#!/usr/bin/env node
// genereaza-vectori.mjs: the conformance vectors, DERIVED from the producers and from evidence already recorded, never typed by hand.
//
//   node genereaza-vectori.mjs               rewrites vectori/ from: the producers run on fixed inputs (the AIP-23 kinds), the evidence
//                                            recorded on testnet 28001 beside the products (a receipt, five market timelines, a notarized
//                                            dataset commitment), and surse-proaspete.json (what needs a key, randomness or the chain)
//   node genereaza-vectori.mjs --verifica    regenerates in memory and compares with vectori/ byte for byte: LA ZI (0) or DIFERIT (1)
//   node genereaza-vectori.mjs --proaspat    completes surse-proaspete.json with what is MISSING from it (what is there stays, so the
//                                            vectors derived from it stay): keys made and discarded here sign a tree head (ML-DSA-65)
//                                            and its classical impostor (Ed25519), a random envelope nobody notarized, a small dataset
//                                            (random salts), the presentations of one identity credential with their forged siblings
//                                            (six hybrid key pairs), and the transaction of the recorded receipt READ from testnet 28001 (two
//                                            eth_ calls; nothing is sent). With --tot everything is made anew; with --refa <name>
//                                            ONE source is made anew (its vectors change, the others stay byte for byte)
//
// A vector is { artifact, input, expected: { verdict, failed, levels } }. An INVALID vector names its `base` (a vector that is not
// INVALID) and its `mutation`: ONE operation (set, remove, add at one JSON path) applied to the base input, so that it differs from the
// base in exactly one place and must be refused for exactly the rules in `expected.failed`. Where the rule sits under a hash (an amount
// under the instruction hash, an order under an index root) one place is not reachable: the mutation is then made at the PRODUCER
// (`mutation.producer`), the commitments above it recomputed, and `mutation.changed` lists every path that moved.
// `exercises` are the rules an implementation must be able to judge to be scored on the vector; `requires: ['rpc-28001']` marks the
// vectors that need the testnet endpoint (run only with --online).
import fs from 'node:fs'; import os from 'node:os'; import path from 'node:path'; import crypto from 'node:crypto'; import { fileURLToPath } from 'node:url';
import { buildProof, KINDS } from '../proof-kinds/proof-kinds.mjs';
import { buildProofOfAi } from '../proof-of-ai/proof-of-ai.mjs';
import { definePolicy, checkAction, decisionEnvelope } from '../agents/agent-policy.mjs';
import { capDeArbore, dovadaIncludere, dovadaConsistenta } from '../verify-layer/jurnal-arbore.mjs';
import { hashIntrare, semneazaCap } from '../verify-layer/sidecar.mjs';
import { merkleTree } from '../verify-layer/arbore-merkle.mjs';
import * as RISC from '../payments/risc.mjs';
import * as BAZA from '../verifiable-data/baza.mjs';
import { newAgentIdentity, openLedger, agentIdFromKey, sessionId, canonical as canonicLedger } from '../agents/agent-ledger.mjs';
import { construieste as lantAI } from '../ai-trust/lant-de-incredere.mjs';
import * as ID from '../identity/identity.mjs';
import * as DV from '../device-identity/device.mjs';
import { hartaPublica, LEVELS } from './reguli.mjs';

const AICI = path.dirname(fileURLToPath(import.meta.url));
const DIR = path.join(AICI, 'vectori'); const PROASPETE = path.join(AICI, 'surse-proaspete.json');
const DOV = { chitanta: new URL('../payments/dovezi/chitanta-28001-2026-10-02T1716Z.json', import.meta.url), piata: new URL('../market-settlement/dovezi/piata-28001-2026-10-02T1652Z.json', import.meta.url),
  date: new URL('../verifiable-data/dovezi/notarizare-28001-2026-10-02T0820Z.json', import.meta.url),
  lantAI: new URL('../ai-trust/dovezi/lant-28001-2026-10-02T0519Z.json', import.meta.url) };
const citeste = (u) => JSON.parse(fs.readFileSync(fileURLToPath(u), 'utf8'));
const clona = (x) => JSON.parse(JSON.stringify(x));
const sha256 = (b) => '0x' + crypto.createHash('sha256').update(b).digest('hex');
const HARTA = hartaPublica();
const RPC_28001 = process.env.AERE_CONFORMANCE_RPC_28001 || 'https://testnet-rpc.aere.network';

// ---------- one operation at one path ----------
export function aplica(input, op) {
  const c = clona(input); let o = c; const p = op.path;
  for (const k of p.slice(0, -1)) { if (o == null || !(k in Object(o))) throw new Error('mutation path not in the base: ' + p.join('.')); o = o[k]; }
  const k = p[p.length - 1];
  if (op.op === 'set') { if (!(k in Object(o))) throw new Error('set: nothing at ' + p.join('.')); o[k] = clona(op.value); }
  else if (op.op === 'add') { if (k in Object(o)) throw new Error('add: something already at ' + p.join('.')); o[k] = clona(op.value); }
  else if (op.op === 'remove') { if (!(k in Object(o))) throw new Error('remove: nothing at ' + p.join('.')); if (Array.isArray(o)) o.splice(k, 1); else delete o[k]; }
  else throw new Error('unknown op ' + op.op);
  return c;
}
const nivele = (failed, extra = {}) => {
  const n = Object.fromEntries(LEVELS.map((l) => [l, 'NOT_MEASURED'])); n.integrity = 'PASSED'; Object.assign(n, extra);
  for (const r of failed) { if (!HARTA[r]) throw new Error('a vector expects an unknown rule: ' + r); n[HARTA[r].level] = 'FAILED'; }
  return n;
};

const V = [];   // the vectors, in order
function valid(id, artifact, title, source, input, { exercises, requires = [], verdict = 'VALID', levels = {}, base = null, mutation = null }) {
  V.push({ v: 1, kind: 'aere-conformance-vector', id, artifact, title, source, requires, exercises: [...exercises].sort(), base, mutation, input, expected: { verdict, failed: [], levels: nivele([], levels) } });
  return input;
}
function invalid(id, title, bazaId, op, failed, { levels = {}, exercises = null, requires = null, producer = null } = {}) {
  const b = V.find((x) => x.id === bazaId); if (!b) throw new Error('no base ' + bazaId); if (b.expected.verdict === 'INVALID') throw new Error('the base of ' + id + ' is itself INVALID');
  const input = producer ? producer.input : aplica(b.input, op);
  const mutation = producer ? { producer: producer.note, changed: producer.changed } : op;
  V.push({ v: 1, kind: 'aere-conformance-vector', id, artifact: b.artifact, title, source: 'derived from ' + bazaId, requires: requires || b.requires, exercises: (exercises || b.exercises).slice().sort(), base: bazaId, mutation, input,
    expected: { verdict: 'INVALID', failed: [...failed].sort(), levels: nivele(failed, { ...b.expected.levels, ...levels }) } });
}

// ---------- the fresh sources: a key, randomness, the chain ----------
async function proaspat(tot, refa = []) {
  // what is already in surse-proaspete.json STAYS (the vectors derived from it stay byte for byte); only what is missing is made.
  // --tot remakes everything (other keys, other salts: every vector derived from the fresh sources changes).
  // --refa <name> remakes ONE source (its producers changed): the vectors derived from it change, every other vector stays.
  const P = !tot && fs.existsSync(PROASPETE) ? JSON.parse(fs.readFileSync(PROASPETE, 'utf8')) : { v: 1, kind: 'aere-conformance-fresh-sources', at: new Date().toISOString() };
  for (const n of refa) { if (!(n in PROASPETE_IN_PLUS)) throw new Error('--refa: no fresh source named ' + n + ' (one of: ' + Object.keys(PROASPETE_IN_PLUS).join(', ') + ')'); delete P[n]; }
  const AT = new Date().toISOString(); const facute = []; const INT = intrariKinds();
  if (!P.signedHead) { // a signed tree head: three envelopes in a hash-chained log, the head signed with an ML-DSA-65 key that exists only in this call
    let prev = '0x' + '00'.repeat(32);
    const jurnal = ['data', 'execution', 'time'].map((k, seq) => { const proof = buildProof(k, INT[k]); const hash = hashIntrare(seq, prev, proof); const e = { seq, prev, proof, hash }; prev = hash; return e; });
    const { privateKey } = crypto.generateKeyPairSync('ml-dsa-65');
    P.signedHead = capDeArbore(jurnal, { host: 'conformance', createdAt: AT, signKeyPem: privateKey.export({ type: 'pkcs8', format: 'pem' }) }); facute.push('signedHead');
  }
  if (!P.classicalHead) { // the same head "signed" by a signer that used a CLASSICAL key and declared the post-quantum scheme (the key exists only in this call)
    const { publicKey, privateKey } = crypto.generateKeyPairSync('ed25519'); const h = clona(P.signedHead);
    h.signature = { scheme: 'ml-dsa-65', publicKey: publicKey.export({ type: 'spki', format: 'der' }).toString('base64'), signature: crypto.sign(null, Buffer.from(JSON.stringify(h.statement), 'utf8'), privateKey).toString('base64') };
    P.classicalHead = h; facute.push('classicalHead');
  }
  if (!P.fresh) { P.fresh = buildProof('data', { name: 'conformance-fresh', content: crypto.randomBytes(32).toString('hex'), createdAt: AT }); facute.push('fresh'); }   // an envelope nobody notarized
  if (!P.receiptTx) { // the transaction of the recorded receipt, read from the chain
    const ins = citeste(DOV.chitanta).instruction;
    const rpc = async (method, params) => { const r = await fetch(RPC_28001, { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify({ jsonrpc: '2.0', id: 1, method, params }), signal: AbortSignal.timeout(20000) }); if (!r.ok) throw new Error(method + ': HTTP ' + r.status); const j = await r.json(); if (j.error || !j.result) throw new Error(method + ': ' + JSON.stringify(j.error || 'no result')); return j.result; };
    const t = await rpc('eth_getTransactionByHash', [ins.txHash]); const rc = await rpc('eth_getTransactionReceipt', [ins.txHash]);
    P.receiptTx = { chainId: 28001, readAt: AT, tx: { from: t.from, to: t.to, value: t.value, blockHash: t.blockHash }, txReceipt: { status: rc.status, blockHash: rc.blockHash } }; facute.push('receiptTx');
  }
  if (!P.dataset) { // a small dataset: 12 records committed as version 1, 4 more as version 2
    const T = fs.mkdtempSync(path.join(os.tmpdir(), 'aere-conf-set-'));
    try {
      const TARI = ['RO', 'DE', 'FR', 'ES']; const rec = (n, de = 0) => Array.from({ length: n }, (_, j) => { const k = de + j; return { id: 'r' + k, country: TARI[k % 4], age: 20 + ((k * 7) % 40), email: 'u' + k + '@example.test', note: 'undisclosed-' + k }; });
      const db = BAZA.creeaza(path.join(T, 'set'), { name: 'conformance', indexes: ['country', 'age'] });
      BAZA.adauga(db, rec(12)); BAZA.angajeaza(db, { createdAt: '2026-10-03T00:00:00.000Z' }); BAZA.adauga(db, rec(4, 12)); BAZA.angajeaza(db, { createdAt: '2026-10-03T00:01:00.000Z' });
      const c1 = BAZA.versiune(db, 1), c2 = BAZA.versiune(db, 2);
      const cerute = []; const seed = 'conformance-sample'; const k = 4;
      await BAZA.esantioneaza({ url: 'vector://served', commitment: c2, k, seed, ia: async (u) => { cerute.push(Number(u.split('/').pop())); return null; } });
      P.dataset = { older: c1, newer: c2, record: BAZA.dovadaInregistrare(db, 2, 5, { fields: ['country', 'age'] }), answer: BAZA.interogheaza(db, 2, { field: 'age', from: 30, to: 45, fields: ['country'] }),
        consistency: BAZA.dovadaConsistenta(db, 1, 2), sample: { k, seed, served: Object.fromEntries(cerute.map((i) => [String(i), BAZA.dovadaInregistrare(db, 2, i, { fields: ['country'] })])) } };
      facute.push('dataset');
    } finally { fs.rmSync(T, { recursive: true, force: true }); }
  }
  for (const [nume, face] of Object.entries(PROASPETE_IN_PLUS)) if (!P[nume]) { P[nume] = await face(P, AT); facute.push(nume); }
  fs.writeFileSync(PROASPETE, JSON.stringify(P, null, 1) + '\n');
  console.log(path.basename(PROASPETE) + ': ' + (facute.length ? 'made now: ' + facute.join(', ') : 'nothing was missing') + '; kept: ' + Object.keys(P).filter((k) => !['v', 'kind', 'at'].includes(k) && !facute.includes(k)).join(', '));
}
/** more fresh sources, each made once: name -> async (P, AT) => value. The sections of the vectors below add theirs here. */
/** the audit log of the vectors: six envelopes of the fixed inputs in a hash chain (no key, no randomness: remade the same every time) */
