vitnify 0.2.1__tar.gz → 0.2.3__tar.gz

{vitnify-0.2.1/src/vitnify.egg-info → vitnify-0.2.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: vitnify
-Version: 0.2.1
+Version: 0.2.3
 Summary: Execution receipts for AI agents: contain, deterministically reconstruct, and cryptographically certify a run.
 Author: vitnify
 License: Apache-2.0

{vitnify-0.2.1 → vitnify-0.2.3}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "vitnify"
-version = "0.2.1"
+version = "0.2.3"
 description = "Execution receipts for AI agents: contain, deterministically reconstruct, and cryptographically certify a run."
 readme = "README.md"
 requires-python = ">=3.10"

{vitnify-0.2.1 → vitnify-0.2.3}/src/vitnify/certificate.py

@@ -184,17 +184,33 @@ def verify_certificate(cert: ExecutionCertificate, log: EventLog, key: bytes | N
             cert.sig, hmac.new(key, cert.digest().encode(), hashlib.blake2b).hexdigest())
     checks["sig_valid"] = sig_valid
 
-    # Capability consistency -- the receipt must PROVE containment held, not just
-    # carry a capability list: every ALLOWED tool call has to be within the
-    # declared, signed-over capability set. (Denied calls need not be granted.)
+    # Capability consistency -- the receipt must PROVE no ungranted tool executed,
+    # not just carry a capability list. Every tool call must be within the declared,
+    # signed-over capability set OR a CLEAN DENIAL (decision exactly "deny",
+    # case/space-insensitive, with no result). Keying only off decision=="allow"
+    # let a forged log slip an ungranted, result-bearing call through by relabelling
+    # the decision ("PERMIT", " allow", omitted...) -- F11. Failing closed on
+    # anything that is not a clean denial removes that, whatever string it carries.
     granted = set(cert.capabilities)
+
+    def _clean_denial(p: dict) -> bool:
+        return (str(p.get("decision", "")).strip().lower() == "deny"
+                and "result" not in p and "result_hash" not in p)
+
     checks["caps_consistent"] = all(
-        e.payload.get("tool") in granted
+        e.payload.get("tool") in granted or _clean_denial(e.payload)
         for e in log.events
         if e.kind == Kind.TOOL_CALL.value
-        and str(e.payload.get("decision", "")).lower() == "allow"
     )
 
+    # A verified receipt must carry NO data field its version does not sign. The v1
+    # body binds none of the v2 issuance fields, so a v1 receipt with issued_at /
+    # nonce / run_id set is carrying an unsigned, forgeable value (e.g. a backdated
+    # issued_at) -- reject it, so ok=True never blesses data outside the signature.
+    checks["fields_match_version"] = not (
+        cert.v == "vitnify-receipt v1"
+        and any(x is not None for x in (cert.issued_at, cert.nonce, cert.run_id)))
+
     # Optional signer pinning -- an embedded key proves continuity, not authority.
     # When an allow-list is supplied, the signer must be ed25519 and on the list.
     if pinned_pubkeys is not None:

{vitnify-0.2.1 → vitnify-0.2.3/src/vitnify.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: vitnify
-Version: 0.2.1
+Version: 0.2.3
 Summary: Execution receipts for AI agents: contain, deterministically reconstruct, and cryptographically certify a run.
 Author: vitnify
 License: Apache-2.0

{vitnify-0.2.1 → vitnify-0.2.3}/tests/test_receipt_v2.py

@@ -109,3 +109,24 @@ def test_f9_session_llm_records_provider():
     ev = next(e for e in s.log.events if e.kind == Kind.LLM_CALL.value)
     assert ev.payload["provider"] == {
         "provider": "openai", "model_version": "gpt-x", "response_id": "resp_1"}
+
+
+def test_f10_v1_receipt_carrying_v2_fields_is_rejected():
+    # F10: v1 does not sign issued_at/nonce/run_id, so a v1 receipt that CARRIES them
+    # is carrying unsigned, forgeable data (e.g. a backdated timestamp) -- it must not
+    # verify, or ok=True would bless a value outside the signature.
+    from vitnify.certificate import ExecutionCertificate, _canon, _digest32
+    from vitnify._vendor.pck.cas import MerkleCAS
+    priv, pub = gen_ed25519()
+    log = _run(); cas = MerkleCAS(log.chunks())
+    b1 = {"v": "vitnify-receipt v1", "program_hash": "p", "capabilities": ["read_docs"],
+          "event_root": cas.root, "n_events": len(log), "head_hash": log.head(),
+          "model_digests": log.model_digests()}
+    sig = priv.sign(bytes.fromhex(_digest32(_canon(b1).encode()))).hex()
+    cert = ExecutionCertificate("p", ["read_docs"], cas.root, len(log), log.head(),
+                                model_digests=log.model_digests())
+    cert.v, cert.sig, cert.sig_alg, cert.pubkey = "vitnify-receipt v1", sig, "ed25519", pub
+    assert verify_certificate(cert, log)["ok"] is True            # genuine v1 still verifies
+    cert.issued_at = "2019-01-01T00:00:00Z"                       # forge a backdated timestamp
+    r = verify_certificate(cert, log)
+    assert r["fields_match_version"] is False and r["ok"] is False

{vitnify-0.2.1 → vitnify-0.2.3}/tests/test_verify_hardening.py

@@ -74,3 +74,24 @@ def test_f5_signer_pinning():
     assert verify_certificate(cert, log, pinned_pubkeys=[pub])["ok"] is True
     # unpinned verification (no allow-list) still succeeds on integrity + self-sig
     assert verify_certificate(cert, log)["ok"] is True
+
+
+def test_f11_containment_not_evaded_by_decision_string():
+    # F11: an ungranted, result-bearing tool call must be rejected no matter what
+    # string its decision carries -- containment is proven, not keyed off "allow".
+    priv, _ = gen_ed25519()
+    for decision in ("PERMIT", " allow", "allowed", "Allow", None):
+        payload = {"tool": "wire_transfer", "result": "SENT"}
+        if decision is not None:
+            payload["decision"] = decision
+        log = EventLog(); log.append(Kind.TOOL_CALL, payload)
+        cert, _ = issue_certificate("prog", ["read_docs"], log, priv=priv)   # wire_transfer ungranted
+        assert verify_certificate(cert, log)["ok"] is False, repr(decision)
+    # an ungranted tool mislabelled DENY but still carrying a result is also rejected
+    log = EventLog(); log.append(Kind.TOOL_CALL, {"tool": "wire_transfer", "decision": "DENY", "result": "SENT"})
+    cert, _ = issue_certificate("prog", ["read_docs"], log, priv=priv)
+    assert verify_certificate(cert, log)["ok"] is False
+    # ...but a clean denial of an ungranted tool still verifies (containment working)
+    log = EventLog(); log.append(Kind.TOOL_CALL, {"tool": "send_email", "decision": "DENY"})
+    cert, _ = issue_certificate("prog", ["read_docs"], log, priv=priv)
+    assert verify_certificate(cert, log)["ok"] is True