vitnify 0.2.3__tar.gz → 0.2.4__tar.gz

{vitnify-0.2.3/src/vitnify.egg-info → vitnify-0.2.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: vitnify
-Version: 0.2.3
+Version: 0.2.4
 Summary: Execution receipts for AI agents: contain, deterministically reconstruct, and cryptographically certify a run.
 Author: vitnify
 License: Apache-2.0

{vitnify-0.2.3 → vitnify-0.2.4}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "vitnify"
-version = "0.2.3"
+version = "0.2.4"
 description = "Execution receipts for AI agents: contain, deterministically reconstruct, and cryptographically certify a run."
 readme = "README.md"
 requires-python = ">=3.10"

{vitnify-0.2.3 → vitnify-0.2.4}/src/vitnify/certificate.py

@@ -158,8 +158,15 @@ def verify_certificate(cert: ExecutionCertificate, log: EventLog, key: bytes | N
     needs the model weights.)
     """
     cas = MerkleCAS(log.chunks())
+    # Every event kind must be recognised. The semantic checks below filter events
+    # by an EXACT kind match, so an unknown kind ("TOOL_CALL", "toolcall", ...) would
+    # slip past them silently -- the same self-declared-label class as an unknown
+    # sig_alg or an unknown decision string. Fail closed here so the whole class is
+    # gone: an unrecognised kind (or decision, or algorithm, or format) never verifies.
+    known_kinds = {k.value for k in Kind}
     checks = {
         "format": cert.v in SUPPORTED_FORMATS,
+        "kinds_known": all(e.kind in known_kinds for e in log.events),
         "root_matches": cas.root == cert.event_root,
         "head_matches": log.head() == cert.head_hash,
         "count_matches": len(log) == cert.n_events,

{vitnify-0.2.3 → vitnify-0.2.4/src/vitnify.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: vitnify
-Version: 0.2.3
+Version: 0.2.4
 Summary: Execution receipts for AI agents: contain, deterministically reconstruct, and cryptographically certify a run.
 Author: vitnify
 License: Apache-2.0

{vitnify-0.2.3 → vitnify-0.2.4}/tests/test_verify_hardening.py

@@ -95,3 +95,28 @@ def test_f11_containment_not_evaded_by_decision_string():
     log = EventLog(); log.append(Kind.TOOL_CALL, {"tool": "send_email", "decision": "DENY"})
     cert, _ = issue_certificate("prog", ["read_docs"], log, priv=priv)
     assert verify_certificate(cert, log)["ok"] is True
+
+
+def test_f12_unknown_event_kind_is_rejected():
+    # F12: the semantic checks filter events by an exact kind match, so an unknown
+    # kind would slip past them. Fail closed -- any unrecognised kind invalidates the
+    # receipt. This closes the whole "self-declared label evades a filter" class:
+    # F1 (sig_alg), F11 (decision), F12 (kind) all now fail closed on unknown values.
+    priv, _ = gen_ed25519()
+    # an ungranted tool hidden under an unrecognised kind must not escape containment
+    log = EventLog(); log.append("TOOL_CALL", {"tool": "wire_transfer", "decision": "ALLOW", "result": "x"})
+    cert, _ = issue_certificate("prog", ["read_docs"], log, priv=priv)
+    r = verify_certificate(cert, log)
+    assert r["kinds_known"] is False and r["ok"] is False
+    # a model step hidden under an unrecognised kind must not verify either
+    log = EventLog(); log.append("LLM_CALL", {"prompt_hash": "p", "tokens": [1], "seed": 0, "model_digest": "d"})
+    cert, _ = issue_certificate("prog", [], log, priv=priv)
+    assert verify_certificate(cert, log)["ok"] is False
+    # every recognised kind still verifies
+    log = EventLog()
+    log.append(Kind.LLM_CALL, {"prompt_hash": "p", "tokens": [1], "seed": 0, "model_digest": "d"})
+    log.append(Kind.TOOL_CALL, {"tool": "read_docs", "decision": "ALLOW", "result": "r", "result_hash": "h"})
+    log.append(Kind.ENTROPY, {"source": "clock", "value": 1})
+    log.append(Kind.AGENT_STEP, {"state": "done"})
+    cert, _ = issue_certificate("prog", ["read_docs"], log, priv=priv)
+    assert verify_certificate(cert, log)["ok"] is True