vitnify 0.2.4__tar.gz → 0.2.6__tar.gz

{vitnify-0.2.4/src/vitnify.egg-info → vitnify-0.2.6}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: vitnify
-Version: 0.2.4
+Version: 0.2.6
 Summary: Execution receipts for AI agents: contain, deterministically reconstruct, and cryptographically certify a run.
 Author: vitnify
 License: Apache-2.0
@@ -64,8 +64,13 @@ log.append(Kind.TOOL_CALL, {"tool": "send_email", "decision": "deny"})  # ungran
 priv, pub = gen_ed25519()
 cert, _ = issue_certificate("program_hash", ["read_docs"], log, priv=priv)
 
-verify_certificate(cert, log)   # level 1: offline integrity — no model, no secret
-# level 2: re-run each step through the engine; every model_digest reproduces bit-for-bit
+checks = verify_certificate(cert, log)   # level 1: offline integrity — no model, no secret
+assert checks["ok"]                       # signed, unaltered, and no ungranted tool ran
+assert checks["containment_enforced"]     # every tool call was GATED, not merely observed
+# A receipt can be ok=True yet containment_enforced=False — a valid transcript from a
+# watch-only integration proves what ran, not that anything was contained. A containment
+# claim requires BOTH. (level 2: re-run each step through the engine; every model_digest
+# reproduces bit-for-bit.)
 ```
 
 See [`vitnify-receipt-v2.md`](vitnify-receipt-v2.md) for the receipt format, and

{vitnify-0.2.4 → vitnify-0.2.6}/README.md

@@ -38,8 +38,13 @@ log.append(Kind.TOOL_CALL, {"tool": "send_email", "decision": "deny"})  # ungran
 priv, pub = gen_ed25519()
 cert, _ = issue_certificate("program_hash", ["read_docs"], log, priv=priv)
 
-verify_certificate(cert, log)   # level 1: offline integrity — no model, no secret
-# level 2: re-run each step through the engine; every model_digest reproduces bit-for-bit
+checks = verify_certificate(cert, log)   # level 1: offline integrity — no model, no secret
+assert checks["ok"]                       # signed, unaltered, and no ungranted tool ran
+assert checks["containment_enforced"]     # every tool call was GATED, not merely observed
+# A receipt can be ok=True yet containment_enforced=False — a valid transcript from a
+# watch-only integration proves what ran, not that anything was contained. A containment
+# claim requires BOTH. (level 2: re-run each step through the engine; every model_digest
+# reproduces bit-for-bit.)
 ```
 
 See [`vitnify-receipt-v2.md`](vitnify-receipt-v2.md) for the receipt format, and

{vitnify-0.2.4 → vitnify-0.2.6}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "vitnify"
-version = "0.2.4"
+version = "0.2.6"
 description = "Execution receipts for AI agents: contain, deterministically reconstruct, and cryptographically certify a run."
 readme = "README.md"
 requires-python = ">=3.10"

{vitnify-0.2.4 → vitnify-0.2.6}/src/vitnify/_vendor/pck/cas.py

@@ -13,29 +13,24 @@ root. The guarantees this buys, and why they matter for AI answers:
     hallucination: a grounded claim points at a chunk with a valid proof; an invented
     one cannot.
 
-This mirrors the BLAKE3 + Merkle design of a native runtime's ``cas_store`` (whose real
-Rust code is exercised in ``research/pck_provenance/``); here we keep a dependency-light
-pure-Python implementation that uses ``blake3`` when available and falls back to
-``hashlib.blake2b`` otherwise. The wire format of a proof is identical either way.
+This mirrors the BLAKE3 + Merkle design of a native runtime's ``cas_store``; here we
+keep a dependency-light pure-Python implementation over ``blake3``. BLAKE3 is a hard
+dependency and DEFINES the wire format: a ``blake2b`` digest is a different value under
+the same ``hash_name``, so there is NO silent stdlib fallback -- one would make honest
+proofs indistinguishable from forgeries. A missing blake3 fails loudly (matching
+``events.py`` / ``certificate.py``), never silently downgrades.
 """
 from __future__ import annotations
 
