vitnify 0.2.1__tar.gz → 0.2.2__tar.gz

{vitnify-0.2.1/src/vitnify.egg-info → vitnify-0.2.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: vitnify
-Version: 0.2.1
+Version: 0.2.2
 Summary: Execution receipts for AI agents: contain, deterministically reconstruct, and cryptographically certify a run.
 Author: vitnify
 License: Apache-2.0

{vitnify-0.2.1 → vitnify-0.2.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "vitnify"
-version = "0.2.1"
+version = "0.2.2"
 description = "Execution receipts for AI agents: contain, deterministically reconstruct, and cryptographically certify a run."
 readme = "README.md"
 requires-python = ">=3.10"

{vitnify-0.2.1 → vitnify-0.2.2}/src/vitnify/certificate.py

@@ -195,6 +195,14 @@ def verify_certificate(cert: ExecutionCertificate, log: EventLog, key: bytes | N
         and str(e.payload.get("decision", "")).lower() == "allow"
     )
 
+    # A verified receipt must carry NO data field its version does not sign. The v1
+    # body binds none of the v2 issuance fields, so a v1 receipt with issued_at /
+    # nonce / run_id set is carrying an unsigned, forgeable value (e.g. a backdated
+    # issued_at) -- reject it, so ok=True never blesses data outside the signature.
+    checks["fields_match_version"] = not (
+        cert.v == "vitnify-receipt v1"
+        and any(x is not None for x in (cert.issued_at, cert.nonce, cert.run_id)))
+
     # Optional signer pinning -- an embedded key proves continuity, not authority.
     # When an allow-list is supplied, the signer must be ed25519 and on the list.
     if pinned_pubkeys is not None:

{vitnify-0.2.1 → vitnify-0.2.2/src/vitnify.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: vitnify
-Version: 0.2.1
+Version: 0.2.2
 Summary: Execution receipts for AI agents: contain, deterministically reconstruct, and cryptographically certify a run.
 Author: vitnify
 License: Apache-2.0

{vitnify-0.2.1 → vitnify-0.2.2}/tests/test_receipt_v2.py

@@ -109,3 +109,24 @@ def test_f9_session_llm_records_provider():
     ev = next(e for e in s.log.events if e.kind == Kind.LLM_CALL.value)
     assert ev.payload["provider"] == {
         "provider": "openai", "model_version": "gpt-x", "response_id": "resp_1"}
+
+
+def test_f10_v1_receipt_carrying_v2_fields_is_rejected():
+    # F10: v1 does not sign issued_at/nonce/run_id, so a v1 receipt that CARRIES them
+    # is carrying unsigned, forgeable data (e.g. a backdated timestamp) -- it must not
+    # verify, or ok=True would bless a value outside the signature.
+    from vitnify.certificate import ExecutionCertificate, _canon, _digest32
+    from vitnify._vendor.pck.cas import MerkleCAS
+    priv, pub = gen_ed25519()
+    log = _run(); cas = MerkleCAS(log.chunks())
+    b1 = {"v": "vitnify-receipt v1", "program_hash": "p", "capabilities": ["read_docs"],
+          "event_root": cas.root, "n_events": len(log), "head_hash": log.head(),
+          "model_digests": log.model_digests()}
+    sig = priv.sign(bytes.fromhex(_digest32(_canon(b1).encode()))).hex()
+    cert = ExecutionCertificate("p", ["read_docs"], cas.root, len(log), log.head(),
+                                model_digests=log.model_digests())
+    cert.v, cert.sig, cert.sig_alg, cert.pubkey = "vitnify-receipt v1", sig, "ed25519", pub
+    assert verify_certificate(cert, log)["ok"] is True            # genuine v1 still verifies
+    cert.issued_at = "2019-01-01T00:00:00Z"                       # forge a backdated timestamp
+    r = verify_certificate(cert, log)
+    assert r["fields_match_version"] is False and r["ok"] is False