function jurnalAudit(strica = null) {
  const INT = intrariKinds(); let prev = '0x' + '00'.repeat(32);
  return ['data', 'execution', 'time', 'identity', 'location', 'device'].map((k, seq) => { const proof = buildProof(k, INT[k]); if (strica) strica(seq, proof); const hash = hashIntrare(seq, prev, proof); const e = { seq, prev, proof, hash }; prev = hash; return e; });
}
/** the attested head of the first `count` entries, in the form the sidecar's attest-head writes */
function capAudit(log, count) {
  const statement = { v: 1, kind: 'aere-audit-head', host: 'conformance', count, head: count ? log[count - 1].hash : '0x' + '00'.repeat(32), createdAt: '2026-10-03T00:00:00Z' };
  return { v: 1, kind: 'aere-audit-head-attestation', statement, statementHash: sha256(Buffer.from(JSON.stringify(statement), 'utf8')) };
}
const PROASPETE_IN_PLUS = {
  // the ledger of ONE agent (its ML-DSA-65 key exists only in this call): four entries written through the ledger; the same ledger
  // with its fourth entry written by an agent that signs what the ledger would not write (an empty approvals list, a false decision,
  // a revocation entry without a revocation); and a ledger whose "agent identity" is a classical key
  agentLedger: async () => {
    const t0 = Math.floor(Date.now() / 1000) - 3600; const sha = (s) => crypto.createHash('sha256').update(Buffer.from(s, 'utf8')).digest('hex');
    const identity = newAgentIdentity(); const { policy, policyHash } = definePolicy({ agentId: identity.agentId, spend: { amount: '100', windowSeconds: 3600 }, recipients: ['0xbbbb'], tools: ['retrieval'] });
    const L = openLedger({ identity, policy, policyHash, now: () => t0 });
    L.record({ kind: 'tool', tool: 'retrieval' }); L.record({ kind: 'payment', to: '0xbbbb', amount: '40' }); L.record({ kind: 'payment', to: '0xbbbb', amount: '70' });
    const trei = L.export(); L.record({ kind: 'tool', tool: 'retrieval' }); const base = L.export();
    const intrare = (key, prev, seq, body) => { const b = { ...body, seq }; const signature = crypto.sign(null, Buffer.from(`${seq}|${prev}|${canonicLedger(b)}`, 'utf8'), key).toString('base64'); return { seq, prev, body: b, signature, hash: sha(`${seq}|${prev}|${canonicLedger(b)}|${signature}`) }; };
    const antet = { v: 2, agentId: identity.agentId, policyHash, session: trei.session }; const prev3 = trei.entries[2].hash;
    const cu = (body) => ({ ...trei, entries: [...trei.entries, intrare(identity.privateKey, prev3, 3, { ...antet, at: t0, ...body })] });
    const unealta = { kind: 'tool', tool: 'retrieval', at: t0 };
    const cl = crypto.generateKeyPairSync('ed25519'); const idCl = agentIdFromKey(cl.publicKey); const pc = definePolicy({ agentId: idCl, tools: ['retrieval'] }); const sesCl = sessionId(idCl, pc.policyHash);
    const clasic = { version: base.version, agentId: idCl, publicKeyPem: cl.publicKey.export({ type: 'spki', format: 'pem' }), policyHash: pc.policyHash, session: sesCl,
      entries: [intrare(cl.privateKey, '0'.repeat(64), 0, { v: 2, agentId: idCl, policyHash: pc.policyHash, session: sesCl, at: t0, action: unealta, decision: { allowed: true, reason: 'tool allowed' }, provenance: null })] };
    return { t0, policy, ledger: base,
      approvalsEmpty: cu({ action: unealta, decision: { allowed: true, reason: 'tool allowed' }, provenance: null, approvals: [] }),
      falseDecision: cu({ action: { kind: 'payment', to: '0xbbbb', amount: '10', at: t0 }, decision: { allowed: false, reason: 'refused by the agent' }, provenance: null }),
      revocationWithout: cu({ action: { kind: 'revocation', revokedAt: t0, at: t0 }, decision: { allowed: false, reason: 'revocation' }, provenance: null }),
      classical: { ledger: clasic, policy: pc.policy } };
  },
  // the head of the audit log signed by its operator (ML-DSA-65), by a classical key that declares ml-dsa-65, and the public key of
  // another operator; the private keys exist only in this call
  auditHead: async () => {
    const cap = capAudit(jurnalAudit(), 4); const op = crypto.generateKeyPairSync('ml-dsa-65'), alt = crypto.generateKeyPairSync('ml-dsa-65'), cl = crypto.generateKeyPairSync('ed25519');
    const pem = (k) => k.export({ type: 'spki', format: 'pem' });
    const clasic = { ...cap, signature: { scheme: 'ml-dsa-65', publicKey: cl.publicKey.export({ type: 'spki', format: 'der' }).toString('base64'), signature: crypto.sign(null, Buffer.from(JSON.stringify(cap.statement), 'utf8'), cl.privateKey).toString('base64') } };
    return { signed: semneazaCap(cap, op.privateKey.export({ type: 'pkcs8', format: 'pem' })), signerPem: pem(op.publicKey), otherSignerPem: pem(alt.publicKey), classical: clasic };
  },
  // three trust chains of ONE agent (its ML-DSA-65 key exists only in this call), without model attestation and runtime record:
  // an action the policy allows; the same action under a policy that does not list the tool (the ledger records the refusal);
  // an output dated a long time before its ledger entry
  aiTrust: async () => {
    const t1 = Math.floor(Date.now() / 1000) - 3600, iso = (t) => new Date(t * 1000).toISOString(); const identity = newAgentIdentity();
    const lant = (tools, outAt) => { const { policy, policyHash } = definePolicy({ agentId: identity.agentId, tools }); const ledger = openLedger({ identity, policy, policyHash, now: () => t1 });
      const proofOfAi = buildProofOfAi({ model: { name: 'example-model', version: '1.0' }, prompt: 'summarise document X', input: 'document X', output: 'a summary of document X', tools: ['model:example-model'], agentId: identity.agentId, requester: 'tester', createdAt: iso(outAt) });
      ledger.record({ kind: 'tool', tool: 'model:example-model', args: { promptHash: proofOfAi.statement.promptHash } }, { provenance: proofOfAi, at: t1 });
      return lantAI({ ledger: ledger.export(), policy: { policy, policyHash }, proofOfAi, createdAt: iso(t1) }); };
    return { allowed: lant(['model:example-model'], t1), refused: lant(['model:another-model'], t1), lateEntry: lant(['model:example-model'], t1 - 7200) };
  },
  // presentations of ONE credential (issuer, holder, a phone, a session key, a stranger and an impostor issuer: six hybrid key pairs
  // that exist only in this call), made by the identity producers (issueCredential, createStatusList, delegate, revokeDelegation,
  // present) at a fixed time, with the verifier's audience, nonce and clock; and the forged siblings that only a key holder can make:
  // a statement changed and signed again by the issuer, the holder or a delegate, with the published formulas (the purpose-separated
  // hybrid signature over the canonical statement; the sha256 of the canonical JSON as the hash)
  identity: async () => {
    const T0 = Math.floor(Date.now() / 1000) * 1000 - 3600000, zi = 86400; const at = (s) => new Date(T0 + s * 1000).toISOString(), la = (s) => new Date(T0 + s * 1000);
    const [iss, hol, phone, sess, strain, imp] = Array.from({ length: 6 }, () => ID.generateKeys());
    const AUD = 'https://verifier.example', NONCE = 'n-' + crypto.randomBytes(8).toString('hex'), LID = 'https://issuer.example/status/1', hashOf = ID.credentialHash;
    const afirmatii = { name: 'Ada Example', age_over_18: true, member_since: '2020', employer: 'Example Ltd' }, DZ = ['name', 'age_over_18', 'member_since'];
    const schimba = (c) => (c[0] === 'A' ? 'B' : 'A') + c.slice(1);
    const emite = (o = {}) => ID.issueCredential({ issuer: iss, holder: hol.public, type: 'ExampleMembership', claims: afirmatii, disclosable: DZ, validFrom: at(-zi), validUntil: at(1000 * zi), status: { list: LID, index: 42 }, decoys: 2, now: la(0), ...o });
    const { credential, disclosures } = emite();
    const cuCred = (c, dz = disclosures, o = {}) => ID.present({ credential: c, disclosures: dz, reveal: ['age_over_18', 'member_since'], presenter: hol, audience: AUD, nonce: NONCE, now: la(60), ...o });
    const resemneaza = (p, k, f) => { const q = clona(p); f(q); q.signature = ID.signText('presentation', ID.canonical(q.binding), k); return q; };
    const reemite = (c, k, f) => { const st = clona(c.statement); f(st); return { statement: st, signature: ID.signText('credential', ID.canonical(st), k) }; };
    const dzv = (nume, val, octeti = 16) => Buffer.from(JSON.stringify([crypto.randomBytes(octeti).toString('base64url'), nume, val]), 'utf8').toString('base64url');
    const direct = cuCred(credential); const cuDezvaluiri = (l) => resemneaza(direct, hol, (q) => { q.disclosures = l; q.binding.disclosuresHash = hashOf(l); });
    const lista = (o = {}) => ID.createStatusList({ issuer: iss, id: LID, validFrom: at(-3600), validUntil: at(zi), now: la(0), ...o });
    const curata = lista(); const fals = 'aere-id:' + '11'.repeat(20); const altId = 'urn:uuid:' + ['00000000', '0000', '4000', '8000', '000000000000'].join('-');   // the id of a credential that is not this one
    // the same claims from an issuer that names no status list (the impostor, and the issuer with a classical key)
    const faraStare = ID.issueCredential({ issuer: imp, holder: hol.public, type: 'ExampleMembership', claims: afirmatii, disclosable: DZ, validFrom: at(-zi), validUntil: at(1000 * zi), now: la(0) });
    const clasic = (() => { const a = crypto.generateKeyPairSync('ed25519'), b = crypto.generateKeyPairSync('ed25519'); const spki = (k) => k.publicKey.export({ type: 'spki', format: 'der' }).toString('base64');
      const pub = { alg: ID.ALG, ed25519: spki(a), mldsa65: spki(b) }; const id = 'aere-id:' + crypto.createHash('sha256').update(Buffer.from(ID.canonical(pub), 'utf8')).digest('hex').slice(0, 40);
      const st = clona(faraStare.credential.statement); st.issuer = { id, keys: pub }; const m = Buffer.from('aere-identity/v1/credential\n' + ID.canonical(st), 'utf8');
      const c = { statement: st, signature: { alg: ID.ALG, ed25519: crypto.sign(null, m, a.privateKey).toString('base64'), mldsa65: crypto.sign(null, m, b.privateKey).toString('base64') } };
      return { issuerId: id, presentation: cuCred(c, faraStare.disclosures) }; })();
    const listaNecitibila = (() => { const st = clona(curata.statement); st.encodedList = Buffer.from('not gzip', 'utf8').toString('base64url'); return { statement: st, signature: ID.signText('status-list', ID.canonical(st), iss) }; })();
    const inClar = (() => { const enc = dzv('employer', 'Another Ltd'); const c = reemite(credential, iss, (st) => { st.sd = [...st.sd, ID.digestOf(enc)].sort(); });
      return resemneaza(cuCred(c), hol, (q) => { q.disclosures = [...q.disclosures, enc]; q.binding.disclosuresHash = hashOf(q.disclosures); }); })();
    const expirat = emite({ validFrom: at(-3 * zi), validUntil: at(-zi) }), inca = emite({ validFrom: at(zi), validUntil: at(2 * zi) });
    // delegation: the holder to a phone, the phone to a session key of ten minutes
    // the scope of a link: which credential ids, which disclosable claims, which audiences (built by position: the field is named in one place)
    const scopul = (iduri, afirm, publicuri) => Object.fromEntries([['credentials', iduri], ['claims', afirm], ['audiences', publicuri]]);
    const scop = scopul([credential.statement.id], ['age_over_18', 'member_since'], [AUD]), ingust = { ...scop, claims: ['age_over_18'] };
    const d1 = ID.delegate({ from: hol, to: phone.public, scope: scop, notBefore: at(0), notAfter: at(zi), maxDepth: 1, now: la(0) });
    const d2 = ID.delegate({ from: phone, to: sess.public, scope: ingust, notBefore: at(30), notAfter: at(600), maxDepth: 0, parent: d1, now: la(30) });
    const prezD = (lant, cheie, o = {}) => ID.present({ credential, disclosures, reveal: ['age_over_18'], presenter: cheie, delegations: lant, audience: AUD, nonce: NONCE, now: la(60), ...o });
    const una = (o = {}) => ID.delegate({ from: hol, to: phone.public, scope: scop, notBefore: at(0), notAfter: at(zi), maxDepth: 0, now: la(0), ...o });
    const veriga = (k, st0, f) => { const st = clona(st0); f(st); return { statement: st, signature: ID.signText('delegation', ID.canonical(st), k) }; };
    const delegat = prezD([d1, d2], sess); const d1z = una();