-import hashlib
 from dataclasses import dataclass, field
 from typing import Optional
 
-try:  # BLAKE3 if the user has it (matches the substrate); else a stdlib fallback.
-    import blake3 as _blake3  # type: ignore
+import blake3 as _blake3
 
-    _HASH_NAME = "blake3"
+_HASH_NAME = "blake3"
 
-    def _digest(b: bytes) -> str:
-        return _blake3.blake3(b).hexdigest()
-except Exception:  # pragma: no cover - depends on environment
-    _HASH_NAME = "blake2b-256"
-
-    def _digest(b: bytes) -> str:
-        return hashlib.blake2b(b, digest_size=32).hexdigest()
+def _digest(b: bytes) -> str:
+    return _blake3.blake3(b).hexdigest()
 
 
 HASH_NAME = _HASH_NAME
@@ -87,6 +82,11 @@ class InclusionProof:
     hash_name: str = HASH_NAME
 
     def verify(self, root: str) -> bool:
+        # A proof carries the hash suite it was built under. This module only speaks
+        # BLAKE3, so a proof committed under any other suite cannot be recomputed here
+        # -- reject rather than silently recompute under the wrong hash.
+        if self.hash_name != HASH_NAME:
+            return False
         return verify_proof(self.leaf, self.path, root)
 
     def to_json(self) -> dict:

{vitnify-0.2.4 → vitnify-0.2.6}/src/vitnify/certificate.py

@@ -41,17 +41,16 @@ def _now_iso() -> str:
     from datetime import datetime, timezone
     return datetime.now(timezone.utc).strftime("%Y-%m-%dT%H:%M:%SZ")
 
-try:
-    import blake3 as _blake3
-    def _digest32(b: bytes) -> str:
-        return _blake3.blake3(b).hexdigest()
-except ImportError:
-    import hashlib
-    def _digest32(b: bytes) -> str:
-        return hashlib.blake2b(b, digest_size=32).hexdigest()
+# BLAKE3 is a hard dependency and DEFINES the wire format: a blake2b digest is a
+# different value, so there is no silent stdlib fallback (see events.py). A missing
+# blake3 fails loudly rather than producing incompatible digests.
+import blake3 as _blake3
+def _digest32(b: bytes) -> str:
+    return _blake3.blake3(b).hexdigest()
 
-# cryptography is imported lazily inside the ed25519 helpers so the fallback path
-# still runs on a stock Python without the dependency.
+# `cryptography` is imported lazily inside the ed25519 helpers, so HMAC-only signing
+# works without it installed. (blake3, above, is a hard dependency -- there is no
+# hash-free path; the module will not import without it.)
 
 
 def _canon(o) -> str:
@@ -121,10 +120,18 @@ def issue_certificate(program_hash, capabilities, log: EventLog, priv=None, key:
     """Build and sign a vitnify-receipt for a completed run.
 
     The model-computation digests are read from the log's llm_call events, so the
-    receipt binds exactly the model steps that were recorded. Each receipt is
-    stamped with an issuer-asserted UTC time, a random nonce, and a run id (pass
-    `run_id` to set your own; a random one is used otherwise) so distinct runs
-    produce distinct, time-placeable receipts. ed25519 (self-verifying) is the
+    receipt binds exactly the model steps that were recorded. `model_digests` is
+    EMPTY for a run with no recomputable model step (a hosted API, or a torch /
+    non-deterministic backend) -- such a receipt is integrity-only: it binds the
+    transcript, not the computation.
+
+    `program_hash` is CALLER-ASSERTED -- the receipt binds whatever string you pass;
+    it does not itself hash your agent's code. Pass a hash of the exact program or
+    config that ran if you want the receipt to pin it.
+
+    Each receipt is stamped with an issuer-asserted UTC time, a random nonce, and a
+    run id (pass `run_id` to set your own; a random one is used otherwise) so distinct
+    runs produce distinct, time-placeable receipts. ed25519 (self-verifying) is the
     canonical signing path; pass `priv`.
     """
     cas = MerkleCAS(log.chunks())
@@ -224,5 +231,17 @@ def verify_certificate(cert: ExecutionCertificate, log: EventLog, key: bytes | N
         checks["signer_pinned"] = (
             sig_valid and cert.sig_alg == "ed25519" and cert.pubkey in set(pinned_pubkeys))
 
