vitnify 0.2.2__tar.gz → 0.2.3__tar.gz

{vitnify-0.2.2/src/vitnify.egg-info → vitnify-0.2.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: vitnify
-Version: 0.2.2
+Version: 0.2.3
 Summary: Execution receipts for AI agents: contain, deterministically reconstruct, and cryptographically certify a run.
 Author: vitnify
 License: Apache-2.0

{vitnify-0.2.2 → vitnify-0.2.3}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "vitnify"
-version = "0.2.2"
+version = "0.2.3"
 description = "Execution receipts for AI agents: contain, deterministically reconstruct, and cryptographically certify a run."
 readme = "README.md"
 requires-python = ">=3.10"

{vitnify-0.2.2 → vitnify-0.2.3}/src/vitnify/certificate.py

@@ -184,15 +184,23 @@ def verify_certificate(cert: ExecutionCertificate, log: EventLog, key: bytes | N
             cert.sig, hmac.new(key, cert.digest().encode(), hashlib.blake2b).hexdigest())
     checks["sig_valid"] = sig_valid
 
-    # Capability consistency -- the receipt must PROVE containment held, not just
-    # carry a capability list: every ALLOWED tool call has to be within the
-    # declared, signed-over capability set. (Denied calls need not be granted.)
+    # Capability consistency -- the receipt must PROVE no ungranted tool executed,
+    # not just carry a capability list. Every tool call must be within the declared,
+    # signed-over capability set OR a CLEAN DENIAL (decision exactly "deny",
+    # case/space-insensitive, with no result). Keying only off decision=="allow"
+    # let a forged log slip an ungranted, result-bearing call through by relabelling
+    # the decision ("PERMIT", " allow", omitted...) -- F11. Failing closed on
+    # anything that is not a clean denial removes that, whatever string it carries.
     granted = set(cert.capabilities)
+
+    def _clean_denial(p: dict) -> bool:
+        return (str(p.get("decision", "")).strip().lower() == "deny"
+                and "result" not in p and "result_hash" not in p)
+
     checks["caps_consistent"] = all(
-        e.payload.get("tool") in granted
+        e.payload.get("tool") in granted or _clean_denial(e.payload)
         for e in log.events
         if e.kind == Kind.TOOL_CALL.value
-        and str(e.payload.get("decision", "")).lower() == "allow"
     )
 
     # A verified receipt must carry NO data field its version does not sign. The v1

{vitnify-0.2.2 → vitnify-0.2.3/src/vitnify.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: vitnify
-Version: 0.2.2
+Version: 0.2.3
 Summary: Execution receipts for AI agents: contain, deterministically reconstruct, and cryptographically certify a run.
 Author: vitnify
 License: Apache-2.0

{vitnify-0.2.2 → vitnify-0.2.3}/tests/test_verify_hardening.py

@@ -74,3 +74,24 @@ def test_f5_signer_pinning():
     assert verify_certificate(cert, log, pinned_pubkeys=[pub])["ok"] is True
     # unpinned verification (no allow-list) still succeeds on integrity + self-sig
     assert verify_certificate(cert, log)["ok"] is True
+
+
+def test_f11_containment_not_evaded_by_decision_string():
+    # F11: an ungranted, result-bearing tool call must be rejected no matter what
+    # string its decision carries -- containment is proven, not keyed off "allow".
+    priv, _ = gen_ed25519()
+    for decision in ("PERMIT", " allow", "allowed", "Allow", None):
+        payload = {"tool": "wire_transfer", "result": "SENT"}
+        if decision is not None:
+            payload["decision"] = decision
+        log = EventLog(); log.append(Kind.TOOL_CALL, payload)
+        cert, _ = issue_certificate("prog", ["read_docs"], log, priv=priv)   # wire_transfer ungranted
+        assert verify_certificate(cert, log)["ok"] is False, repr(decision)
+    # an ungranted tool mislabelled DENY but still carrying a result is also rejected
+    log = EventLog(); log.append(Kind.TOOL_CALL, {"tool": "wire_transfer", "decision": "DENY", "result": "SENT"})
+    cert, _ = issue_certificate("prog", ["read_docs"], log, priv=priv)
+    assert verify_certificate(cert, log)["ok"] is False
+    # ...but a clean denial of an ungranted tool still verifies (containment working)
+    log = EventLog(); log.append(Kind.TOOL_CALL, {"tool": "send_email", "decision": "DENY"})
+    cert, _ = issue_certificate("prog", ["read_docs"], log, priv=priv)
+    assert verify_certificate(cert, log)["ok"] is True