vitnify 0.2.2__tar.gz → 0.2.4__tar.gz

{vitnify-0.2.2/src/vitnify.egg-info → vitnify-0.2.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: vitnify
-Version: 0.2.2
+Version: 0.2.4
 Summary: Execution receipts for AI agents: contain, deterministically reconstruct, and cryptographically certify a run.
 Author: vitnify
 License: Apache-2.0

{vitnify-0.2.2 → vitnify-0.2.4}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "vitnify"
-version = "0.2.2"
+version = "0.2.4"
 description = "Execution receipts for AI agents: contain, deterministically reconstruct, and cryptographically certify a run."
 readme = "README.md"
 requires-python = ">=3.10"

{vitnify-0.2.2 → vitnify-0.2.4}/src/vitnify/certificate.py

@@ -158,8 +158,15 @@ def verify_certificate(cert: ExecutionCertificate, log: EventLog, key: bytes | N
     needs the model weights.)
     """
     cas = MerkleCAS(log.chunks())
+    # Every event kind must be recognised. The semantic checks below filter events
+    # by an EXACT kind match, so an unknown kind ("TOOL_CALL", "toolcall", ...) would
+    # slip past them silently -- the same self-declared-label class as an unknown
+    # sig_alg or an unknown decision string. Fail closed here so the whole class is
+    # gone: an unrecognised kind (or decision, or algorithm, or format) never verifies.
+    known_kinds = {k.value for k in Kind}
     checks = {
         "format": cert.v in SUPPORTED_FORMATS,
+        "kinds_known": all(e.kind in known_kinds for e in log.events),
         "root_matches": cas.root == cert.event_root,
         "head_matches": log.head() == cert.head_hash,
         "count_matches": len(log) == cert.n_events,
@@ -184,15 +191,23 @@ def verify_certificate(cert: ExecutionCertificate, log: EventLog, key: bytes | N
             cert.sig, hmac.new(key, cert.digest().encode(), hashlib.blake2b).hexdigest())
     checks["sig_valid"] = sig_valid
 
-    # Capability consistency -- the receipt must PROVE containment held, not just
-    # carry a capability list: every ALLOWED tool call has to be within the
-    # declared, signed-over capability set. (Denied calls need not be granted.)
+    # Capability consistency -- the receipt must PROVE no ungranted tool executed,
+    # not just carry a capability list. Every tool call must be within the declared,
+    # signed-over capability set OR a CLEAN DENIAL (decision exactly "deny",
+    # case/space-insensitive, with no result). Keying only off decision=="allow"
+    # let a forged log slip an ungranted, result-bearing call through by relabelling
+    # the decision ("PERMIT", " allow", omitted...) -- F11. Failing closed on
+    # anything that is not a clean denial removes that, whatever string it carries.
     granted = set(cert.capabilities)
+
+    def _clean_denial(p: dict) -> bool:
+        return (str(p.get("decision", "")).strip().lower() == "deny"
+                and "result" not in p and "result_hash" not in p)
+
     checks["caps_consistent"] = all(
-        e.payload.get("tool") in granted
+        e.payload.get("tool") in granted or _clean_denial(e.payload)
         for e in log.events
         if e.kind == Kind.TOOL_CALL.value
-        and str(e.payload.get("decision", "")).lower() == "allow"
     )
 
     # A verified receipt must carry NO data field its version does not sign. The v1

{vitnify-0.2.2 → vitnify-0.2.4/src/vitnify.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: vitnify
-Version: 0.2.2
+Version: 0.2.4
 Summary: Execution receipts for AI agents: contain, deterministically reconstruct, and cryptographically certify a run.
 Author: vitnify
 License: Apache-2.0

{vitnify-0.2.2 → vitnify-0.2.4}/tests/test_verify_hardening.py

@@ -74,3 +74,49 @@ def test_f5_signer_pinning():
     assert verify_certificate(cert, log, pinned_pubkeys=[pub])["ok"] is True
     # unpinned verification (no allow-list) still succeeds on integrity + self-sig
     assert verify_certificate(cert, log)["ok"] is True
+
+
+def test_f11_containment_not_evaded_by_decision_string():
+    # F11: an ungranted, result-bearing tool call must be rejected no matter what
+    # string its decision carries -- containment is proven, not keyed off "allow".
+    priv, _ = gen_ed25519()
+    for decision in ("PERMIT", " allow", "allowed", "Allow", None):
+        payload = {"tool": "wire_transfer", "result": "SENT"}
+        if decision is not None:
+            payload["decision"] = decision
+        log = EventLog(); log.append(Kind.TOOL_CALL, payload)
+        cert, _ = issue_certificate("prog", ["read_docs"], log, priv=priv)   # wire_transfer ungranted
+        assert verify_certificate(cert, log)["ok"] is False, repr(decision)
+    # an ungranted tool mislabelled DENY but still carrying a result is also rejected
+    log = EventLog(); log.append(Kind.TOOL_CALL, {"tool": "wire_transfer", "decision": "DENY", "result": "SENT"})
+    cert, _ = issue_certificate("prog", ["read_docs"], log, priv=priv)
+    assert verify_certificate(cert, log)["ok"] is False
+    # ...but a clean denial of an ungranted tool still verifies (containment working)
+    log = EventLog(); log.append(Kind.TOOL_CALL, {"tool": "send_email", "decision": "DENY"})
+    cert, _ = issue_certificate("prog", ["read_docs"], log, priv=priv)
+    assert verify_certificate(cert, log)["ok"] is True
+
+
+def test_f12_unknown_event_kind_is_rejected():
+    # F12: the semantic checks filter events by an exact kind match, so an unknown
+    # kind would slip past them. Fail closed -- any unrecognised kind invalidates the
+    # receipt. This closes the whole "self-declared label evades a filter" class:
+    # F1 (sig_alg), F11 (decision), F12 (kind) all now fail closed on unknown values.
+    priv, _ = gen_ed25519()
+    # an ungranted tool hidden under an unrecognised kind must not escape containment
+    log = EventLog(); log.append("TOOL_CALL", {"tool": "wire_transfer", "decision": "ALLOW", "result": "x"})
+    cert, _ = issue_certificate("prog", ["read_docs"], log, priv=priv)
+    r = verify_certificate(cert, log)
+    assert r["kinds_known"] is False and r["ok"] is False
+    # a model step hidden under an unrecognised kind must not verify either
+    log = EventLog(); log.append("LLM_CALL", {"prompt_hash": "p", "tokens": [1], "seed": 0, "model_digest": "d"})
+    cert, _ = issue_certificate("prog", [], log, priv=priv)
+    assert verify_certificate(cert, log)["ok"] is False
+    # every recognised kind still verifies
+    log = EventLog()
+    log.append(Kind.LLM_CALL, {"prompt_hash": "p", "tokens": [1], "seed": 0, "model_digest": "d"})
+    log.append(Kind.TOOL_CALL, {"tool": "read_docs", "decision": "ALLOW", "result": "r", "result_hash": "h"})
+    log.append(Kind.ENTROPY, {"source": "clock", "value": 1})
+    log.append(Kind.AGENT_STEP, {"state": "done"})
+    cert, _ = issue_certificate("prog", ["read_docs"], log, priv=priv)
+    assert verify_certificate(cert, log)["ok"] is True