-    checks["ok"] = all(checks.values())
+    # Enforcement vs observation. An "allow"/"deny" decision came from the capability
+    # wall -- the call was GATED. Any other value (e.g. "observed" from the record-only
+    # callback adapter) means it was WATCHED, not enforced, so the receipt is a
+    # tamper-evident transcript, not proof containment was applied -- the containment
+    # analogue of an empty model_digests. Reported separately, NOT folded into ok, so a
+    # valid transcript stays valid while a containment PROOF requires ok AND this True.
+    checks["containment_enforced"] = all(
+        str(e.payload.get("decision", "")).strip().lower() in ("allow", "deny")
+        for e in log.events
+        if e.kind == Kind.TOOL_CALL.value
+    )
+
+    checks["ok"] = all(v for k, v in checks.items() if k != "containment_enforced")
     return checks

{vitnify-0.2.4 → vitnify-0.2.6}/src/vitnify/engine.py

@@ -10,14 +10,12 @@ The engine is the `vitni-receipt` binary (built from the vitni-tensor crate). Po
 from __future__ import annotations
 import os, json, subprocess
 
-try:
-    import blake3 as _blake3
-    def _h32(b: bytes) -> str:
-        return _blake3.blake3(b).hexdigest()
-except ImportError:
-    import hashlib
-    def _h32(b: bytes) -> str:
-        return hashlib.blake2b(b, digest_size=32).hexdigest()
+# BLAKE3 is a hard dependency and DEFINES the wire format (see events.py): the prompt
+# hash bound into a receipt must be blake3, so there is no silent blake2b fallback -- a
+# missing blake3 fails loudly rather than binding an incompatible digest.
+import blake3 as _blake3
+def _h32(b: bytes) -> str:
+    return _blake3.blake3(b).hexdigest()
 
 DEFAULT_BIN = os.environ.get("VITNI_RECEIPT_BIN", "vitni-receipt")
 

{vitnify-0.2.4 → vitnify-0.2.6}/src/vitnify/events.py

@@ -13,14 +13,14 @@ import json
 from dataclasses import dataclass, asdict
 from enum import Enum
 
-try:
-    import blake3 as _blake3
-    def _h32(b: bytes) -> str:
-        return _blake3.blake3(b).hexdigest()
-except ImportError:  # stdlib fallback; wire format is identical either way
-    import hashlib
-    def _h32(b: bytes) -> str:
-        return hashlib.blake2b(b, digest_size=32).hexdigest()
+# BLAKE3 is a hard dependency and DEFINES the wire format: a blake2b digest is a
+# different value, so there is no silent stdlib fallback -- one would make honest
+# receipts indistinguishable from forgeries across implementations (and the receipt
+# carries no hash-suite identifier to tell them apart). A normal `pip install
+# vitnify` always resolves the wheel; a missing blake3 fails loudly, not silently.
+import blake3 as _blake3
+def _h32(b: bytes) -> str:
+    return _blake3.blake3(b).hexdigest()
 
 
 def canon(obj) -> str:

{vitnify-0.2.4 → vitnify-0.2.6}/src/vitnify/viewer.py

@@ -85,9 +85,25 @@ def render(run: dict) -> str:
     def badge(ok, yes, no):
         return f'<div class="badge {"good" if ok else "bad"}"><span class="dot"></span>{yes if ok else no}</div>'
 