    const lung = (() => { const chei = [phone, sess]; let de = hol; const l = []; for (let i = 0; i < 9; i++) { const catre = chei[i % 2]; l.push(ID.delegate({ from: de, to: catre.public, scope: scop, notBefore: at(0), notAfter: at(zi), maxDepth: 0, now: la(0) })); de = catre; } return prezD(l, de); })();
    const semnaturaVerigii = (() => { const d = clona(una()); d.signature.mldsa65 = schimba(d.signature.mldsa65); return prezD([d], phone); })();
    return { at: at(0), audience: AUD, nonce: NONCE, now: at(65), later: at(3665), muchLater: at(4000 * zi), trusted: [iss.id], strangerId: strain.id,
      lists: { clean: curata, revoked: lista({ revoked: [42] }), unreadable: listaNecitibila, short: lista({ size: 8 }), otherIssuer: ID.createStatusList({ issuer: imp, id: LID, revoked: [42], validFrom: at(-3600), validUntil: at(zi), now: la(0) }), expired: lista({ revoked: [42], validFrom: at(-2 * zi), validUntil: at(-zi) }) },
      undisclosed: disclosures.find((e) => ID.decodeDisclosure(e).name === 'name'),
      direct, delegated: delegat,
      revocations: { byHolder: ID.revokeDelegation({ by: hol, delegation: d1, at: at(10), now: la(10) }), byGiver: ID.revokeDelegation({ by: phone, delegation: d2, at: at(40), now: la(40) }),
        byStranger: ID.revokeDelegation({ by: strain, delegation: d1, at: at(10), now: la(10) }), inTheFuture: ID.revokeDelegation({ by: hol, delegation: d1, at: at(zi), now: la(10) }) },
      forged: {
        issuerImpostor: cuCred(reemite(faraStare.credential, imp, (st) => { st.issuer.id = iss.id; }), faraStare.disclosures),
        issuerClassicalKey: clasic,
        holderId: resemneaza(cuCred(reemite(credential, iss, (st) => { st.holder.id = fals; })), hol, (q) => { q.binding.presenter.id = fals; }),
        credentialSignatureMlDsa: cuCred((() => { const c = clona(credential); c.signature.mldsa65 = schimba(c.signature.mldsa65); return c; })()),
        credentialSignatureEd25519: cuCred((() => { const c = clona(credential); c.signature.ed25519 = schimba(c.signature.ed25519); return c; })()),
        claimEdited: cuCred((() => { const c = clona(credential); c.statement.claims.employer = 'Another Ltd'; return c; })()),
        expired: cuCred(expirat.credential, expirat.disclosures), notYetValid: cuCred(inca.credential, inca.disclosures),
        sdTwice: cuCred(reemite(credential, iss, (st) => { st.sd = [...st.sd, st.sd[0]].sort(); })),
        disclosureShortSalt: cuDezvaluiri([...direct.disclosures, dzv('nickname', 'x', 8)]),
        disclosureFabricated: cuDezvaluiri([...direct.disclosures, dzv('age_over_21', true)]),
        disclosureTwice: cuDezvaluiri([direct.disclosures[0], direct.disclosures[0], direct.disclosures[1]]),
        disclosureOverPlain: inClar,
        claimName: cuCred(reemite(credential, iss, (st) => { st.claims['bad name'] = 'x'; })),
        otherCredential: resemneaza(direct, hol, (q) => { q.binding.credentialHash = hashOf(emite().credential); }),
        stranger: cuCred(credential, disclosures, { presenter: strain }),
        createdAt: resemneaza(direct, hol, (q) => { q.binding.createdAt = 'yesterday'; }),
        chainUnsigned: resemneaza(delegat, sess, (q) => { q.binding.delegations = []; }),
        chainNine: lung,
        linkForm: prezD([veriga(hol, d1z.statement, (st) => { st.kind = 'aere-delegation-v0'; })], phone),
        linkIds: resemneaza(prezD([veriga(hol, d1z.statement, (st) => { st.to.id = fals; })], phone), phone, (q) => { q.binding.presenter.id = fals; }),
        linkFromStranger: prezD([ID.delegate({ from: strain, to: phone.public, scope: scop, notBefore: at(0), notAfter: at(zi), now: la(0) })], phone),
        linkNoParent: prezD([d1, ID.delegate({ from: phone, to: sess.public, scope: ingust, notBefore: at(30), notAfter: at(600), maxDepth: 0, now: la(30) })], sess),
        linkSignature: semnaturaVerigii,
        linkScopeUnknownField: prezD([veriga(hol, d1z.statement, (st) => { st.scope.extra = ['x']; })], phone),
        linkScopeUnsorted: prezD([veriga(hol, d1z.statement, (st) => { st.scope.claims = ['member_since', 'age_over_18']; })], phone),
        linkExpired: prezD([una({ notBefore: at(-7200), notAfter: at(-3600) })], phone),
        linkDepthZero: prezD([d1z, veriga(phone, d2.statement, (st) => { st.parent = ID.delegationHash(d1z); })], sess),
        linkDepthNegative: prezD([d1z, veriga(phone, d2.statement, (st) => { st.parent = ID.delegationHash(d1z); st.maxDepth = -1; })], sess),
        linkWidens: prezD([d1, veriga(phone, d2.statement, (st) => { st.scope.claims = '*'; })], sess),
        linkOtherCredential: prezD([una({ scope: scopul([altId], scop.claims, scop.audiences) })], phone),
        linkOtherClaims: prezD([una({ scope: ingust })], phone, { reveal: ['age_over_18', 'name'] }),
        linkOtherAudience: prezD([una({ scope: { ...scop, audiences: ['https://other.example'] } })], phone) } };
  },
  // a device (roadmap 31): one manufacturer, two owners, a second identity the first owner sells to, a stranger, another manufacturer,
  // a device key and a clone's key (six hybrid key pairs and two ML-DSA-65 keys that exist only in this call), every link made by the
  // producers of the device module at a fixed time; and the forged siblings only a key holder can make, signed again with the
  // published formulas (signLink, signAttestation)
  device: async () => {
    const T0 = Math.floor(Date.now() / 1000) * 1000 - 3600000, zi = 86400; const at = (s) => new Date(T0 + s * 1000).toISOString(), la = (s) => new Date(T0 + s * 1000);
    const [mfr, op, buyer, strain, imp, second] = Array.from({ length: 6 }, () => ID.generateKeys()); const dev = DV.generateDeviceKey(), clone = DV.generateDeviceKey();
    const AUD = 'https://gateway.example', NONCE = 'n-' + crypto.randomBytes(8).toString('hex'), LID = 'https://manufacturer.example/status/1', MODEL = 'AX-200';
    // the firmware image and its Proof of Software attestation are the fixtures of the device module (the attestation was written by the Proof of Software tool)
    const IMG1 = Buffer.from('conformance firmware 1.0.0', 'utf8'), IMG2 = fs.readFileSync(fileURLToPath(new URL('../device-identity/fixturi/firmware-2.0.0.bin', import.meta.url))), POS = citeste(new URL('../device-identity/fixturi/atestare-firmware.json', import.meta.url));
    const face = (o = {}) => DV.manufacture({ manufacturer: mfr, deviceKey: dev.publicKey, model: MODEL, serial: 'SN-0001', validFrom: at(-30 * zi), validUntil: at(3650 * zi), status: { list: LID, index: 7 }, now: la(-30 * zi), ...o });
    const cred = face(); const lista = (o = {}) => ID.createStatusList({ issuer: mfr, id: LID, validFrom: at(-3600), validUntil: at(zi), now: la(-3600), ...o });
    const rel = (o = {}) => DV.releaseFirmware({ signer: mfr, model: MODEL, version: '2.0.0', sequence: 2, image: IMG2, now: la(-5 * zi), ...o });
    const fw2 = rel(), fw1 = rel({ version: '1.0.0', sequence: 1, image: IMG1, now: la(-20 * zi) });
    const pol = (o = {}) => DV.firmwarePolicy({ manufacturer: mfr, model: MODEL, minSequence: 1, validFrom: at(-3600), validUntil: at(zi), now: la(-3600), ...o });
    const t1 = DV.transferOwnership({ from: mfr, to: op.public, manufacture: cred, now: la(-10 * zi) }), t2 = DV.transferOwnership({ from: op, to: buyer.public, manufacture: cred, transfers: [t1], now: la(-2 * zi) });
    const cap0 = DV.ownershipHead(cred), cap1 = DV.ownershipHead(cred, [t1]);
    const aut = (owner, cap, o = {}) => DV.authorize({ owner, deviceId: dev.deviceId, ownership: cap, actions: ['door.unlock', 'telemetry.publish'], notBefore: at(-zi), notAfter: at(zi), now: la(-zi), ...o });
    // a status record: the manufacturer signs as the manufacturer of the credential (no ownership head), anybody else under the head given
    const stare = (by, state, seq, cap, o = {}) => DV.statusRecord({ by, state, seq, validUntil: at(zi), now: la(-600), ...(by === mfr ? { manufacture: cred } : { deviceId: dev.deviceId, ownership: cap }), ...o });
    const atest = (o = {}) => DV.attest({ device: dev, nonce: NONCE, audience: AUD, firmware: fw2, ownership: cap1, action: 'telemetry.publish', now: la(60), ...o });
    const A1 = aut(op, cap1), X1 = atest(); const plic = DV.proofOfDevice(X1, buildProof);
    const reSemn = (scop, link, k, f) => { const st = clona(link.statement); f(st); return { statement: st, signature: DV.signLink(scop, st, k) }; };
    const reCred = (c, k, f) => { const st = clona(c.statement); f(st); return { statement: st, signature: ID.signText('credential', ID.canonical(st), k) }; };
    const reAtest = (x, f) => { const st = clona(x.statement); f(st); return { statement: st, signature: DV.signAttestation(st, dev) }; };
    const fals = 'aere-id:' + '11'.repeat(20);
    // sold on: the first owner transfers the device to a second identity (a buyer, or another key of its own: the chain cannot tell)
    const tx = DV.transferOwnership({ from: op, to: second.public, manufacture: cred, transfers: [t1], now: la(-300) }), capx = DV.ownershipHead(cred, [t1, tx]);
    // sold, and bought back: the first owner owns the device again, under a third head
    const t3 = DV.transferOwnership({ from: buyer, to: op.public, manufacture: cred, transfers: [t1, t2], now: la(-zi) }), cap3 = DV.ownershipHead(cred, [t1, t2, t3]);
    const credAlt = face({ deviceKey: clone.publicKey, serial: 'SN-0002', status: { list: LID, index: 8 } });   // ANOTHER device of the same manufacturer
    const clasic = (() => { const ed = crypto.generateKeyPairSync('ed25519'); const spki = ed.publicKey.export({ type: 'spki', format: 'der' }).toString('base64'); const id = 'aere-device:' + crypto.createHash('sha256').update(Buffer.from(spki, 'base64')).digest('hex').slice(0, 40);
      const st = clona(X1.statement); st.key = spki; st.deviceId = id;
      return { credential: reCred(cred, mfr, (s) => { s.claims.deviceKey = spki; s.claims.deviceId = id; }), attestation: { statement: st, signature: { alg: 'ml-dsa-65', value: crypto.sign(null, Buffer.from('aere-device/v1/attestation\n' + ID.canonical(st), 'utf8'), ed.privateKey).toString('base64') } } }; })();
    const lung = (() => { const l = []; let de = mfr; const chei = [op, buyer]; for (let i = 0; i < 65; i++) { const catre = chei[i % 2]; l.push(DV.transferOwnership({ from: de, to: catre.public, manufacture: cred, transfers: l, now: la(-10 * zi + i) })); de = catre; } return l; })();
    // ---- (2026-10-06, after a second adversarial review) one input for each condition that had none: the order of a list, an ending
    // 30 s past, a form the producers refuse to write (signed by hand with the published formulas), a device id written otherwise
    const r2 = (() => {
      const LID2 = 'https://manufacturer.example/status/2';
      const rehash = (o) => { o.statementHash = sha256(Buffer.from(JSON.stringify(o.statement), 'utf8')); return o; };
      const notPoS = (() => { const a = clona(POS); a.statement.kind = 'aere-proof-of-something-else'; return rehash(a); })();
      const idMare = 'aere-device:' + dev.deviceId.slice('aere-device:'.length).toUpperCase();
      // the same device key certified by ANOTHER manufacturer, which then says the device is retired
      const credImp = DV.manufacture({ manufacturer: imp, deviceKey: dev.publicKey, model: MODEL, serial: 'SN-0001', validFrom: at(-zi), validUntil: at(3650 * zi), now: la(-zi) });
      return {
        trustedBoth: [mfr.id, imp.id],
        records: { suspendedFive: stare(op, 'suspended', 5, cap1), activeThree: stare(op, 'active', 3, cap1), activeFive: stare(op, 'active', 5, cap1), activeSix: stare(op, 'active', 6, cap1),
          activeNumberNotWhole: reSemn('status', stare(op, 'active', 1, cap1), op, (s) => { s.seq = 1.5; }), suspendedNumberAsText: reSemn('status', stare(op, 'suspended', 7, cap1), op, (s) => { s.seq = '7'; }),
          activeExpired30s: stare(op, 'active', 1, cap1, { now: la(-3600), validUntil: at(35) }),
          activeValidityWithOffset: reSemn('status', stare(op, 'active', 1, cap1), op, (s) => { s.validUntil = s.validUntil.slice(0, -1) + '+03:00'; }),
          retiredByManufacturerUpperCaseId: reSemn('status', stare(mfr, 'retired', 1, null), mfr, (s) => { s.deviceId = idMare; }),
          activeUpperCaseId: reSemn('status', stare(op, 'active', 1, cap1), op, (s) => { s.deviceId = idMare; }),
          retiredByOwnerIdWithSpace: reSemn('status', stare(op, 'retired', 3, cap1), op, (s) => { s.deviceId = dev.deviceId + ' '; }),
