind.TOOL_CALL, {"tool": "read_docs", "decision": "allow"})
+    return log
+
+
+def test_receipt_is_v2_and_carries_time_nonce_runid():
+    priv, _ = gen_ed25519()
+    log = _run()
+    cert, _ = issue_certificate("prog", ["read_docs"], log, priv=priv)
+    assert cert.v == FORMAT == "vitnify-receipt v2"
+    assert cert.issued_at and cert.issued_at.endswith("Z")
+    assert cert.nonce and cert.run_id
+    body = cert.body()  # all three are inside the SIGNED body
+    assert body["issued_at"] == cert.issued_at
+    assert body["nonce"] == cert.nonce
+    assert body["run_id"] == cert.run_id
+    assert verify_certificate(cert, log)["ok"] is True
+
+
+def test_run_id_is_honoured_when_supplied():
+    priv, _ = gen_ed25519()
+    cert, _ = issue_certificate("prog", ["read_docs"], _run(), priv=priv, run_id="case-42")
+    assert cert.run_id == "case-42"
+
+
+def test_tampering_time_nonce_or_runid_breaks_the_signature():
+    priv, _ = gen_ed25519()
+    log = _run()
+    cert, _ = issue_certificate("prog", ["read_docs"], log, priv=priv)
+    for f in ("issued_at", "nonce", "run_id"):
+        forged = copy.deepcopy(cert)
+        setattr(forged, f, "tampered")
+        assert verify_certificate(forged, log)["ok"] is False
+
+
+def test_hosted_provider_identity_is_bound_and_drift_is_detectable():
+    # F7: recording provider identity binds it into the receipt's event root, so a
+    # later check can tell a provider change apart from tampering.
+    priv, _ = gen_ed25519()
+    log = EventLog()
+    log.append_llm_call("ph", [1, 2], seed=0, model_digest="",
+                        provider={"provider": "openai", "model_version": "gpt-x-2026-01",
+                                  "system_fingerprint": "fp_abc", "response_id": "resp_1"})
+    cert, _ = issue_certificate("prog", [], log, priv=priv)
+    assert verify_certificate(cert, log)["ok"] is True
+
+    # A different provider fingerprint yields a different event root, so the original
+    # receipt no longer matches -- drift is detected, and the bound provider fields
+    # make it attributable to the backend rather than to forgery.
+    drifted = EventLog()
+    drifted.append_llm_call("ph", [1, 2], seed=0, model_digest="",
+                            provider={"provider": "openai", "model_version": "gpt-x-2026-02",
+                                      "system_fingerprint": "fp_XYZ", "response_id": "resp_2"})
+    assert verify_certificate(cert, drifted)["ok"] is False
+
+
+def test_v1_receipt_still_verifies_under_the_v2_verifier():
+    # F8: a receipt validly signed under v1 (7-field body) must still verify -- a
+    # published format is frozen and the product's premise is verify-years-later.
+    from vitnify.certificate import ExecutionCertificate, _canon, _digest32
+    from vitnify._vendor.pck.cas import MerkleCAS
+    import copy
+    priv, pub = gen_ed25519()
+    log = _run()
+    cas = MerkleCAS(log.chunks())
+    v1_body = {"v": "vitnify-receipt v1", "program_hash": "prog",
+               "capabilities": ["read_docs"], "event_root": cas.root,
+               "n_events": len(log), "head_hash": log.head(),
+               "model_digests": log.model_digests()}
+    sig = priv.sign(bytes.fromhex(_digest32(_canon(v1_body).encode()))).hex()
+    cert = ExecutionCertificate("prog", ["read_docs"], cas.root, len(log), log.head(),
+                                model_digests=log.model_digests())
+    cert.v, cert.sig, cert.sig_alg, cert.pubkey = "vitnify-receipt v1", sig, "ed25519", pub
+    r = verify_certificate(cert, log)
+    assert r["format"] and r["sig_valid"] and r["ok"]          # v1 fully verifies
+    bad = copy.deepcopy(cert); bad.program_hash = "evil"        # ...but tampering is caught
+    assert verify_certificate(bad, log)["ok"] is False
+
+
+def test_f9_session_llm_records_provider():
+    from vitnify.replayer import Session
+
+    class _Tok:
+        def decode(self, toks, skip_special_tokens=True):
+            return "text"
+
+    class _LM:
+        tok = _Tok()
+        def generate(self, prompt, n_new, batch_load, invariant):
+            return [1, 2], ["h1", "h2"]
+
+    s = Session(_LM(), caps=[], tools={}, invariant=True,
+                provider={"provider": "openai", "model_version": "gpt-x"})
+    s.llm("hi", n_new=2, provider={"response_id": "resp_1"})    # per-call merges with session default
+    ev = next(e for e in s.log.events if e.kind == Kind.LLM_CALL.value)
+    assert ev.payload["provider"] == {
+        "provider": "openai", "model_version": "gpt-x", "response_id": "resp_1"}
+
+
+def test_f10_v1_receipt_carrying_v2_fields_is_rejected():
+    # F10: v1 does not sign issued_at/nonce/run_id, so a v1 receipt that CARRIES them
+    # is carrying unsigned, forgeable data (e.g. a backdated timestamp) -- it must not
+    # verify, or ok=True would bless a value outside the signature.