+    def warn_badge(text):
+        return f'<div class="badge warn"><span class="dot"></span>{text}</div>'
+
+    # Whether the receipt PROVES containment, derived from the events the same way the
+    # verifier does: every tool decision must be a gated allow/deny. An observe-only
+    # run (a watching callback that records but does not gate) is a valid transcript but
+    # proves no containment -- it must NOT render as a plain green "verified" receipt,
+    # or a non-engineer is handed a badge that claims more than the receipt shows.
+    containment_enforced = all(
+        str(e["payload"].get("decision", "")).strip().lower() in ("allow", "deny")
+        for e in events if e["kind"] == "tool_call")
+    containment_badge = (badge(True, "Containment enforced", "")
+                         if containment_enforced
+                         else warn_badge("Containment observed — not proven"))
+
     badges = (badge(v["contained"], "Injection contained", "NOT contained")
               + badge(v["replay_identical"], "Replay bit-identical", "Replay diverged")
-              + badge(v["cert_ok"], "Certificate verified", "Certificate FAILED"))
+              + badge(v["cert_ok"], "Certificate verified", "Certificate FAILED")
+              + containment_badge)
 
     cert_rows = "".join(
         f'<div class="crow"><span class="ck">{k}</span><span class="cv mono">{_esc(val)}</span></div>'
@@ -105,17 +121,17 @@ def render(run: dict) -> str:
 :root {{
   --bg:#FBFBFD; --surface:#FFFFFF; --surface-2:#F4F5F8; --ink:#1b1f27; --ink-dim:#5a6270;
   --border:#E4E7ED; --accent:#0FB5A6; --ok:#1F9D63; --ok-bg:#E7F5EE; --deny:#D6532E; --deny-bg:#FBECE6;
-  --tamper:#E5484D; --mono-bg:#F2F4F7; --shadow:0 1px 2px rgba(20,26,40,.05),0 8px 24px rgba(20,26,40,.05);
+  --warn:#B7791F; --tamper:#E5484D; --mono-bg:#F2F4F7; --shadow:0 1px 2px rgba(20,26,40,.05),0 8px 24px rgba(20,26,40,.05);
 }}
 @media (prefers-color-scheme:dark){{ :root:not([data-theme="light"]){{
   --bg:#0E1116; --surface:#161A21; --surface-2:#1C222B; --ink:#E6E9EF; --ink-dim:#98A2B3;
   --border:#262D38; --accent:#25C6B6; --ok:#3FBE7C; --ok-bg:#12291E; --deny:#EE7A54; --deny-bg:#2A1811;
-  --tamper:#F2585B; --mono-bg:#12161C; --shadow:0 1px 2px rgba(0,0,0,.4),0 12px 32px rgba(0,0,0,.35);
+  --warn:#E0A93B; --tamper:#F2585B; --mono-bg:#12161C; --shadow:0 1px 2px rgba(0,0,0,.4),0 12px 32px rgba(0,0,0,.35);
 }} }}
 :root[data-theme="dark"] {{
   --bg:#0E1116; --surface:#161A21; --surface-2:#1C222B; --ink:#E6E9EF; --ink-dim:#98A2B3;
   --border:#262D38; --accent:#25C6B6; --ok:#3FBE7C; --ok-bg:#12291E; --deny:#EE7A54; --deny-bg:#2A1811;
-  --tamper:#F2585B; --mono-bg:#12161C; --shadow:0 1px 2px rgba(0,0,0,.4),0 12px 32px rgba(0,0,0,.35);
+  --warn:#E0A93B; --tamper:#F2585B; --mono-bg:#12161C; --shadow:0 1px 2px rgba(0,0,0,.4),0 12px 32px rgba(0,0,0,.35);
 }}
 *{{box-sizing:border-box}}
 body{{margin:0;background:var(--bg);color:var(--ink);
@@ -133,6 +149,7 @@ h1{{font-size:27px;margin:0;letter-spacing:-.01em;text-wrap:balance;}}
 .badge .dot{{width:8px;height:8px;border-radius:50%;}}
 .badge.good{{color:var(--ok);}} .badge.good .dot{{background:var(--ok);}}
 .badge.bad{{color:var(--tamper);}} .badge.bad .dot{{background:var(--tamper);}}
+.badge.warn{{color:var(--warn);}} .badge.warn .dot{{background:var(--warn);}}
 section{{background:var(--surface);border:1px solid var(--border);border-radius:14px;padding:22px 22px;margin:16px 0;box-shadow:var(--shadow);}}
 .sec-h{{display:flex;align-items:baseline;justify-content:space-between;gap:12px;margin:0 0 14px;}}
 .sec-h h2{{font-size:13px;letter-spacing:.09em;text-transform:uppercase;color:var(--ink-dim);margin:0;font-weight:700;}}
@@ -174,7 +191,7 @@ footer{{color:var(--ink-dim);font-size:12px;margin-top:26px;text-align:center;}}
 