          retiredByOtherManufacturer: DV.statusRecord({ by: imp, manufacture: credImp, state: 'retired', seq: 1, validUntil: at(zi), now: la(-600) }) },
        lists: { otherId: ID.createStatusList({ issuer: mfr, id: LID2, validFrom: at(-3600), validUntil: at(zi), now: la(-3600) }),
          otherIdRevoked: ID.createStatusList({ issuer: mfr, id: LID2, revoked: [7], validFrom: at(-3600), validUntil: at(zi), now: la(-3600) }), expired30s: lista({ validFrom: at(-3 * zi), validUntil: at(35), now: la(-3 * zi) }) },
        policies: { floorNegative: reSemn('firmware-policy', pol(), mfr, (s) => { s.minSequence = -1; }), expired30s: pol({ validFrom: at(-7200), validUntil: at(35), now: la(-7200) }) },
        manufactureExpired30s: face({ validUntil: at(35) }), manufactureBeginsInTolerance: face({ validFrom: at(95) }),
        manufactureSelectiveDisclosure: reCred(cred, mfr, (s) => { s.sd = ['x']; }),
        firmwareNamesNotProofOfSoftware: reSemn('firmware', rel(), mfr, (s) => { s.softwareAttestationHash = notPoS.statementHash; }), notProofOfSoftware: notPoS,
        authorizationEndWithoutZone: reSemn('authorization', A1, op, (s) => { s.notAfter = s.notAfter.slice(0, -1); }),
        attestationOld330s: atest({ now: la(-265) }), attestationOld300s: atest({ now: la(-235) }),
        envelopeStatementOtherKind: (() => { const e = clona(plic); e.statement.kind = 'aere-proof-of-something-else'; return rehash(e); })(),
        chainOf64: lung.slice(0, 64) };
    })();
    return { r2, at: at(0), now: at(65), later: at(3665), audience: AUD, nonce: NONCE, trusted: [mfr.id], strangerId: strain.id,
      manufacture: cred, firmware: fw2, firmwareWithSoftware: rel({ softwareAttestation: POS }), software: POS, transfers: [t1, t2], authorization: A1, attestation: X1, envelope: plic,
      reading: { statementHash: plic.statementHash, at: Math.floor((T0 + 100000) / 1000), chainId: 28001 }, readingEarlier: Math.floor((T0 - 600000) / 1000),
      lists: { clean: lista(), revoked: lista({ revoked: [7] }), unreadable: (() => { const st = clona(lista().statement); st.encodedList = Buffer.from('not gzip', 'utf8').toString('base64url'); return { statement: st, signature: ID.signText('status-list', ID.canonical(st), mfr) }; })(),
        // a list with the same id signed by ANOTHER manufacturer (it recalls the device), and the manufacturer's own list, expired
        byAnotherManufacturer: ID.createStatusList({ issuer: imp, id: LID, revoked: [7], validFrom: at(-3600), validUntil: at(zi), now: la(-3600) }), expired: lista({ validFrom: at(-3 * zi), validUntil: at(-zi), now: la(-3 * zi) }),
        // the manufacturer's list, recalling the device, with a validity that is not a time (signed by hand)
        validityNotATime: (() => { const st = clona(lista({ revoked: [7] }).statement); st.validUntil = 'next year'; return { statement: st, signature: ID.signText('status-list', ID.canonical(st), mfr) }; })() },
      policies: { current: pol(), floorThree: pol({ minSequence: 3 }), retracts: pol({ retracted: [fw2.statement.digest] }),
        // a policy of the manufacturer for ANOTHER model; one that expired; and one signed by hand whose retracted entry is the 64 hex digits of this release without 0x (the producer refuses to write it)
        otherModel: pol({ model: 'BX-1', minSequence: 0 }), expired: pol({ validFrom: at(-7200), validUntil: at(-10), now: la(-7200) }),
        retractedNotADigest: reSemn('firmware-policy', pol(), mfr, (s) => { s.retracted = [fw2.statement.digest.slice(2)]; }),
        // one not in force yet; two more that cannot be read (signed by hand); and one whose tooling wrote the retracted digest in upper case
        notYet: pol({ validFrom: at(zi), validUntil: at(2 * zi) }), floorNotANumber: reSemn('firmware-policy', pol(), mfr, (s) => { s.minSequence = '1'; }), validityNotATime: reSemn('firmware-policy', pol(), mfr, (s) => { s.validUntil = 'next week'; }),
        retractsUpperCase: reSemn('firmware-policy', pol(), mfr, (s) => { s.retracted = ['0x' + fw2.statement.digest.slice(2).toUpperCase()]; }),
        // a policy of a version this verifier does not read (it retracts the release), signed by hand
        otherVersion: reSemn('firmware-policy', pol({ retracted: [fw2.statement.digest] }), mfr, (s) => { s.v = 2; }) },
      records: { active: stare(op, 'active', 1, cap1), retiredByManufacturer: stare(mfr, 'retired', 1, null), suspendedByOwner: stare(op, 'suspended', 2, cap1), retiredByStranger: stare(strain, 'retired', 9, cap1), activeLaterByOwner: stare(op, 'active', 9, cap1),
        retiredByOwner: stare(op, 'retired', 3, cap1),
        // the owner's retirement in a record that names NO ownership head: signed by hand with the published formula (the producer refuses to write one)
        retiredByOwnerNoHead: reSemn('status', stare(op, 'retired', 3, cap1), op, (s) => { s.ownership = null; }),
        // the owner's keys under an id they do not derive; the manufacturer's retirement of ANOTHER device; a retirement the manufacturer dated 120 s after the verifier's clock
        retiredOwnerKeysOtherId: reSemn('status', stare(op, 'retired', 9, cap1), op, (s) => { s.by.id = fals; }),
        retiredOtherDevice: DV.statusRecord({ by: mfr, manufacture: credAlt, state: 'retired', seq: 1, validUntil: at(zi), now: la(-600) }),
        retiredByManufacturerAhead: stare(mfr, 'retired', 1, null, { now: la(185) }),
        // after the sale to the second identity: its own "active"; and what the FIRST owner signed (before the sale, under its own head; and under the new head)
        activeBySecond: stare(second, 'active', 1, capx, { now: la(-100) }), retiredByFirstOwner: stare(op, 'retired', 1, cap1, { now: la(-900) }), suspendedByFirstOwner: stare(op, 'suspended', 1, cap1, { now: la(-900) }),
        retiredByFirstOwnerUnderNewHead: stare(op, 'retired', 2, capx, { now: la(-50) }),
        // bought back: the owner's "active" under its third head
        activeUnderThirdHead: stare(op, 'active', 1, cap3),
        // suspension and time: a suspension by the manufacturer; one of the owner whose record has expired; an "active" that has expired; a
        // second record of the owner with the number of its "active" that says suspended; a retirement whose date is not a time (signed by
        // hand); a retirement the manufacturer dated 30 s after the verifier's clock (inside the tolerance)
        suspendedByManufacturer: stare(mfr, 'suspended', 1, null), suspendedByOwnerExpired: stare(op, 'suspended', 2, cap1, { now: la(-3 * zi), validUntil: at(-zi) }), activeExpired: stare(op, 'active', 1, cap1, { now: la(-3 * zi), validUntil: at(-zi) }),
        suspendedSameNumber: stare(op, 'suspended', 1, cap1), retiredByManufacturerNoDate: reSemn('status', stare(mfr, 'retired', 1, null), mfr, (s) => { s.at = 'yesterday'; }), retiredByManufacturerJustAhead: stare(mfr, 'retired', 1, null, { now: la(95) }),
        // a record of the manufacturer in a version this verifier does not read (it says retired), signed by hand
        retiredByManufacturerOtherVersion: reSemn('status', stare(mfr, 'retired', 1, null), mfr, (s) => { s.v = 2; }) },
      resold: { transfers: [t1, tx], authorization: aut(second, capx, { now: la(-200), notBefore: at(-200) }), attestation: atest({ ownership: capx }) },
      boughtBack: { transfers: [t1, t2, t3], authorization: aut(op, cap3, { now: la(-3600), notBefore: at(-3600) }), attestation: atest({ ownership: cap3 }) },
      attestationJustAhead: atest({ now: la(95) }),
      forged: {
        manufactureNotYet: face({ validFrom: at(zi) }),
        manufactureHolderOtherId: reCred(cred, mfr, (s) => { s.holder = { id: fals, keys: mfr.public }; }), manufactureHolderOtherKeys: reCred(cred, mfr, (s) => { s.holder = { id: mfr.id, keys: op.public }; }),
        deviceKeyNotCanonical: reCred(cred, mfr, (s) => { s.claims.deviceKey = dev.publicKey + '='; }), attestationKeyNotCanonical: reAtest(X1, (s) => { s.key = dev.publicKey + '='; }),
        transferGiverId: reSemn('transfer', t1, mfr, (s) => { s.from.id = fals; }), transferPosition: reSemn('transfer', t2, op, (s) => { s.seq = 7; }),
        authorizationNotYet: aut(op, cap1, { notBefore: at(3600) }), authorizationAfterAttestation: aut(op, cap1, { notBefore: at(123) }), authorizationEndedBetween: aut(op, cap1, { notAfter: at(62) }),
        attestationOtherSequence: atest({ firmware: { digest: fw2.statement.digest, sequence: 9 } }), attestationOtherDigest: atest({ firmware: { digest: fw1.statement.digest, sequence: 2 } }),
        attestationAhead: atest({ now: la(185) }),
        // an attestation dated 35 s ahead (inside the tolerance), for the two conditions of the authorization window that need one
        attestationAheadInTolerance: atest({ now: la(100) }), authorizationBeginsAfterTolerance: aut(op, cap1, { notBefore: at(135) }), authorizationEndsBeforeAttestation: aut(op, cap1, { notAfter: at(66) }),
        transferFuture: reSemn('transfer', t2, op, (s) => { s.at = at(30 * zi); }),
        manufactureHardwareRoot: reCred(cred, mfr, (s) => { s.claims.hardwareRoot = { type: 'ek-certificate', evidence: 'AAAA' }; }),
        firmwareSignerId: reSemn('firmware', fw2, mfr, (s) => { s.signer.id = fals; }), authorizationOwnerId: reSemn('authorization', A1, op, (s) => { s.owner.id = fals; }),
        manufacturerImpostor: reCred(DV.manufacture({ manufacturer: imp, deviceKey: dev.publicKey, model: MODEL, serial: 'SN-0001', validFrom: at(-30 * zi), validUntil: at(3650 * zi), status: { list: LID, index: 7 }, now: la(-30 * zi) }), imp, (s) => { s.issuer.id = mfr.id; s.holder.id = mfr.id; }),
        manufactureHolder: reCred(cred, mfr, (s) => { s.holder = { id: op.id, keys: op.public }; }),
        manufactureExpired: face({ validFrom: at(-30 * zi), validUntil: at(-zi) }),
        deviceKeyClassical: clasic.credential, attestationClassical: clasic.attestation,
        deviceId: reCred(cred, mfr, (s) => { s.claims.deviceId = clone.deviceId; }),
        manufactureTime: reCred(cred, mfr, (s) => { s.validUntil = 'next year'; }),
        firmwareByStranger: DV.releaseFirmware({ signer: strain, model: MODEL, version: '2.0.0', sequence: 2, image: IMG2, now: la(-5 * zi) }),
        firmwareOtherModel: rel({ model: 'BX-1' }),
        firmwareOld: fw1, attestationOfOld: atest({ firmware: fw1 }),
        transferFromFormerOwner: reSemn('transfer', t2, mfr, (s) => { s.from = { id: mfr.id, keys: mfr.public }; }),
        transferPrev: reSemn('transfer', t2, op, (s) => { s.prev = cap0; }),
        transferBackdated: reSemn('transfer', t2, op, (s) => { s.at = at(-20 * zi); }),
        transferOtherDevice: reSemn('transfer', t2, op, (s) => { s.deviceId = clone.deviceId; }),
        transferIds: reSemn('transfer', t2, op, (s) => { s.to.id = fals; }),
        transferByStranger: { statement: t2.statement, signature: DV.signLink('transfer', t2.statement, strain) },
        chainLong: lung,
        authorizationByFormerOwner: aut(mfr, cap1), authorizationOldHead: aut(op, cap0), authorizationExpired: aut(op, cap1, { notBefore: at(-2 * zi), notAfter: at(-3600) }),
        authorizationOtherAction: aut(op, cap1, { actions: ['door.unlock'] }), authorizationOtherDevice: DV.authorize({ owner: op, deviceId: clone.deviceId, ownership: cap1, actions: ['door.unlock', 'telemetry.publish'], notBefore: at(-zi), notAfter: at(zi), now: la(-zi) }),
        authorizationPurpose: { statement: A1.statement, signature: DV.signLink('status', A1.statement, op) },
        cloneOwnId: DV.attest({ device: clone, nonce: NONCE, audience: AUD, firmware: fw2, ownership: cap1, action: 'telemetry.publish', now: la(60) }),
        cloneClaimsId: (() => { const st = clona(X1.statement); st.key = clone.publicKey; return { statement: st, signature: DV.signAttestation(st, clone) }; })(),
        cloneSigns: { statement: X1.statement, signature: DV.signAttestation(X1.statement, clone) },
        attestationOldHead: atest({ ownership: cap0 }),
        hardwareRoot: (() => { const st = clona(X1.statement); st.hardwareRoot = { type: 'tpm2-quote', evidence: 'AAAA' }; return { statement: st, signature: DV.signAttestation(st, dev) }; })(),
        envelopeOfAnother: DV.proofOfDevice(atest({ now: la(61) }), buildProof) } };