+    from vitnify.certificate import ExecutionCertificate, _canon, _digest32
+    from vitnify._vendor.pck.cas import MerkleCAS
+    priv, pub = gen_ed25519()
+    log = _run(); cas = MerkleCAS(log.chunks())
+    b1 = {"v": "vitnify-receipt v1", "program_hash": "p", "capabilities": ["read_docs"],
+          "event_root": cas.root, "n_events": len(log), "head_hash": log.head(),
+          "model_digests": log.model_digests()}
+    sig = priv.sign(bytes.fromhex(_digest32(_canon(b1).encode()))).hex()
+    cert = ExecutionCertificate("p", ["read_docs"], cas.root, len(log), log.head(),
+                                model_digests=log.model_digests())
+    cert.v, cert.sig, cert.sig_alg, cert.pubkey = "vitnify-receipt v1", sig, "ed25519", pub
+    assert verify_certificate(cert, log)["ok"] is True            # genuine v1 still verifies
+    cert.issued_at = "2019-01-01T00:00:00Z"                       # forge a backdated timestamp
+    r = verify_certificate(cert, log)
+    assert r["fields_match_version"] is False and r["ok"] is False

vitnify-0.2.0/tests/test_receipt_v2.py

@@ -1,68 +0,0 @@
-"""vitnify-receipt v2 -- issuance identity (F4) and hosted-provider binding (F7).
-
-v2 adds `issued_at`, `nonce`, and `run_id` to the signed body so a receipt can be
-placed in time and one run's receipt can't stand in for another's, and supports
-recording hosted-provider identity on the model step so provider drift is
-distinguishable from tampering.
-"""
-import copy
-
-from vitnify.events import EventLog, Kind
-from vitnify.certificate import issue_certificate, verify_certificate, gen_ed25519, FORMAT
-
-
-def _run():
-    log = EventLog()
-    log.append(Kind.TOOL_CALL, {"tool": "read_docs", "decision": "allow"})
-    return log
-
-
-def test_receipt_is_v2_and_carries_time_nonce_runid():
-    priv, _ = gen_ed25519()
-    log = _run()
-    cert, _ = issue_certificate("prog", ["read_docs"], log, priv=priv)
-    assert cert.v == FORMAT == "vitnify-receipt v2"
-    assert cert.issued_at and cert.issued_at.endswith("Z")
-    assert cert.nonce and cert.run_id
-    body = cert.body()  # all three are inside the SIGNED body
-    assert body["issued_at"] == cert.issued_at
-    assert body["nonce"] == cert.nonce
-    assert body["run_id"] == cert.run_id
-    assert verify_certificate(cert, log)["ok"] is True
-
-
-def test_run_id_is_honoured_when_supplied():
-    priv, _ = gen_ed25519()
-    cert, _ = issue_certificate("prog", ["read_docs"], _run(), priv=priv, run_id="case-42")
-    assert cert.run_id == "case-42"
-
-
-def test_tampering_time_nonce_or_runid_breaks_the_signature():
-    priv, _ = gen_ed25519()
-    log = _run()
-    cert, _ = issue_certificate("prog", ["read_docs"], log, priv=priv)
-    for f in ("issued_at", "nonce", "run_id"):
-        forged = copy.deepcopy(cert)
-        setattr(forged, f, "tampered")
-        assert verify_certificate(forged, log)["ok"] is False
-
-
-def test_hosted_provider_identity_is_bound_and_drift_is_detectable():
-    # F7: recording provider identity binds it into the receipt's event root, so a
-    # later check can tell a provider change apart from tampering.
-    priv, _ = gen_ed25519()
-    log = EventLog()
-    log.append_llm_call("ph", [1, 2], seed=0, model_digest="",
-                        provider={"provider": "openai", "model_version": "gpt-x-2026-01",
-                                  "system_fingerprint": "fp_abc", "response_id": "resp_1"})
-    cert, _ = issue_certificate("prog", [], log, priv=priv)
-    assert verify_certificate(cert, log)["ok"] is True
-
-    # A different provider fingerprint yields a different event root, so the original
-    # receipt no longer matches -- drift is detected, and the bound provider fields
-    # make it attributable to the backend rather than to forgery.
-    drifted = EventLog()
-    drifted.append_llm_call("ph", [1, 2], seed=0, model_digest="",
-                            provider={"provider": "openai", "model_version": "gpt-x-2026-02",
-                                      "system_fingerprint": "fp_XYZ", "response_id": "resp_2"})
-    assert verify_certificate(cert, drifted)["ok"] is False