vitnify 0.4.2__tar.gz → 0.4.4__tar.gz

{vitnify-0.4.2/src/vitnify.egg-info → vitnify-0.4.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: vitnify
-Version: 0.4.2
+Version: 0.4.4
 Summary: Execution receipts for AI agents: contain, deterministically reconstruct, and cryptographically certify a run.
 Author: vitnify
 License: Apache-2.0
@@ -91,7 +91,9 @@ See the [receipt format spec](https://github.com/vitnify/vitnify-receipt-spec/bl
 **Two verification levels — and when to use each.** *Level 1 (integrity)* is offline,
 instant, and needs no model — recompute the Merkle root and check the signature; this is
 the default for every receipt, and it's what proves containment and tamper-evidence.
-*Level 2 (recompute)* additionally re-runs the model to reproduce the committed logits.
+*Level 2 (recompute)* additionally re-runs the model to reproduce the committed output
+tokens (per-op / activation records — a stronger commitment — are an available mode the
+shipped binary does not emit).
 It is the **dispute path** — run on a contested subset when someone challenges a specific
 decision, **not** on every receipt inline. It is deliberately slow: the pinned-order
 deterministic engine trades throughput for bit-exactness, roughly two orders of magnitude

{vitnify-0.4.2 → vitnify-0.4.4}/README.md

@@ -65,7 +65,9 @@ See the [receipt format spec](https://github.com/vitnify/vitnify-receipt-spec/bl
 **Two verification levels — and when to use each.** *Level 1 (integrity)* is offline,
 instant, and needs no model — recompute the Merkle root and check the signature; this is
 the default for every receipt, and it's what proves containment and tamper-evidence.
-*Level 2 (recompute)* additionally re-runs the model to reproduce the committed logits.
+*Level 2 (recompute)* additionally re-runs the model to reproduce the committed output
+tokens (per-op / activation records — a stronger commitment — are an available mode the
+shipped binary does not emit).
 It is the **dispute path** — run on a contested subset when someone challenges a specific
 decision, **not** on every receipt inline. It is deliberately slow: the pinned-order
 deterministic engine trades throughput for bit-exactness, roughly two orders of magnitude

{vitnify-0.4.2 → vitnify-0.4.4}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "vitnify"
-version = "0.4.2"
+version = "0.4.4"
 description = "Execution receipts for AI agents: contain, deterministically reconstruct, and cryptographically certify a run."
 readme = "README.md"
 requires-python = ">=3.10"

{vitnify-0.4.2 → vitnify-0.4.4}/src/vitnify/viewer.py

@@ -119,7 +119,7 @@ def render(run: dict) -> str:
     #                   UNESTABLISHED (no trust root) -- shown as such, NOT as "failed".
     integrity_ok = bool(v.get("integrity_ok"))
     authority_ok = v.get("authority_ok")          # True / False / None
-    replay_ok = bool(v.get("replay_identical"))
+    replay = v.get("replay_identical")            # True / False / None — see the three-state badge
     # Containment is trustworthy only on a verified (untampered) log -- that is INTEGRITY,
     # not authority: a stranger with no trust root can still see the run was contained.
     containment_proven = integrity_ok and bool(tool_events) and all_gated
@@ -144,15 +144,24 @@ def render(run: dict) -> str:
     else:
         containment_badge = badge(True, "Containment enforced", "")   # every call gated; none needed blocking
 
-    badges = (integrity_badge + authority_badge + containment_badge
-              + badge(replay_ok, "Replay bit-identical", "Replay diverged"))
+    # Replay is ALSO three-state: not-run (absent) must not read as diverged. L2 recompute
+    # is the DISPUTE path, so the common receipt carries no replay data -- rendering that as
+    # a red "diverged" asserts a failure that never happened (the same shape as authority).
+    if replay is True:
+        replay_badge = badge(True, "Replay bit-identical", "")
+    elif replay is False:
+        replay_badge = badge(False, "", "Replay diverged")
+    else:
+        replay_badge = neutral_badge("Replay not run — L1 verdict only")
+
+    badges = integrity_badge + authority_badge + containment_badge + replay_badge
 
     # Headline asserts ONLY what the evidence supports. Integrity is the base claim (anyone
     # can verify it offline); authority is claimed ONLY when a trust root confirmed it --
     # an unestablished authority is never dressed up as verified.
     claims = (["integrity-verified"] if integrity_ok else []) \
         + (["contained"] if containment_proven else []) \
-        + (["replayed bit-for-bit"] if replay_ok else []) \
+        + (["replayed bit-for-bit"] if replay is True else []) \
         + (["signed by an approved runtime"] if authority_ok is True else [])
     if not claims:
         headline = "Recorded agent run."
@@ -171,9 +180,22 @@ def render(run: dict) -> str:
             ("event-log root", cert["event_root"]),
             ("chain head", cert["head_hash"]),
             ("certificate id", cert.get("digest", "—")),
-            ("signature", cert.get("sig", "—")),
+            (f"signature ({_esc(cert['sig_alg'])})" if cert.get("sig_alg") else "signature",
+             cert.get("sig", "—")),
         ])
 
