vitnify 0.2.7__tar.gz → 0.2.9__tar.gz

{vitnify-0.2.7/src/vitnify.egg-info → vitnify-0.2.9}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: vitnify
-Version: 0.2.7
+Version: 0.2.9
 Summary: Execution receipts for AI agents: contain, deterministically reconstruct, and cryptographically certify a run.
 Author: vitnify
 License: Apache-2.0

{vitnify-0.2.7 → vitnify-0.2.9}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "vitnify"
-version = "0.2.7"
+version = "0.2.9"
 description = "Execution receipts for AI agents: contain, deterministically reconstruct, and cryptographically certify a run."
 readme = "README.md"
 requires-python = ">=3.10"

{vitnify-0.2.7 → vitnify-0.2.9}/src/vitnify/certificate.py

@@ -177,7 +177,11 @@ def verify_certificate(cert: ExecutionCertificate, log: EventLog, key: bytes | N
     model_digest through vitni-tensor -- is a separate step that additionally
     needs the model weights.)
     """
-    cas = MerkleCAS(log.chunks())
+    # An empty event log has no Merkle commitment, so no legitimately issued receipt
+    # carries one (issue_certificate commits >=1 event). A verifier must FAIL CLOSED on
+    # such degenerate/hostile input, never crash: compute the root only when there are
+    # events and treat its absence as a non-match, instead of letting MerkleCAS raise.
+    cas_root = MerkleCAS(log.chunks()).root if log.events else None
     # Every event kind must be recognised. The semantic checks below filter events
     # by an EXACT kind match, so an unknown kind ("TOOL_CALL", "toolcall", ...) would
     # slip past them silently -- the same self-declared-label class as an unknown
@@ -187,7 +191,7 @@ def verify_certificate(cert: ExecutionCertificate, log: EventLog, key: bytes | N
     checks = {
         "format": cert.v in SUPPORTED_FORMATS,
         "kinds_known": all(e.kind in known_kinds for e in log.events),
-        "root_matches": cas.root == cert.event_root,
+        "root_matches": cas_root is not None and cas_root == cert.event_root,
         "head_matches": log.head() == cert.head_hash,
         "count_matches": len(log) == cert.n_events,
         "model_digests_match": log.model_digests() == list(cert.model_digests),

{vitnify-0.2.7 → vitnify-0.2.9}/src/vitnify/viewer.py

@@ -89,31 +89,46 @@ def render(run: dict) -> str:
     def warn_badge(text):
         return f'<div class="badge warn"><span class="dot"></span>{text}</div>'
 
+    def neutral_badge(text):
+        return f'<div class="badge neutral"><span class="dot"></span>{text}</div>'
+
     # Every containment claim on this page is DERIVED from the events with the SAME rule
     # the verifier uses (decision_is_gated) -- never taken from the caller's verdict dict.
-    # An observe-only run (a watching callback that records but does not gate) is a valid
-    # transcript that proves no containment; it must not read as "contained" anywhere,
-    # headline included, or a non-engineer is handed a claim stronger than the receipt.
+    # But a claim is only as strong as the evidence under it, so the page asserts
+    # containment POSITIVELY only when both hold:
+    #   * the certificate verifies -- otherwise the log is UNVERIFIED and may be the very
+    #     forgery the certificate exists to catch, so nothing derived from it can be
+    #     trusted, containment included; and
+    #   * a tool was actually gated -- a run that called no tool has nothing to contain,
+    #     so "contained" would be vacuously true.
+    # verify_certificate reports those cases as containment_enforced=True (a machine
+    # predicate over the events alone); the human page is deliberately stricter and never
+    # reads as "contained" on unverified or empty evidence.
     tool_events = [e for e in events if e["kind"] == "tool_call"]
-    containment_enforced = all(decision_is_gated(e["payload"].get("decision")) for e in tool_events)
+    all_gated = all(decision_is_gated(e["payload"].get("decision")) for e in tool_events)
     blocked = any(str(e["payload"].get("decision", "")).strip().lower() == "deny" for e in tool_events)
     cert_ok = bool(v.get("cert_ok"))
     replay_ok = bool(v.get("replay_identical"))
+    containment_proven = cert_ok and bool(tool_events) and all_gated
 
-    if not containment_enforced:
+    if not cert_ok:
+        containment_badge = warn_badge("Containment unverified — certificate failed")
+    elif not tool_events:
+        containment_badge = neutral_badge("No tool calls")            # nothing to contain
+    elif not all_gated:
         containment_badge = warn_badge("Containment observed — not proven")
     elif blocked:
-        containment_badge = badge(True, "Injection contained", "")   # an ungranted call was refused
+        containment_badge = badge(True, "Injection contained", "")    # an ungranted call was refused
     else:
-        containment_badge = badge(True, "Containment enforced", "")  # every call gated; none needed blocking
+        containment_badge = badge(True, "Containment enforced", "")   # every call gated; none needed blocking
 
     badges = (containment_badge
               + badge(replay_ok, "Replay bit-identical", "Replay diverged")
               + badge(cert_ok, "Certificate verified", "Certificate FAILED"))
 