  },
};

// ---------- fixed inputs of the AIP-23 kinds (the inputs of the published AIP-23 kind vectors) ----------
function intrariKinds() {
  const AT = '2026-09-26T00:00:00Z'; const H = (s) => sha256(Buffer.from(s, 'utf8'));
  return { data: { name: 'report.csv', content: 'a,b,c', createdAt: AT }, execution: { program: 'aere-node', input: 'in', output: 'out', exitCode: 0, createdAt: AT },
    identity: { subjectId: 'agent-1', publicKey: 'PK', method: 'ml-dsa-65', createdAt: AT }, compliance: { subject: 'org-x', policy: 'pq-ready', result: 'pass', evidence: 'EV', createdAt: AT },
    runtime: { host: 'h1', artifactContent: 'BIN', attested: H('BIN'), matches: true, createdAt: AT }, location: { subject: 'srv-eu', region: 'eu-central', evidence: 'EV', createdAt: AT },
    device: { deviceId: 'dev-9', attestation: 'ATT', publicKey: 'PK', posture: 'secure-boot', createdAt: AT }, payment: { from: '0xa', to: '0xb', amount: '100', asset: 'AERE', tx: 'TX', createdAt: AT },
    ownership: { owner: '0xowner', assetId: 'nft-7', asset: 'ASSET', createdAt: AT }, time: { subject: 'SUBJ', source: 'aere-anchor', at: AT, createdAt: AT },
    block: { blockHash: '0x' + 'ab'.repeat(32), stateRoot: '0x' + 'cd'.repeat(32), anchorHeight: 20255488, certificateDigest: '0x' + 'ef'.repeat(32), createdAt: AT },
    authorization: { grantor: 'org-x', grantee: 'agent-7', scope: 'payments:send<=100', policy: 'POLICY', expiresAt: '2026-12-31T00:00:00Z', createdAt: AT },
    settlement: { chainId: 2800, txHash: '0x' + '12'.repeat(32), blockHash: '0x' + '34'.repeat(32), from: '0xa', to: '0xb', amount: '100', asset: 'AERE', instruction: 'INSTR', createdAt: AT },
    provenance: { subject: 'ARTIFACT', parents: ['SRC-1', 'SRC-2'], process: 'BUILD', actor: 'build-bot', createdAt: AT } };
}
/** Every AIP-23 kind, from its producer, on the fixed inputs. */
export function plicuriKinds() {
  const AT = '2026-09-26T00:00:00Z'; const INT = intrariKinds(); const out = [];
  for (const k of KINDS) { if (!INT[k]) throw new Error('proof kind ' + k + ' has no fixed input here: a new kind needs its vectors'); out.push([k, buildProof(k, INT[k])]); }
  out.push(['ai', buildProofOfAi({ model: { name: 'example-model', version: '1.0' }, prompt: 'summarize', output: 'summary', tools: ['search'], agentId: 'agent-7', createdAt: AT })]);
  const { policy, policyHash } = definePolicy({ agentId: 'agent-7', spend: { amount: '100', windowSeconds: 3600, asset: 'AERE' }, tools: ['search'], recipients: null });
  const action = { kind: 'payment', to: '0xb', amount: '50', at: 1 };
  out.push(['agent-decision', decisionEnvelope({ policyHash, action, decision: checkAction(policy, action, []), createdAt: AT })]);
  return out;
}

// ---------- the vectors ----------
function construieste() {
  if (!fs.existsSync(PROASPETE)) throw new Error('surse-proaspete.json is missing: run with --proaspat once (it reads testnet 28001)');
  const P = JSON.parse(fs.readFileSync(PROASPETE, 'utf8'));
  const E = ['envelope.form', 'envelope.integrity'];

  // (A) AIP-23 envelopes: every kind VALID; its statementHash cut short (form); one statement field changed (integrity)
  for (const [k, env] of plicuriKinds()) {
    valid(`envelope/${k}.valid`, 'envelope', `the ${k} envelope from its producer`, 'producer on fixed inputs', { envelope: env }, { exercises: E });
    invalid(`envelope/${k}.form`, `${k}: the statementHash is 63 hex digits`, `envelope/${k}.valid`, { op: 'set', path: ['envelope', 'statementHash'], value: env.statementHash.slice(0, -1) }, ['envelope.form']);
    const camp = Object.keys(env.statement).find((c) => c !== 'kind' && typeof env.statement[c] === 'string'); if (!camp) throw new Error('kind ' + k + ' has no string field to change');
    invalid(`envelope/${k}.integrity`, `${k}: statement.${camp} changed after hashing`, `envelope/${k}.valid`, { op: 'set', path: ['envelope', 'statement', camp], value: env.statement[camp] + '0' }, ['envelope.integrity']);
  }
  // files that are not envelopes at all: one base (the data envelope), the whole file replaced
  { const b = 'envelope/data.valid'; const env = V.find((x) => x.id === b).input.envelope;
    const nuPlic = (nume, titlu, v) => invalid('envelope/data.' + nume, titlu, b, { op: 'set', path: ['envelope'], value: v }, ['envelope.form']);
    nuPlic('form-null', 'the file holds the JSON value null', null); nuPlic('form-number', 'the file holds a number', 7); nuPlic('form-string', 'the file holds a string', 'x');
    nuPlic('form-true', 'the file holds true', true); nuPlic('form-list', 'the file holds a list with the envelope inside', [env]);
    const lista = '[]';
    invalid('envelope/data.form-statement-list', 'the statement is a list, with the hash of that list', b, null, ['envelope.form'], { producer: { note: 'a producer that made the statement a list and hashed it', input: { envelope: { ...clona(env), statement: [], statementHash: sha256(Buffer.from(lista, 'utf8')) } }, changed: [['envelope', 'statement'], ['envelope', 'statementHash']] } });
    invalid('envelope/data.form-not-json', 'the file is not JSON (the envelope cut short)', b, null, ['envelope.form'], { producer: { note: 'the file holds text that is not JSON: the input carries it as `raw`, the text of the file, in place of `envelope`', input: { raw: JSON.stringify(env).slice(0, 60) }, changed: [['envelope'], ['raw']] } }); }
  // a signed envelope: the tree head of an audit log, ML-DSA-65
  const b64 = P.signedHead.signature.signature;
  valid('envelope/signed-head.valid', 'envelope', 'a tree head signed with ML-DSA-65', 'producer (verify-layer tree head), key made and discarded at generation', { envelope: P.signedHead }, { exercises: [...E, 'envelope.signature'], levels: { authenticity: 'PASSED' } });
  invalid('envelope/signed-head.signature', 'the signature has one character changed', 'envelope/signed-head.valid', { op: 'set', path: ['envelope', 'signature', 'signature'], value: (b64[0] === 'A' ? 'B' : 'A') + b64.slice(1) }, ['envelope.signature']);
  invalid('envelope/signed-head.signature-classical-key', 'the signature declares ml-dsa-65 and was made with an Ed25519 key: a classical signature is not a post-quantum one because it says so', 'envelope/signed-head.valid', null, ['envelope.signature'],
    { producer: { note: 'the signer used a classical key (Ed25519, made and discarded at generation) and declared the scheme ml-dsa-65', input: { envelope: P.classicalHead }, changed: [['envelope', 'signature', 'publicKey'], ['envelope', 'signature', 'signature']] } });
  invalid('envelope/signed-head.signature-not-object', 'the signature field is a string', 'envelope/signed-head.valid', { op: 'set', path: ['envelope', 'signature'], value: 'signed' }, ['envelope.signature']);
  invalid('envelope/signed-head.signature-no-key', 'the signature carries no public key', 'envelope/signed-head.valid', { op: 'remove', path: ['envelope', 'signature', 'publicKey'] }, ['envelope.signature']);
  // notarization: a recorded envelope on 28001 (online), the same judged offline (the claim is not checked), a fresh one with a false claim
  const D = citeste(DOV.date); const F = [...E, 'envelope.finality']; const R = ['rpc-28001'];
  valid('envelope/notarized-28001.valid', 'envelope', 'a dataset commitment notarized on testnet 28001, read back under a verified post-quantum anchor', 'recorded (verifiable-data, 2026-10-02)', { envelope: D.envelope, chain: 28001 }, { exercises: F, requires: R, levels: { anchoring: 'PASSED', finality: 'PASSED' } });
  valid('envelope/notarized-claim.partial', 'envelope', 'the same envelope judged offline: the notarization it claims is not checked, so it is not VALID', 'recorded (verifiable-data, 2026-10-02)', { envelope: D.envelope, chain: 28001 }, { exercises: E, verdict: 'PARTIAL' });
  valid('envelope/fresh-28001.valid', 'envelope', 'an envelope nobody notarized, claiming nothing', 'producer, random content', { envelope: P.fresh, chain: 28001 }, { exercises: F, requires: R });
  invalid('envelope/fresh-28001.finality', 'the same envelope claims a notarization the chain does not hold', 'envelope/fresh-28001.valid', { op: 'add', path: ['envelope', 'notarization'], value: { chainId: 28001 } }, ['envelope.finality']);

  // (B) a payment under a declared policy: the recorded payment P1, then one input changed per rule
  const C = citeste(DOV.chitanta); const RK = Object.keys(HARTA).filter((r) => r.startsWith('risk.'));
  valid('payment-risk/company-p1.valid', 'payment-risk', 'the recorded payment to a company, allowed by its policy', 'recorded (payments, 2026-10-02)', { policy: C.policy, inputs: C.inputs }, { exercises: RK });
  const ref = C.policy.refusedCounterparties[0].address; const acum = C.inputs.now;
  const risc = (nume, titlu, op, r) => invalid('payment-risk/company-p1.' + nume, titlu, 'payment-risk/company-p1.valid', op, [r]);
  risc('form', 'the payer is not an address', { op: 'set', path: ['inputs', 'payer'], value: '0x1234' }, 'risk.form');
  risc('form-amount', 'the amount is zero', { op: 'set', path: ['inputs', 'amount'], value: '0' }, 'risk.form');
  risc('form-time', 'no time given', { op: 'remove', path: ['inputs', 'now'] }, 'risk.form');
  risc('form-history', 'a history entry the engine cannot count (it is refused, not left out of the window)', { op: 'set', path: ['inputs', 'history'], value: [{ at: 'yesterday', amountUsd: '0.100000' }] }, 'risk.form');
  risc('asset', 'an asset the policy does not allow', { op: 'set', path: ['inputs', 'asset'], value: 'other-token' }, 'risk.asset');
  risc('counterparty', 'the payee is a refused counterparty of the policy', { op: 'set', path: ['inputs', 'payee'], value: ref }, 'risk.counterparty');
  risc('rate', 'no USD rate declared, and the policy requires one', { op: 'remove', path: ['inputs', 'rate'] }, 'risk.rate');
  risc('rate-number', 'the USD rate given as a JSON number instead of a decimal string (refused, not rounded)', { op: 'set', path: ['inputs', 'rate', 'usdPerUnit'], value: 0.5 }, 'risk.rate');
  risc('limit', 'an amount above the per-payment limit', { op: 'set', path: ['inputs', 'amount'], value: '2400000000000000000' }, 'risk.limit');
  risc('window', 'three payments already in the window (the fourth is one too many)', { op: 'set', path: ['inputs', 'history'], value: [1, 2, 3].map((s) => ({ at: acum - 10 * s, amountUsd: '0.100000' })) }, 'risk.window');

  // (C) the receipt of that payment: as the issuer built it; with its notarization claim (offline: PARTIAL; online: VALID)
  const CK = [...Object.keys(HARTA).filter((r) => r.startsWith('receipt.')), ...E]; const claim = C.envelope.notarization; const env0 = clona(C.envelope); delete env0.notarization;
  const rb = 'payment-receipt/company-p1.valid'; const tx = P.receiptTx;
  valid(rb, 'payment-receipt', 'the recorded receipt as its issuer built it, with the policy, the inputs judged and the transaction read from the chain', 'recorded (payments, 2026-10-02); transaction read from 28001 at ' + tx.readAt, { receipt: { instruction: C.instruction, envelope: env0 }, policy: C.policy, inputs: C.inputs, tx: tx.tx, txReceipt: tx.txReceipt, chain: 28001 }, { exercises: CK });
  const chit = (nume, titlu, op, r, o) => invalid('payment-receipt/company-p1.' + nume, titlu, rb, op, r, o);
  chit('binding', 'the purpose on the instruction changed after the envelope committed to it', { op: 'set', path: ['receipt', 'instruction', 'purpose'], value: C.instruction.purpose + ' (edited)' }, ['receipt.binding']);
  chit('policy', 'a looser policy shown in place of the one under the hash (so the verdict does not reproduce either)', { op: 'set', path: ['policy', 'perPaymentMaxUsd'], value: '1000.000000' }, ['receipt.policy', 'receipt.risk']);
  chit('risk', 'other inputs shown than the ones the issuer judged', { op: 'set', path: ['inputs', 'now'], value: C.inputs.now + 1 }, ['receipt.risk']);
  chit('chain', 'the transaction on chain pays someone else', { op: 'set', path: ['tx', 'to'], value: C.policy.refusedCounterparties[0].address }, ['receipt.chain']);
  { // the amount in USD sits under the instruction hash: the issuer writes another amount and commits to it
    const r = { instruction: clona(C.instruction), envelope: clona(env0) }; r.instruction.amountUsd = '0.300000';
