# proof-kinds: one builder for every AIP-23 proof kind

A generic builder of AERE Proof Protocol envelopes (AIP-23) for the standard proof kinds: `data`, `execution`, `identity`,
`compliance`, `runtime`, `location`, `device`, `payment`, `ownership`, `time`, `block`, `authorization`, `settlement`,
`provenance` and, since 2026-10-18, `secret-access`. Every kind produces the same envelope (`statement` plus `statementHash`, the
SHA-256 of the canonical statement text), so the same AIP-23 reference verifier checks all of them with no kind-specific
verification code.

```
import { buildProof, KINDS } from './proof-kinds.mjs';
const envelope = buildProof('runtime', { host, artifactContent, attested, matches: true, createdAt });
```

A kind is a schema: its required fields, some of them digests, plus `createdAt`. Raw content given for a digest field is hashed
(bytes as they are, strings as UTF-8, other values as their JSON text), and a value that is already a 32-byte digest is kept, so
an envelope carries digests, never the raw content. A missing required field stops the build with an error instead of producing
an incomplete envelope. Notarization and the post-quantum certificate over it come from AIP-23, not from this builder.

`secret-access` is the audit entry of the secrets service (`pq-secrets/`): the service (its audience), the secret name, the version,
the operation, the verdict (`allowed`, `refused`, or since 2026-10-18 `failed`: allowed and entered, then the change could not be
stored) with the rules that refused, the grant that allowed, the holder and the presenter (key-derived `aere-id` identities,
verified), the digest of the presentation's signed binding (`presentationHash`) and of the grant's policy (`policyHash`). It never
carries the secret value, nor a digest of it: a digest of a guessable value does not hide it. Since 2026-10-18 (the adversarial
review of the secrets service) it may also carry `requestHash` (the digest of the request received, already a 32-byte hash),
`claimedHolder` / `claimedPresenter` (ids a presentation claimed and nobody verified) and `judged` (on a refusal, each grant judged
with the rules it refused on); envelopes without these fields are byte for byte what they were.

**A kind may have a vocabulary** (`valori` in its schema: per field, a predicate and what it says), judged by `buildProof` on every
field present; `secret-access` is the only kind with one: `verdict` is `allowed`, `refused` or `failed`, `operation` one of the
operations of the secrets service (`SECRET_ACCESS.operations`, which the service requires to be its own list), `version` an integer of
at least 1 or `null`, `rules` a list of rule names, ids `aere-id:` + 40 hex or `null`, `createdAt` an RFC 3339 time. An envelope with
the verdict `banana` is no longer built. The reference verifier does not judge vocabularies (it judges the form and the hash of any
kind), so an envelope written by hand with such values stays `VALID` there: the vocabulary is the builder's promise, not the
verifier's. `KINDS.json` of the published copy names the values of each field that has them.

Test: `node proba-proof-kinds.mjs` (28 checks: every kind built and found `VALID` by the reference verifier, seven negative
controls such as content changed after hashing, a required field missing or a `secret-access` value outside its vocabulary, no raw
content in any envelope, bytes hashed as bytes, the new `secret-access` fields, the vocabulary held by that kind alone). It needs the AIP-23 reference verifier: `AERE_VERIFY_PROOF=<path to verify-proof.mjs>` (as published at
aere.network/tools, with `verify-anchor.mjs`, `mpt.mjs`, `falcon512.mjs`, `registry-v3.mjs` and `package.json` beside it and `npm install` done there); without it the test reports that it did not measure and exits with 2. Node.js 24.