-    # Headline asserts ONLY what holds. "contained" tracks containment_enforced (not the
-    # caller), so the observe-only page drops the word instead of retracting it below.
-    claims = (["contained"] if containment_enforced else []) \
+    # Headline asserts ONLY what the evidence supports: "contained" needs a verified log
+    # AND a gated tool; "cryptographically certified" needs the signature to check out.
+    claims = (["contained"] if containment_proven else []) \
         + (["replayed bit-for-bit"] if replay_ok else []) \
         + (["cryptographically certified"] if cert_ok else [])
     if not claims:
@@ -170,6 +185,7 @@ h1{{font-size:27px;margin:0;letter-spacing:-.01em;text-wrap:balance;}}
 .badge.good{{color:var(--ok);}} .badge.good .dot{{background:var(--ok);}}
 .badge.bad{{color:var(--tamper);}} .badge.bad .dot{{background:var(--tamper);}}
 .badge.warn{{color:var(--warn);}} .badge.warn .dot{{background:var(--warn);}}
+.badge.neutral{{color:var(--ink-dim);}} .badge.neutral .dot{{background:var(--ink-dim);}}
 section{{background:var(--surface);border:1px solid var(--border);border-radius:14px;padding:22px 22px;margin:16px 0;box-shadow:var(--shadow);}}
 .sec-h{{display:flex;align-items:baseline;justify-content:space-between;gap:12px;margin:0 0 14px;}}
 .sec-h h2{{font-size:13px;letter-spacing:.09em;text-transform:uppercase;color:var(--ink-dim);margin:0;font-weight:700;}}

{vitnify-0.2.7 → vitnify-0.2.9/src/vitnify.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: vitnify
-Version: 0.2.7
+Version: 0.2.9
 Summary: Execution receipts for AI agents: contain, deterministically reconstruct, and cryptographically certify a run.
 Author: vitnify
 License: Apache-2.0

{vitnify-0.2.7 → vitnify-0.2.9}/tests/test_verify_hardening.py

@@ -11,7 +11,8 @@ verification-bypass that must stay closed:
   F5  optional key pinning rejects an unpinned (but otherwise valid) signer
 """
 from vitnify.events import EventLog, Kind
-from vitnify.certificate import issue_certificate, verify_certificate, gen_ed25519
+from vitnify.certificate import (
+    ExecutionCertificate, issue_certificate, verify_certificate, gen_ed25519)
 
 
 def _log(tool, decision):
@@ -140,3 +141,16 @@ def test_observe_only_receipt_is_flagged_not_masqueraded():
     assert receipt("OBSERVED", ["read_docs"])["ok"] is False    # observed ungranted tool ran -> rejected
     r = receipt("ALLOW", ["read_docs", "send_email"])           # enforced allow -> real proof
     assert r["ok"] is True and r["containment_enforced"] is True
+
+
+def test_empty_log_fails_closed_not_raises():
+    # A verifier must never CRASH on degenerate/hostile input. An empty event log has no
+    # Merkle commitment (no legitimately issued receipt has one), so verification must
+    # return ok=False -- not raise ValueError from MerkleCAS on the empty chunk list.
+    priv, _ = gen_ed25519()
+    log = EventLog()                      # zero events
+    # A signed certificate that merely CLAIMS an empty run must still not verify.
+    cert = ExecutionCertificate("prog", [], "0" * 64, 0, "genesis").sign_ed25519(priv)
+    checks = verify_certificate(cert, log)   # must not raise
+    assert checks["ok"] is False
+    assert checks["root_matches"] is False

{vitnify-0.2.7 → vitnify-0.2.9}/tests/test_viewer.py

@@ -80,22 +80,41 @@ def test_enforced_all_allow_claims_containment():
     assert "Containment observed" not in html
 
 
-def test_headline_drops_uncertified_claim():
+def test_cert_failed_drops_all_derived_claims():
+    # If the certificate does not verify, the event log is UNVERIFIED -- it may be the
+    # very forgery the certificate exists to catch -- so the page must not claim
+    # containment (or certification) from it, even though every event reads as gated.
     run, _ = _build(["allow"], cert_ok=False)
-    headline = _headline(render(run))
+    html = render(run)
+    headline = _headline(html)
     assert "cryptographically certified" not in headline
-    assert "contained" in headline.lower()  # containment still holds
+    assert "contained" not in headline.lower()
+    assert ("warn", "Containment unverified — certificate failed") in _badges(html)
+    assert ("bad", "Certificate FAILED") in _badges(html)
+    assert not any(t in ("Injection contained", "Containment enforced") for _, t in _badges(html))
 
 
-def test_viewer_containment_matches_verifier():
-    # The viewer and the verifier must never disagree about containment -- they share
-    # one predicate (decision_is_gated). Assert the page's warn badge appears iff the
-    # verifier reports containment_enforced=False, for both gated and observed runs.
-    for decisions in (["allow", "deny"], ["observed"], ["allow"], ["PERMIT"]):
-        run, log = _build(decisions)
+def test_zero_tool_run_is_not_vacuously_contained():
+    # all([]) is True, so a tool-free run is containment_enforced at the API level -- but
+    # the page must not tell a human the run was "contained" when nothing was ever gated.
+    run, _ = _build([])  # llm_call only, no tool calls
+    html = render(run)
+    assert "contained" not in _headline(html).lower()
+    assert ("neutral", "No tool calls") in _badges(html)
+
+
+def test_viewer_never_claims_containment_without_verified_gating():
+    # Soundness: the headline reads "contained" ONLY when the certificate verifies, a
+    # tool was actually gated, and the verifier's own predicate agrees gating held. The
+    # page never claims containment on unverified, empty, or ungated evidence.
+    cases = [(["allow", "deny"], True), (["observed"], True), (["allow"], True),
+             (["PERMIT"], True), (["allow"], False), ([], True)]
+    for decisions, cert_ok in cases:
+        run, log = _build(decisions, cert_ok=cert_ok)
+        says_contained = "contained" in _headline(render(run)).lower()
         enforced = verify_certificate(_recert(run), log)["containment_enforced"]
-        warned = "Containment observed — not proven" in render(run)
-        assert warned == (not enforced), decisions
+        if says_contained:
+            assert cert_ok and bool(decisions) and enforced, (decisions, cert_ok)
 
 
 def test_render_tolerates_missing_digest():