    r.envelope.statement.instructionHash = sha256(Buffer.from(RISC.canonical(r.instruction), 'utf8')); r.envelope.statementHash = sha256(Buffer.from(JSON.stringify(r.envelope.statement), 'utf8'));
    const b = V.find((x) => x.id === rb);
    chit('amount', 'the issuer wrote a USD amount that is not the amount at the declared rate, and committed to it', null, ['receipt.amount'], { producer: { note: 'instruction.amountUsd changed by the issuer; instructionHash and statementHash recomputed with the published formulas', input: { ...clona(b.input), receipt: r },
      changed: [['receipt', 'instruction', 'amountUsd'], ['receipt', 'envelope', 'statement', 'instructionHash'], ['receipt', 'envelope', 'statementHash']] } });
  }
  { // the risk verdict sits under the instruction hash: the issuer attaches a verdict made for ANOTHER payment and commits to it
    const b = V.find((x) => x.id === rb); const reangajeaza = (r) => { r.envelope.statement.instructionHash = sha256(Buffer.from(RISC.canonical(r.instruction), 'utf8')); r.envelope.statementHash = sha256(Buffer.from(JSON.stringify(r.envelope.statement), 'utf8')); return r; };
    const cuVerdict = (inputs) => { const v = RISC.judeca(C.policy, inputs); if (v.decision !== 'ALLOW') throw new Error('the reused verdict must be an ALLOW'); const r = { instruction: clona(C.instruction), envelope: clona(env0) };
      r.instruction.risk = { ...r.instruction.risk, policyHash: v.policyHash, inputsHash: v.inputsHash, verdictHash: v.verdictHash, decision: v.decision, unmeasured: v.unmeasured }; return { ...clona(b.input), receipt: reangajeaza(r), inputs }; };
    const H = [['receipt', 'instruction', 'risk', 'inputsHash'], ['receipt', 'instruction', 'risk', 'verdictHash'], ['receipt', 'envelope', 'statement', 'instructionHash'], ['receipt', 'envelope', 'statementHash']];
    chit('risk-other-payment', 'the issuer attached an ALLOW verdict that was made for a payment to someone else', null, ['receipt.risk'], { producer: { note: 'the risk verdict was computed for another payee; its hashes are on the instruction; instructionHash and statementHash recomputed', input: cuVerdict({ ...clona(C.inputs), payee: '0x' + '11'.repeat(20) }), changed: [['inputs', 'payee'], ...H] } });
    chit('risk-other-rate', 'the issuer attached an ALLOW verdict that was made at another USD rate than the one on the receipt', null, ['receipt.risk'], { producer: { note: 'the risk verdict was computed at another rate; its hashes are on the instruction; instructionHash and statementHash recomputed', input: cuVerdict({ ...clona(C.inputs), rate: { ...C.inputs.rate, usdPerUnit: '0.25' } }), changed: [['inputs', 'rate', 'usdPerUnit'], ...H] } }); }
  const cuClaim = { op: 'add', path: ['receipt', 'envelope', 'notarization'], value: claim };
  { const b = V.find((x) => x.id === rb); const inp = aplica(b.input, cuClaim);
    valid('payment-receipt/company-p1-claim.partial', 'payment-receipt', 'the notarized receipt judged offline: its notarization claim is not checked', 'recorded (payments, 2026-10-02)', inp, { exercises: CK, verdict: 'PARTIAL', base: rb, mutation: cuClaim });
    valid('payment-receipt/company-p1-28001.valid', 'payment-receipt', 'the notarized receipt judged with the chain: integrity, anchoring and finality in one verdict', 'recorded (payments, 2026-10-02)', inp, { exercises: [...CK, 'envelope.finality'], requires: R, levels: { anchoring: 'PASSED', finality: 'PASSED' }, base: rb, mutation: cuClaim }); }

  // (D) market timelines recorded on 28001. The public task (`spec`) stays in the input only where the replay rule is exercised:
  // each replay recomputes the task and costs seconds.
  const M = citeste(DOV.piata).scenarii; const MK = Object.keys(HARTA).filter((r) => r.startsWith('market.'));
  const tl = (s, cuSpec) => { const d = clona(M[s].date); if (!cuSpec) delete d.spec; if (d.envelope === null) delete d.envelope; return d; };
  const mv = (id, s, titlu, o = {}) => valid('market-timeline/' + id, 'market-timeline', titlu, 'recorded (market-settlement, 2026-10-02), scenario ' + s, tl(s, o.spec), { exercises: o.exercises || MK, verdict: o.verdict, requires: o.requires, levels: o.levels });
  mv('s2-slashed.valid', 'S2', 'a dispute the challenger won: the provider slashed');
  mv('s3-paid-after-dispute.valid', 'S3', 'a dispute the provider won');
  mv('s3-paid-after-dispute-replayed.valid', 'S3', 'the same timeline with the public task: the judge recomputes it and agrees with the arbiter', { spec: true });
  mv('s4-refunded-expired.valid', 'S4', 'claimed and never delivered: the escrow reclaimed after the deadline');
  mv('s5-refunded-cancelled.valid', 'S5', 'posted and cancelled: the escrow returned');
  mv('s1-paid-claim.partial', 'S1', 'accepted and paid; its execution envelope claims a notarization that an offline run does not check', { exercises: [...MK, ...E], verdict: 'PARTIAL' });
  mv('s1-paid-28001.valid', 'S1', 'the same timeline judged with the chain: the execution envelope is under a verified post-quantum anchor', { exercises: [...MK, ...F], requires: R, levels: { anchoring: 'PASSED', finality: 'PASSED' } });
  const ev = (d, n) => d.events.findIndex((e) => e.name === n); const S = (s) => V.find((x) => x.id === 'market-timeline/' + s).input;
  const piata = (nume, titlu, baza, op, r) => invalid('market-timeline/' + nume, titlu, 'market-timeline/' + baza, op, r);
  { const d = S('s2-slashed.valid'); const j = d.job;
    piata('s2.posting', 'the JobPosted event names another requester than the job', 's2-slashed.valid', { op: 'set', path: ['events', ev(d, 'JobPosted'), 'args', 'requester'], value: j.provider }, ['market.posting']);
    piata('s2.window', 'the dispute was raised after the challenge window closed', 's2-slashed.valid', { op: 'set', path: ['events', ev(d, 'JobDisputed'), 'timestamp'], value: j.submittedAt + j.challengeWindow + 5 }, ['market.window']);
    piata('s2.deadline-submitted', 'the result was submitted after the deadline', 's2-slashed.valid', { op: 'set', path: ['events', ev(d, 'ResultSubmitted'), 'timestamp'], value: j.deadline + 1 }, ['market.deadline']);
    piata('s2.arbiter', 'the dispute was resolved by an address that is not the arbiter', 's2-slashed.valid', { op: 'set', path: ['events', ev(d, 'DisputeResolved'), 'from'], value: j.requester }, ['market.arbiter']);
    piata('s2.payout', 'the slashed bond is paid to someone who is not the challenger', 's2-slashed.valid', { op: 'set', path: ['events', ev(d, 'JobSlashed'), 'args', 'challenger'], value: j.provider }, ['market.payout']);
    piata('s2.result', 'the result bytes shown do not hash to the commitment on chain', 's2-slashed.valid', { op: 'set', path: ['result'], value: d.result.slice(0, -2) + (d.result.endsWith('00') ? '01' : '00') }, ['market.result']); }
  { const d = S('s3-paid-after-dispute.valid');
    piata('s3.payout', 'the payout names someone who is not the provider', 's3-paid-after-dispute.valid', { op: 'set', path: ['events', ev(d, 'JobPaid'), 'args', 'provider'], value: d.job.requester }, ['market.payout']);
    piata('s3.arbiter-no-dispute', 'the dispute withheld from the timeline: a resolution with no dispute, and an event the job state implies is missing', 's3-paid-after-dispute.valid', { op: 'remove', path: ['events', ev(d, 'JobDisputed')] }, ['market.arbiter', 'market.complete']);
    piata('s3.replay', 'another task shown than the one the job committed to: the recomputation contradicts the arbiter', 's3-paid-after-dispute-replayed.valid', { op: 'set', path: ['spec', 'seed'], value: '0x' + 'ab'.repeat(32) }, ['market.replay']); }
  { const d = S('s4-refunded-expired.valid');
    piata('s4.deadline', 'the escrow was reclaimed as expired before the deadline', 's4-refunded-expired.valid', { op: 'set', path: ['events', ev(d, 'JobRefunded'), 'timestamp'], value: d.job.deadline - 1 }, ['market.deadline']);
    piata('s4.complete-claim', 'the claim withheld from the timeline (the job state names a provider)', 's4-refunded-expired.valid', { op: 'remove', path: ['events', ev(d, 'JobClaimed')] }, ['market.complete']);
    piata('s4.payout', 'the refund names someone who is not the requester', 's4-refunded-expired.valid', { op: 'set', path: ['events', ev(d, 'JobRefunded'), 'args', 'requester'], value: d.job.provider }, ['market.payout']); }
  { const d = S('s5-refunded-cancelled.valid');
    piata('s5.form', 'an event whose time is not a whole number of seconds', 's5-refunded-cancelled.valid', { op: 'set', path: ['events', ev(d, 'JobPosted'), 'timestamp'], value: d.events[ev(d, 'JobPosted')].timestamp + 0.5 }, ['market.form']); }
  { const d = S('s1-paid-claim.partial'); const j = d.job;
    piata('s1.window', 'a third party finalized inside the challenge window', 's1-paid-claim.partial', { op: 'set', path: ['events', ev(d, 'JobPaid'), 'timestamp'], value: j.submittedAt + 1 }, ['market.window']);
    piata('s1.complete-submission', 'the submission withheld from the timeline (the job state has a submission time)', 's1-paid-claim.partial', { op: 'remove', path: ['events', ev(d, 'ResultSubmitted')] }, ['market.complete']);
    piata('s1.deadline', 'the job was claimed after its deadline', 's1-paid-claim.partial', { op: 'set', path: ['events', ev(d, 'JobClaimed'), 'timestamp'], value: j.deadline + 1 }, ['market.deadline']);
    piata('s1.proof-late', 'the execution envelope was notarized only after the challenge window closed', 's1-paid-claim.partial', { op: 'set', path: ['envelope', 'notarization', 'firstSeen'], value: j.submittedAt + j.challengeWindow + 1 }, ['market.proof']);
    invalid('market-timeline/s1-28001.proof-claim-early', 'the envelope claims it was notarized earlier than the chain, read under the anchor, says', 'market-timeline/s1-paid-28001.valid', { op: 'set', path: ['envelope', 'notarization', 'firstSeen'], value: d.envelope.notarization.firstSeen - 600 }, ['market.proof']);
    piata('s1.proof-other-result', 'the execution envelope names another result (and so no longer hashes to its statementHash)', 's1-paid-claim.partial', { op: 'set', path: ['envelope', 'statement', 'outputHash'], value: '0x' + 'cc'.repeat(32) }, ['envelope.integrity', 'market.proof']); }

  // (F) the trust chain of an AI result (ai-trust): the bundle recorded on 28001 with its witness, and three made by one fresh agent
  { const AK = Object.keys(HARTA).filter((r) => r.startsWith('aitrust.')); const B = citeste(DOV.lantAI).bundle; const A = 'ai-trust-bundle'; const src = 'recorded (ai-trust, 2026-10-02)';
    const fara = AK.filter((r) => !['aitrust.witness-head', 'aitrust.provenance-finality'].includes(r)); const L = { authenticity: 'PASSED' };
    const bo = 'ai-trust/recorded.partial', bl = 'ai-trust/recorded-28001.valid';
    valid(bo, A, 'the recorded trust chain judged offline: every link holds, the notarized heads it brings are not read', src, { bundle: B, chain: 28001 }, { exercises: fara, verdict: 'PARTIAL', levels: L });
    valid(bl, A, 'the same trust chain with the chain: the ledger head is under a verified post-quantum anchor', src, { bundle: B, chain: 28001 }, { exercises: AK, requires: R, levels: { ...L, anchoring: 'PASSED', finality: 'PASSED' } });
    const lv = (nume, titlu, op, r, o) => invalid('ai-trust/recorded.' + nume, titlu, bo, op, r, o); const altHex = (h) => h.slice(0, -1) + (h.endsWith('0') ? '1' : '0');
    const rehash = (e) => { e.statementHash = sha256(Buffer.from(JSON.stringify(e.statement), 'utf8')); return e; }; const cu = (f) => { const b = clona(B); f(b); return { bundle: b, chain: 28001 }; };
    lv('form', 'the bundle declares another format', { op: 'set', path: ['bundle', 'format'], value: 'another-format' }, ['aitrust.form'], { levels: { authenticity: 'NOT_MEASURED' } });
    lv('identity-mismatch', 'the bundle names another agent than the key derives', { op: 'set', path: ['bundle', 'identity', 'agentId'], value: 'aere-agent:' + '11'.repeat(20) }, ['aitrust.identity-mismatch']);
    lv('identity-key', 'the public key of the identity is not a key', { op: 'set', path: ['bundle', 'identity', 'publicKeyPem'], value: 'not a key' }, ['aitrust.identity-key']);
    lv('version-attestation', 'the model attestation changed after it was hashed', { op: 'set', path: ['bundle', 'version', 'attestation', 'statement', 'artifacts', 0, 'sha256'], value: '0x' + 'ef'.repeat(32) }, ['aitrust.version-attestation']);