+    # Footer is DERIVED, never a hardcoded claim. State only what the page proves, and the
+    # ACTUAL signature algorithm from the receipt (not a fixed "HMAC"). No batch-invariance
+    # claim: that determinism property is NOT closed by the engine -- it is precisely why
+    # level 2 is a single-request path, so asserting it here would be false.
+    sig_alg = cert.get("sig_alg")
+    sig_note = f"Signed with {_esc(sig_alg)}. " if sig_alg else ""
+    footer_text = (sig_note +
+        "Verified offline from the receipt alone — no model, no network, no secret. "
+        "Level-2 recomputation (re-run the model to reproduce the committed output tokens) is the "
+        "dispute path for a contested run, not required for the integrity, containment, and "
+        "authority verdicts above.")
+
     return f"""<title>Agent Replay Certificate</title>
 <style>
 :root {{
@@ -277,7 +299,7 @@ footer{{color:var(--ink-dim);font-size:12px;margin-top:26px;text-align:center;}}
     </div>
   </section>
 
-  <footer>Recorded under production batch load, replayed alone &mdash; bit-identical only because inference is batch-invariant. HMAC signing shown; ed25519/TPM in production.</footer>
+  <footer>{_esc(footer_text)}</footer>
 </div>
 
 <script>

{vitnify-0.4.2 → vitnify-0.4.4/src/vitnify.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: vitnify
-Version: 0.4.2
+Version: 0.4.4
 Summary: Execution receipts for AI agents: contain, deterministically reconstruct, and cryptographically certify a run.
 Author: vitnify
 License: Apache-2.0
@@ -91,7 +91,9 @@ See the [receipt format spec](https://github.com/vitnify/vitnify-receipt-spec/bl
 **Two verification levels — and when to use each.** *Level 1 (integrity)* is offline,
 instant, and needs no model — recompute the Merkle root and check the signature; this is
 the default for every receipt, and it's what proves containment and tamper-evidence.
-*Level 2 (recompute)* additionally re-runs the model to reproduce the committed logits.
+*Level 2 (recompute)* additionally re-runs the model to reproduce the committed output
+tokens (per-op / activation records — a stronger commitment — are an available mode the
+shipped binary does not emit).
 It is the **dispute path** — run on a contested subset when someone challenges a specific
 decision, **not** on every receipt inline. It is deliberately slow: the pinned-order
 deterministic engine trades throughput for bit-exactness, roughly two orders of magnitude

{vitnify-0.4.2 → vitnify-0.4.4}/tests/test_viewer.py

@@ -37,7 +37,7 @@ def _build(decisions, *, cert_ok=True, replay=True, authority=None):
         "events": [asdict(e) for e in log.events],
         "certificate": {"program_hash": cert.program_hash, "capabilities": cert.capabilities,
                         "event_root": cert.event_root, "head_hash": cert.head_hash,
-                        "digest": cert.digest(), "sig": cert.sig},
+                        "digest": cert.digest(), "sig": cert.sig, "sig_alg": cert.sig_alg},
         "verdict": {"replay_identical": replay, "integrity_ok": cert_ok, "authority_ok": authority},
     }
     return run, log
@@ -98,6 +98,32 @@ def test_authority_badge_is_three_state():
     assert "signed by an approved runtime" not in _headline(render(_build(["allow"], authority=None)[0]))
 
 
+def test_replay_badge_is_three_state():
+    """not-run (absent) must read neutral, NOT a red 'diverged' -- the same false-negative
+    the authority split removed, and now the COMMON case since L2 is the dispute path."""
+    run, _ = _build(["allow"], replay=None)         # no replay data (L1-only receipt)
+    b = _badges(render(run))
+    assert ("neutral", "Replay not run — L1 verdict only") in b
+    assert not any(t == "Replay diverged" for _, t in b)
+    assert "replayed bit-for-bit" not in _headline(render(run))
+    # ran & identical -> good; ran & diverged -> bad (distinct from not-run)
+    assert ("good", "Replay bit-identical") in _badges(render(_build(["allow"], replay=True)[0]))
+    assert ("bad", "Replay diverged") in _badges(render(_build(["allow"], replay=False)[0]))
+
+
+def test_footer_makes_no_unbacked_claims():
+    """The footer must not assert batch-invariance (not an engine property) or a fixed
+    HMAC (the demo signs ed25519). It is derived from the run, not hardcoded marketing."""
+    html = render(_build(["allow"])[0])
+    assert "batch-invariant" not in html and "batch invariant" not in html
+    assert "HMAC signing" not in html
+    assert "ed25519" in html                         # the real signature algorithm, shown
+    # L2 reproduces the committed OUTPUT TOKENS, not logits (the shipped binary emits
+    # output_tokens + hash, n_ops=0; logits are a stronger, non-default mode). Never overclaim.
+    assert "committed logits" not in html
+    assert "committed output tokens" in html
+
+
 def test_cert_failed_drops_all_derived_claims():
     # If the certificate does not verify, the event log is UNVERIFIED -- it may be the
     # very forgery the certificate exists to catch -- so the page must not claim