 <div class="wrap">
   <header class="top">
-    <div class="eyebrow">VitniReplay &middot; Execution Certificate</div>
+    <div class="eyebrow">Vitnify &middot; Execution Certificate</div>
     <h1>This agent run was contained, replayed bit-for-bit, and cryptographically certified.</h1>
     <p class="task">Task recorded: &ldquo;{_esc(run.get('task','(agent run)'))}&rdquo;</p>
   </header>

{vitnify-0.2.4 → vitnify-0.2.6/src/vitnify.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: vitnify
-Version: 0.2.4
+Version: 0.2.6
 Summary: Execution receipts for AI agents: contain, deterministically reconstruct, and cryptographically certify a run.
 Author: vitnify
 License: Apache-2.0
@@ -64,8 +64,13 @@ log.append(Kind.TOOL_CALL, {"tool": "send_email", "decision": "deny"})  # ungran
 priv, pub = gen_ed25519()
 cert, _ = issue_certificate("program_hash", ["read_docs"], log, priv=priv)
 
-verify_certificate(cert, log)   # level 1: offline integrity — no model, no secret
-# level 2: re-run each step through the engine; every model_digest reproduces bit-for-bit
+checks = verify_certificate(cert, log)   # level 1: offline integrity — no model, no secret
+assert checks["ok"]                       # signed, unaltered, and no ungranted tool ran
+assert checks["containment_enforced"]     # every tool call was GATED, not merely observed
+# A receipt can be ok=True yet containment_enforced=False — a valid transcript from a
+# watch-only integration proves what ran, not that anything was contained. A containment
+# claim requires BOTH. (level 2: re-run each step through the engine; every model_digest
+# reproduces bit-for-bit.)
 ```
 
 See [`vitnify-receipt-v2.md`](vitnify-receipt-v2.md) for the receipt format, and

{vitnify-0.2.4 → vitnify-0.2.6}/tests/test_verify_hardening.py

@@ -120,3 +120,23 @@ def test_f12_unknown_event_kind_is_rejected():
     log.append(Kind.AGENT_STEP, {"state": "done"})
     cert, _ = issue_certificate("prog", ["read_docs"], log, priv=priv)
     assert verify_certificate(cert, log)["ok"] is True
+
+
+def test_observe_only_receipt_is_flagged_not_masqueraded():
+    # A record-only adapter records tool calls with decision "observed" -- watched,
+    # not gated. Such a receipt is a valid transcript (ok=True) but must be FLAGGED
+    # containment_enforced=False so it can't pass as a containment proof; an enforced
+    # allow/deny receipt reads containment_enforced=True.
+    priv, _ = gen_ed25519()
+
+    def receipt(decision, caps):
+        log = EventLog()
+        log.append(Kind.TOOL_CALL, {"tool": "send_email", "args": ["x"], "decision": decision, "result": "sent"})
+        cert, _ = issue_certificate("prog", caps, log, priv=priv)
+        return verify_certificate(cert, log)
+
+    r = receipt("OBSERVED", ["read_docs", "send_email"])        # observed + granted
+    assert r["ok"] is True and r["containment_enforced"] is False
+    assert receipt("OBSERVED", ["read_docs"])["ok"] is False    # observed ungranted tool ran -> rejected
+    r = receipt("ALLOW", ["read_docs", "send_email"])           # enforced allow -> real proof
+    assert r["ok"] is True and r["containment_enforced"] is True