vitnify 0.2.3__tar.gz → 0.2.5__tar.gz

{vitnify-0.2.3/src/vitnify.egg-info → vitnify-0.2.5}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: vitnify
-Version: 0.2.3
+Version: 0.2.5
 Summary: Execution receipts for AI agents: contain, deterministically reconstruct, and cryptographically certify a run.
 Author: vitnify
 License: Apache-2.0

{vitnify-0.2.3 → vitnify-0.2.5}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "vitnify"
-version = "0.2.3"
+version = "0.2.5"
 description = "Execution receipts for AI agents: contain, deterministically reconstruct, and cryptographically certify a run."
 readme = "README.md"
 requires-python = ">=3.10"

{vitnify-0.2.3 → vitnify-0.2.5}/src/vitnify/certificate.py

@@ -41,14 +41,12 @@ def _now_iso() -> str:
     from datetime import datetime, timezone
     return datetime.now(timezone.utc).strftime("%Y-%m-%dT%H:%M:%SZ")
 
-try:
-    import blake3 as _blake3
-    def _digest32(b: bytes) -> str:
-        return _blake3.blake3(b).hexdigest()
-except ImportError:
-    import hashlib
-    def _digest32(b: bytes) -> str:
-        return hashlib.blake2b(b, digest_size=32).hexdigest()
+# BLAKE3 is a hard dependency and DEFINES the wire format: a blake2b digest is a
+# different value, so there is no silent stdlib fallback (see events.py). A missing
+# blake3 fails loudly rather than producing incompatible digests.
+import blake3 as _blake3
+def _digest32(b: bytes) -> str:
+    return _blake3.blake3(b).hexdigest()
 
 # cryptography is imported lazily inside the ed25519 helpers so the fallback path
 # still runs on a stock Python without the dependency.
@@ -121,10 +119,18 @@ def issue_certificate(program_hash, capabilities, log: EventLog, priv=None, key:
     """Build and sign a vitnify-receipt for a completed run.
 
     The model-computation digests are read from the log's llm_call events, so the
-    receipt binds exactly the model steps that were recorded. Each receipt is
-    stamped with an issuer-asserted UTC time, a random nonce, and a run id (pass
-    `run_id` to set your own; a random one is used otherwise) so distinct runs
-    produce distinct, time-placeable receipts. ed25519 (self-verifying) is the
+    receipt binds exactly the model steps that were recorded. `model_digests` is
+    EMPTY for a run with no recomputable model step (a hosted API, or a torch /
+    non-deterministic backend) -- such a receipt is integrity-only: it binds the
+    transcript, not the computation.
+
+    `program_hash` is CALLER-ASSERTED -- the receipt binds whatever string you pass;
+    it does not itself hash your agent's code. Pass a hash of the exact program or
+    config that ran if you want the receipt to pin it.
+
+    Each receipt is stamped with an issuer-asserted UTC time, a random nonce, and a
+    run id (pass `run_id` to set your own; a random one is used otherwise) so distinct
+    runs produce distinct, time-placeable receipts. ed25519 (self-verifying) is the
     canonical signing path; pass `priv`.
     """
     cas = MerkleCAS(log.chunks())
@@ -158,8 +164,15 @@ def verify_certificate(cert: ExecutionCertificate, log: EventLog, key: bytes | N
     needs the model weights.)
     """
     cas = MerkleCAS(log.chunks())
+    # Every event kind must be recognised. The semantic checks below filter events
+    # by an EXACT kind match, so an unknown kind ("TOOL_CALL", "toolcall", ...) would
+    # slip past them silently -- the same self-declared-label class as an unknown
+    # sig_alg or an unknown decision string. Fail closed here so the whole class is
+    # gone: an unrecognised kind (or decision, or algorithm, or format) never verifies.
+    known_kinds = {k.value for k in Kind}
     checks = {
         "format": cert.v in SUPPORTED_FORMATS,
+        "kinds_known": all(e.kind in known_kinds for e in log.events),
         "root_matches": cas.root == cert.event_root,
         "head_matches": log.head() == cert.head_hash,
         "count_matches": len(log) == cert.n_events,
@@ -217,5 +230,17 @@ def verify_certificate(cert: ExecutionCertificate, log: EventLog, key: bytes | N
         checks["signer_pinned"] = (
             sig_valid and cert.sig_alg == "ed25519" and cert.pubkey in set(pinned_pubkeys))
 
-    checks["ok"] = all(checks.values())
+    # Enforcement vs observation. An "allow"/"deny" decision came from the capability
+    # wall -- the call was GATED. Any other value (e.g. "observed" from the record-only
+    # callback adapter) means it was WATCHED, not enforced, so the receipt is a
+    # tamper-evident transcript, not proof containment was applied -- the containment
+    # analogue of an empty model_digests. Reported separately, NOT folded into ok, so a
+    # valid transcript stays valid while a containment PROOF requires ok AND this True.
+    checks["containment_enforced"] = all(
+        str(e.payload.get("decision", "")).strip().lower() in ("allow", "deny")
+        for e in log.events
+        if e.kind == Kind.TOOL_CALL.value
+    )
+
+    checks["ok"] = all(v for k, v in checks.items() if k != "containment_enforced")
     return checks