    lv('version-artifact-mismatch', 'the attestation covers another artifact than the weights the output names', null, ['aitrust.version-artifact-mismatch'], { producer: { note: 'the attester attested another artifact digest (statement rehashed)', input: cu((b) => { b.version.attestation.statement.artifacts[0].sha256 = '0x' + 'ab'.repeat(32); rehash(b.version.attestation); }), changed: [['bundle', 'version', 'attestation', 'statement', 'artifacts', 0, 'sha256'], ['bundle', 'version', 'attestation', 'statementHash']] } });
    lv('version-label-mismatch', 'the attestation names another model version than the output', null, ['aitrust.version-label-mismatch'], { producer: { note: 'the attester attested another version label (statement rehashed)', input: cu((b) => { b.version.attestation.statement.subject.version = String(b.version.attestation.statement.subject.version) + '-other'; rehash(b.version.attestation); }), changed: [['bundle', 'version', 'attestation', 'statement', 'subject', 'version'], ['bundle', 'version', 'attestation', 'statementHash']] } });
    lv('runtime-record', 'the runtime record is an envelope of another kind', { op: 'set', path: ['bundle', 'runtime', 'record', 'kind'], value: 'aere-proof-of-data-attestation' }, ['aitrust.runtime-record']);
    lv('runtime-artifact-mismatch', 'the host declared another artifact running', null, ['aitrust.runtime-artifact-mismatch'], { producer: { note: 'the host recorded another artifact digest (statement rehashed)', input: cu((b) => { b.runtime.record.statement.artifactSha256 = '0x' + 'cd'.repeat(32); rehash(b.runtime.record); }), changed: [['bundle', 'runtime', 'record', 'statement', 'artifactSha256'], ['bundle', 'runtime', 'record', 'statementHash']] } });
    lv('runtime-after-output', 'the runtime record is dated an hour after the output', null, ['aitrust.runtime-after-output'], { producer: { note: 'the host dated its record after the output (statement rehashed)', input: cu((b) => { b.runtime.record.statement.createdAt = new Date(Date.parse(b.provenance.proofOfAi.statement.createdAt) + 3600000).toISOString(); rehash(b.runtime.record); }), changed: [['bundle', 'runtime', 'record', 'statement', 'createdAt'], ['bundle', 'runtime', 'record', 'statementHash']] } });
    lv('audit-log-broken', 'one entry hash of the audit log changed', { op: 'set', path: ['bundle', 'runtime', 'auditLog', 0, 'hash'], value: altHex(B.runtime.auditLog[0].hash) }, ['aitrust.audit-log-broken']);
    lv('runtime-not-in-audit-log', 'an audit log that does not hold the runtime record', { op: 'set', path: ['bundle', 'runtime', 'auditLog'], value: [] }, ['aitrust.runtime-not-in-audit-log']);
    lv('audit-head', 'the attested head of the audit log changed after it was hashed', { op: 'set', path: ['bundle', 'runtime', 'head', 'statementHash'], value: altHex(B.runtime.head.statementHash) }, ['aitrust.audit-head']);
    lv('policy-hash', 'the bundle pins another policy hash than the policy it shows', { op: 'set', path: ['bundle', 'permissions', 'policyHash'], value: altHex(B.permissions.policyHash) }, ['aitrust.policy-hash']);
    lv('policy', 'the policy shown is not a policy', { op: 'set', path: ['bundle', 'permissions', 'policy'], value: 'no policy' }, ['aitrust.policy']);
    lv('ledger-invalid', 'a ledger entry changed after it was signed', { op: 'set', path: ['bundle', 'permissions', 'ledger', 'entries', 0, 'body', 'action', 'args'], value: { promptHash: '0x' + '00'.repeat(32) } }, ['aitrust.ledger-invalid']);
    lv('output-not-in-ledger', 'another output than the one the ledger entry links', null, ['aitrust.output-not-in-ledger'], { producer: { note: 'the producer of the output wrote another output digest (statement rehashed); the ledger still links the first', input: cu((b) => { b.provenance.proofOfAi.statement.outputHash = sha256(Buffer.from('another output', 'utf8')); rehash(b.provenance.proofOfAi); }), changed: [['bundle', 'provenance', 'proofOfAi', 'statement', 'outputHash'], ['bundle', 'provenance', 'proofOfAi', 'statementHash']] } });
    lv('provenance-envelope', 'the Proof of AI envelope is of another kind (and so is no longer what the ledger links)', { op: 'set', path: ['bundle', 'provenance', 'proofOfAi', 'kind'], value: 'aere-proof-of-data-attestation' }, ['aitrust.output-not-in-ledger', 'aitrust.provenance-envelope']);
    invalid('ai-trust/recorded-28001.witness-head', 'a notarized head that is not a head of this ledger', bl, { op: 'set', path: ['bundle', 'witness', 'heads', 0, 'statementHash'], value: altHex(B.witness.heads[0].statementHash) }, ['aitrust.witness-head'], { levels: { anchoring: 'FAILED', finality: 'NOT_MEASURED' } });
    invalid('ai-trust/recorded-28001.provenance-finality', 'the Proof of AI envelope claims a notarization the chain does not hold (and so is no longer what the ledger links)', bl, { op: 'add', path: ['bundle', 'provenance', 'proofOfAi', 'notarization'], value: { chainId: 28001 } }, ['aitrust.output-not-in-ledger', 'aitrust.provenance-finality'], { levels: { anchoring: 'FAILED', finality: 'PASSED' } });
    // one fresh agent, three chains: allowed (no witness at all), refused by the policy, dated apart
    const T = P.aiTrust; const fb = 'ai-trust/fresh-agent.partial'; const fsrc = 'producers (agents ledger, Proof of AI), one agent key made and discarded at generation';
    valid(fb, A, 'a trust chain with no witness: the links hold, and nobody but the agent fixed a time', fsrc, { bundle: T.allowed }, { exercises: fara, verdict: 'PARTIAL', levels: L });
    invalid('ai-trust/fresh-agent.action-refused', 'the same action under a policy that does not allow the tool: the ledger entry of the output is a refusal', fb, null, ['aitrust.action-refused'], { producer: { note: 'the owner\'s policy lists another tool; the agent recorded the action and the ledger holds the refusal', input: { bundle: T.refused }, changed: [['bundle', 'permissions']] } });
    invalid('ai-trust/fresh-agent.ledger-time-mismatch', 'the output is dated two hours before its ledger entry', fb, null, ['aitrust.ledger-time-mismatch'], { producer: { note: 'the producer dated the output two hours before the agent recorded it', input: { bundle: T.lateEntry }, changed: [['bundle', 'permissions'], ['bundle', 'provenance']] } }); }
  // (G) an audit log (verify-layer): the chain, an attested head, a signed head; inclusion and consistency against tree heads
  { const LK = Object.keys(HARTA).filter((r) => r.startsWith('auditlog.')), TK = Object.keys(HARTA).filter((r) => r.startsWith('audittree.')); const sig = ['auditlog.head-unsigned', 'auditlog.head-scheme', 'auditlog.head-key', 'auditlog.head-signature', 'auditlog.head-signer'];
    const lant = LK.filter((r) => !r.includes('.head-')), cuCap = LK.filter((r) => !sig.includes(r)); const log = jurnalAudit(), patru = log.slice(0, 4), cap4 = capAudit(log, 4); const AH = P.auditHead;
    const altHex = (h) => h.slice(0, -1) + (h.endsWith('0') ? '1' : '0'); const src = 'producers (verify-layer log and tree) on the fixed inputs';
    const NA = { integrity: 'NOT_MEASURED', authenticity: 'FAILED' };
    valid('audit-log/six-entries.valid', 'audit-log', 'a log of six entries, its hash chain intact', src, { log }, { exercises: lant });
    const lg = (nume, titlu, op, r) => invalid('audit-log/six-entries.' + nume, titlu, 'audit-log/six-entries.valid', op, [r]);
    lg('entry', 'an entry of the log is not a log entry', { op: 'set', path: ['log', 1], value: 'not an entry' }, 'auditlog.entry');
    lg('seq', 'an entry carries another sequence number', { op: 'set', path: ['log', 1, 'seq'], value: 5 }, 'auditlog.seq');
    lg('chain', 'an entry does not link the one before it', { op: 'set', path: ['log', 2, 'prev'], value: altHex(log[2].prev) }, 'auditlog.chain');
    lg('hash', 'the hash of the last entry is not the hash of its content', { op: 'set', path: ['log', 5, 'hash'], value: altHex(log[5].hash) }, 'auditlog.hash');
    const bh = 'audit-log/head-at-four.valid';
    valid(bh, 'audit-log', 'four entries and the attested head that covers them', src, { log: patru, head: cap4 }, { exercises: cuCap });
    const hd = (nume, titlu, op, r, o) => invalid('audit-log/head-at-four.' + nume, titlu, bh, op, [r], o);
    hd('head-form', 'the head is an attestation of another kind', { op: 'set', path: ['head', 'kind'], value: 'aere-proof-of-data-attestation' }, 'auditlog.head-form');
    hd('head-hash', 'the head changed after it was hashed', { op: 'set', path: ['head', 'statementHash'], value: altHex(cap4.statementHash) }, 'auditlog.head-hash');
    hd('head-short', 'the last attested entry removed from the log', { op: 'remove', path: ['log', 3] }, 'auditlog.head-short');
    { const rescris = jurnalAudit((seq, proof) => { if (seq === 1) { proof.statement.createdAt = '2026-09-27T00:00:00Z'; proof.statementHash = sha256(Buffer.from(JSON.stringify(proof.statement), 'utf8')); } }).slice(0, 4);
      hd('head-rewritten', 'the host rewrote an entry before the attested point and chained the log again', null, 'auditlog.head-rewritten', { producer: { note: 'entry 1 rewritten (another envelope), every later entry re-chained; the head is the one attested before', input: { log: rescris, head: cap4 }, changed: [['log', 1], ['log', 2], ['log', 3]] } }); }
    const bs = 'audit-log/signed-head.valid'; const b64 = AH.signed.signature.signature;
    valid(bs, 'audit-log', 'the same log against its head signed by the operator (ML-DSA-65), with the signer expected', src + '; operator key made and discarded at generation', { log: patru, head: AH.signed, signer: AH.signerPem }, { exercises: LK, levels: { authenticity: 'PASSED' } });
    const sg = (nume, titlu, op, r, o = {}) => invalid('audit-log/signed-head.' + nume, titlu, bs, op, [r], { levels: NA, ...o });
    sg('head-unsigned', 'the signature taken off a head whose signer is required', { op: 'remove', path: ['head', 'signature'] }, 'auditlog.head-unsigned');
    sg('head-scheme', 'the head signature declares another scheme', { op: 'set', path: ['head', 'signature', 'scheme'], value: 'ed25519' }, 'auditlog.head-scheme');
    sg('head-scheme-classical-key', 'the head is signed with an Ed25519 key that declares ml-dsa-65', null, 'auditlog.head-scheme', { producer: { note: 'the signer used a classical key (made and discarded at generation) and declared the scheme ml-dsa-65', input: { log: patru, head: AH.classical, signer: AH.signerPem }, changed: [['head', 'signature', 'publicKey'], ['head', 'signature', 'signature']] } });
    sg('head-key', 'the public key of the head signature is not a key', { op: 'set', path: ['head', 'signature', 'publicKey'], value: 'AAAA' }, 'auditlog.head-key');
    sg('head-signature', 'the head signature has one character changed', { op: 'set', path: ['head', 'signature', 'signature'], value: (b64[0] === 'A' ? 'B' : 'A') + b64.slice(1) }, 'auditlog.head-signature');
    sg('head-signer', 'the head is signed, by another key than the signer expected', { op: 'set', path: ['signer'], value: AH.otherSignerPem }, 'auditlog.head-signer');
    // the same signed head with NO signer expected (2026-10-05): the scheme rule is then all that stands between a classical key and acceptance
    const bn = 'audit-log/signed-head-any-signer.valid';
    valid(bn, 'audit-log', 'the same log against its signed head, with no signer expected: the head must still be signed with a key of the scheme it declares', src + '; operator key made and discarded at generation', { log: patru, head: AH.signed }, { exercises: LK, levels: { authenticity: 'PASSED' } });
    invalid('audit-log/signed-head-any-signer.head-scheme-classical-key', 'the head is signed with an Ed25519 key that declares ml-dsa-65, and no signer is expected: without the scheme rule this head is accepted', bn, null, ['auditlog.head-scheme'],
      { levels: NA, producer: { note: 'the signer used a classical key (made and discarded at generation) and declared the scheme ml-dsa-65', input: { log: patru, head: AH.classical }, changed: [['head', 'signature', 'publicKey'], ['head', 'signature', 'signature']] } });
    // the tree: inclusion of entry 2 under the head of six, consistency from the head of four to the head of six