{vitnify-0.2.3 → vitnify-0.2.5}/src/vitnify/events.py

@@ -13,14 +13,14 @@ import json
 from dataclasses import dataclass, asdict
 from enum import Enum
 
-try:
-    import blake3 as _blake3
-    def _h32(b: bytes) -> str:
-        return _blake3.blake3(b).hexdigest()
-except ImportError:  # stdlib fallback; wire format is identical either way
-    import hashlib
-    def _h32(b: bytes) -> str:
-        return hashlib.blake2b(b, digest_size=32).hexdigest()
+# BLAKE3 is a hard dependency and DEFINES the wire format: a blake2b digest is a
+# different value, so there is no silent stdlib fallback -- one would make honest
+# receipts indistinguishable from forgeries across implementations (and the receipt
+# carries no hash-suite identifier to tell them apart). A normal `pip install
+# vitnify` always resolves the wheel; a missing blake3 fails loudly, not silently.
+import blake3 as _blake3
+def _h32(b: bytes) -> str:
+    return _blake3.blake3(b).hexdigest()
 
 
 def canon(obj) -> str:

{vitnify-0.2.3 → vitnify-0.2.5/src/vitnify.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: vitnify
-Version: 0.2.3
+Version: 0.2.5
 Summary: Execution receipts for AI agents: contain, deterministically reconstruct, and cryptographically certify a run.
 Author: vitnify
 License: Apache-2.0

{vitnify-0.2.3 → vitnify-0.2.5}/tests/test_verify_hardening.py

@@ -95,3 +95,48 @@ def test_f11_containment_not_evaded_by_decision_string():
     log = EventLog(); log.append(Kind.TOOL_CALL, {"tool": "send_email", "decision": "DENY"})
     cert, _ = issue_certificate("prog", ["read_docs"], log, priv=priv)
     assert verify_certificate(cert, log)["ok"] is True
+
+
+def test_f12_unknown_event_kind_is_rejected():
+    # F12: the semantic checks filter events by an exact kind match, so an unknown
+    # kind would slip past them. Fail closed -- any unrecognised kind invalidates the
+    # receipt. This closes the whole "self-declared label evades a filter" class:
+    # F1 (sig_alg), F11 (decision), F12 (kind) all now fail closed on unknown values.
+    priv, _ = gen_ed25519()
+    # an ungranted tool hidden under an unrecognised kind must not escape containment
+    log = EventLog(); log.append("TOOL_CALL", {"tool": "wire_transfer", "decision": "ALLOW", "result": "x"})
+    cert, _ = issue_certificate("prog", ["read_docs"], log, priv=priv)
+    r = verify_certificate(cert, log)
+    assert r["kinds_known"] is False and r["ok"] is False
+    # a model step hidden under an unrecognised kind must not verify either
+    log = EventLog(); log.append("LLM_CALL", {"prompt_hash": "p", "tokens": [1], "seed": 0, "model_digest": "d"})
+    cert, _ = issue_certificate("prog", [], log, priv=priv)
+    assert verify_certificate(cert, log)["ok"] is False
+    # every recognised kind still verifies
+    log = EventLog()
+    log.append(Kind.LLM_CALL, {"prompt_hash": "p", "tokens": [1], "seed": 0, "model_digest": "d"})
+    log.append(Kind.TOOL_CALL, {"tool": "read_docs", "decision": "ALLOW", "result": "r", "result_hash": "h"})
+    log.append(Kind.ENTROPY, {"source": "clock", "value": 1})
+    log.append(Kind.AGENT_STEP, {"state": "done"})
+    cert, _ = issue_certificate("prog", ["read_docs"], log, priv=priv)
+    assert verify_certificate(cert, log)["ok"] is True
+
+
+def test_observe_only_receipt_is_flagged_not_masqueraded():
+    # A record-only adapter records tool calls with decision "observed" -- watched,
+    # not gated. Such a receipt is a valid transcript (ok=True) but must be FLAGGED
+    # containment_enforced=False so it can't pass as a containment proof; an enforced
+    # allow/deny receipt reads containment_enforced=True.
+    priv, _ = gen_ed25519()
+
+    def receipt(decision, caps):
+        log = EventLog()
+        log.append(Kind.TOOL_CALL, {"tool": "send_email", "args": ["x"], "decision": decision, "result": "sent"})
+        cert, _ = issue_certificate("prog", caps, log, priv=priv)
+        return verify_certificate(cert, log)
+
+    r = receipt("OBSERVED", ["read_docs", "send_email"])        # observed + granted
+    assert r["ok"] is True and r["containment_enforced"] is False
+    assert receipt("OBSERVED", ["read_docs"])["ok"] is False    # observed ungranted tool ran -> rejected
+    r = receipt("ALLOW", ["read_docs", "send_email"])           # enforced allow -> real proof
+    assert r["ok"] is True and r["containment_enforced"] is True