    const t6 = capDeArbore(log, { host: 'conformance', createdAt: '2026-10-03T00:00:00Z' }), t4 = capDeArbore(patru, { host: 'conformance', createdAt: '2026-10-03T00:00:00Z' }); const inc = dovadaIncludere(log, 2);
    const bi = 'audit-inclusion/entry-2.valid'; const INC = TK.filter((r) => !r.includes('consistency'));
    valid(bi, 'audit-inclusion', 'entry 2 proven in the tree of six entries, against its head', src, { proof: inc, head: t6 }, { exercises: INC });
    const ic = (nume, titlu, op, r, o) => invalid('audit-inclusion/entry-2.' + nume, titlu, bi, op, [r], o);
    ic('proof-form', 'the proof declares another kind', { op: 'set', path: ['proof', 'kind'], value: 'another-proof' }, 'audittree.proof-form');
    ic('inclusion-index', 'the proof is for another index than the entry shown', { op: 'set', path: ['proof', 'index'], value: 3 }, 'audittree.inclusion-index');
    ic('inclusion-entry', 'the entry shown changed after it was hashed', { op: 'set', path: ['proof', 'entry', 'prev'], value: altHex(inc.entry.prev) }, 'audittree.inclusion-entry');
    ic('inclusion-leaf', 'the leaf is not the leaf of the entry shown', { op: 'set', path: ['proof', 'leafHash'], value: altHex(inc.leafHash) }, 'audittree.inclusion-leaf');
    ic('inclusion-path', 'one hash of the path changed', { op: 'set', path: ['proof', 'path', 0], value: altHex(inc.path[0]) }, 'audittree.inclusion-path');
    ic('inclusion-head', 'the head given is the head of another tree', { op: 'set', path: ['head'], value: t4 }, 'audittree.inclusion-head');
    ic('head-form', 'the tree head is an attestation of another kind', { op: 'set', path: ['head', 'kind'], value: 'aere-audit-head-attestation' }, 'audittree.head-form');
    ic('head-hash', 'the tree head changed after it was hashed', { op: 'set', path: ['head', 'statementHash'], value: altHex(t6.statementHash) }, 'audittree.head-hash');
    { const stricat = jurnalAudit((seq, proof) => { if (seq === 2) proof.statementHash = altHex(proof.statementHash); });
      ic('inclusion-envelope', 'the host logged an envelope that does not hash to its statementHash: the entry is in the tree, and it is not an envelope', null, 'audittree.inclusion-envelope', { producer: { note: 'the host wrote a broken envelope into entry 2 and chained the log over it', input: { proof: dovadaIncludere(stricat, 2), head: capDeArbore(stricat, { host: 'conformance', createdAt: '2026-10-03T00:00:00Z' }) }, changed: [['proof'], ['head']] } }); }
    const cons = dovadaConsistenta(log, 4); const bc = 'audit-consistency/four-to-six.valid';
    valid(bc, 'audit-consistency', 'the tree of six entries extends the tree of four', src, { proof: cons, older: t4, newer: t6 }, { exercises: TK.filter((r) => !r.includes('inclusion')) });
    const co = (nume, titlu, op, r) => invalid('audit-consistency/four-to-six.' + nume, titlu, bc, op, [r]);
    co('consistency-start', 'the proof starts at another root than the old head', { op: 'set', path: ['proof', 'firstRoot'], value: altHex(cons.firstRoot) }, 'audittree.consistency-start');
    co('consistency-end', 'the proof ends at another root than the new head', { op: 'set', path: ['proof', 'secondRoot'], value: altHex(cons.secondRoot) }, 'audittree.consistency-end');
    co('consistency', 'one hash of the consistency path changed', { op: 'set', path: ['proof', 'path', 0], value: altHex(cons.path[0]) }, 'audittree.consistency'); }
  // (H) an agent's signed ledger (agents): four entries of one fresh agent, verified as a stranger would
  { const GK = Object.keys(HARTA).filter((r) => r.startsWith('agents.')); const G = P.agentLedger; const bg = 'agent-ledger/four-entries.valid'; const L0 = G.ledger;
    const altHex = (h) => h.slice(0, -1) + (h.endsWith('0') ? '1' : '0'); const NA = { integrity: 'NOT_MEASURED', authenticity: 'FAILED' }, NI = { authenticity: 'NOT_MEASURED' };
    valid(bg, 'agent-ledger', 'the ledger of an agent: a tool call, a payment, a payment refused above the limit, a tool call', 'producer (agents ledger), one agent key made and discarded at generation', { ledger: L0, policy: G.policy }, { exercises: GK, levels: { authenticity: 'PASSED' } });
    const ag = (nume, titlu, op, r, o = {}) => invalid('agent-ledger/four-entries.' + nume, titlu, bg, op, [r], { levels: ['agents.key', 'agents.identity', 'agents.signature'].includes(r) ? NA : NI, ...o });
    ag('ledger-form', 'the entries are not a list', { op: 'set', path: ['ledger', 'entries'], value: 'none' }, 'agents.ledger-form');
    ag('policy', 'the verifier pins another policy hash than the policy given', { op: 'add', path: ['policyHash'], value: '0x' + 'ab'.repeat(32) }, 'agents.policy');
    ag('other-policy', 'the ledger names another policy', { op: 'set', path: ['ledger', 'policyHash'], value: altHex(L0.policyHash) }, 'agents.other-policy');
    ag('session', 'the session is not the one derived from the agent and the policy', { op: 'set', path: ['ledger', 'session'], value: altHex(L0.session) }, 'agents.session');
    ag('key', 'the public key is not a key', { op: 'set', path: ['ledger', 'publicKeyPem'], value: 'not a key' }, 'agents.key');
    ag('key-classical', 'a ledger whose agent identity is an Ed25519 key: the id is derived from it and every entry is signed by it', null, 'agents.key', { producer: { note: 'the agent\'s identity key is a classical key (made and discarded at generation)', input: { ledger: G.classical.ledger, policy: G.classical.policy }, changed: [['ledger'], ['policy']] } });
    { const x = 'aere-agent:' + '11'.repeat(20); ag('identity', 'the ledger names an agent id that its key does not derive (with the session of that id)', null, 'agents.identity', { producer: { note: 'the ledger claims another agent id, and the session derived from it', input: { ledger: { ...clona(L0), agentId: x, session: sessionId(x, L0.policyHash) }, policy: G.policy }, changed: [['ledger', 'agentId'], ['ledger', 'session']] } }); }
    ag('anchor', 'an anchor that names no entry of this ledger', { op: 'add', path: ['anchors'], value: [{ seq: 99, hash: L0.entries[0].hash, at: G.t0 }] }, 'agents.anchor');
    ag('seq', 'an entry carries another sequence number', { op: 'set', path: ['ledger', 'entries', 1, 'seq'], value: 5 }, 'agents.seq');
    ag('chain', 'an entry does not link the one before it', { op: 'set', path: ['ledger', 'entries', 1, 'prev'], value: altHex(L0.entries[1].prev) }, 'agents.chain');
    ag('body', 'the body of an entry names another session than its ledger', { op: 'set', path: ['ledger', 'entries', 1, 'body', 'session'], value: altHex(L0.session) }, 'agents.body');
    ag('signature', 'the signature of an entry has one character changed', { op: 'set', path: ['ledger', 'entries', 1, 'signature'], value: (L0.entries[1].signature[0] === 'A' ? 'B' : 'A') + L0.entries[1].signature.slice(1) }, 'agents.signature');
    ag('hash', 'the hash of the last entry does not reproduce', { op: 'set', path: ['ledger', 'entries', 3, 'hash'], value: altHex(L0.entries[3].hash) }, 'agents.hash');
    ag('time', 'the verifier\'s clock is before the entries: they are from its future', { op: 'add', path: ['maxTime'], value: G.t0 - 1000 }, 'agents.time');
    const al4 = (nume, titlu, l, r, nota) => ag(nume, titlu, null, r, { producer: { note: nota, input: { ledger: l, policy: G.policy }, changed: [['ledger', 'entries', 3]] } });
    al4('approvals', 'the fourth entry carries an empty approvals list', G.approvalsEmpty, 'agents.approvals', 'the agent signed an entry with an approvals field that is an empty list');
    al4('decision', 'the fourth entry writes a refusal for a payment the policy allows', G.falseDecision, 'agents.decision', 'the agent signed an entry whose decision is not the one the policy gives');
    al4('revocation', 'the fourth entry is a revocation entry that carries no revocation', G.revocationWithout, 'agents.revocation', 'the agent signed a revocation entry without the owner\'s revocation'); }
  // (I) a presentation of a post-quantum credential (identity): judged with what the verifier brings (audience, nonce, clock, trusted
  // issuers, status lists, revocations). One credential, shown by its holder and by a session key at the end of a delegation chain
  { const IK = Object.keys(HARTA).filter((r) => r.startsWith('identity.')); const X = P.identity; const A = 'identity-presentation'; const F = X.forged;
    const intrare = (prez, o = {}) => ({ presentation: prez, audience: X.audience, nonce: X.nonce, now: X.now, trustedIssuers: X.trusted, statusLists: [X.lists.clean], ...o });
    const AP = { authenticity: 'PASSED' }, OPRIT = { authenticity: 'NOT_MEASURED' }, NI = { integrity: 'NOT_MEASURED' }; const schimba = (c) => (c[0] === 'A' ? 'B' : 'A') + c.slice(1);
    const src = 'producers (identity: issueCredential, createStatusList, delegate, present), six hybrid key pairs made and discarded at generation';
    const bd = 'identity-presentation/direct.valid', bl = 'identity-presentation/delegated.valid';
    valid(bd, A, 'a holder shows two of three disclosable claims to a verifier that brings its audience, its nonce, its clock, the issuer it trusts and the issuer\'s current status list', src, intrare(X.direct), { exercises: IK, levels: AP });
    valid(bl, A, 'the same credential shown by a session key: the holder delegated to a phone, the phone to the session key for ten minutes and one claim', src, intrare(X.delegated), { exercises: IK, levels: AP });
    // what the verifier did not bring: nothing fails, and the verdict is not VALID
    const fara = (nume, titlu, baza, op, levels) => valid('identity-presentation/' + nume, A, titlu, src, aplica(V.find((x) => x.id === baza).input, op), { exercises: IK, verdict: 'PARTIAL', levels: { ...AP, ...levels }, base: baza, mutation: op });
    fara('direct.no-audience.partial', 'the verifier gives no audience: a presentation made for another verifier would be accepted, so this one is not VALID', bd, { op: 'remove', path: ['audience'] }, NI);
    fara('direct.no-nonce.partial', 'the verifier gives no nonce: an old presentation could be replayed', bd, { op: 'remove', path: ['nonce'] }, NI);
    fara('direct.no-trusted-issuers.partial', 'the verifier names no issuer it trusts: anyone can issue a credential with their own keys', bd, { op: 'remove', path: ['trustedIssuers'] }, { authenticity: 'NOT_MEASURED' });
    fara('direct.no-status-list.partial', 'the credential names a status list and the verifier was not handed it: a revocation cannot be seen', bd, { op: 'remove', path: ['statusLists'] }, NI);
    fara('direct.status-list-other-issuer.partial', 'the list handed has the right id and another issuer\'s signature (and revokes): ignored, the status is not read', bd, { op: 'set', path: ['statusLists', 0], value: X.lists.otherIssuer }, NI);
    fara('direct.status-list-expired.partial', 'the issuer\'s list handed is no longer valid on the verifier\'s clock: the status is not read', bd, { op: 'set', path: ['statusLists', 0], value: X.lists.expired }, NI);
    // revocations that do not take effect leave the delegated presentation VALID
    const ramane = (nume, titlu, rev) => { const op = { op: 'add', path: ['revocations'], value: [rev] }; valid('identity-presentation/' + nume, A, titlu, src, aplica(V.find((x) => x.id === bl).input, op), { exercises: IK, levels: AP, base: bl, mutation: op }); };
    ramane('delegated.revocation-by-stranger.valid', 'a revocation of the first link signed by a stranger is ignored', X.revocations.byStranger);
    ramane('delegated.revocation-in-the-future.valid', 'a revocation by the holder dated a day ahead has not taken effect on the verifier\'s clock', X.revocations.inTheFuture);
    // one operation on the direct presentation
    const d = (nume, titlu, op, r, o = {}) => invalid('identity-presentation/direct.' + nume, titlu, bd, op, r, o); const sg = X.direct.signature;
    d('form', 'the file is of another kind', { op: 'set', path: ['presentation', 'kind'], value: 'aere-credential' }, ['identity.form'], { levels: OPRIT });
    d('form-null', 'the presentation is the JSON value null', { op: 'set', path: ['presentation'], value: null }, ['identity.form'], { levels: OPRIT });
    d('form-credential', 'the credential inside is of another kind', { op: 'set', path: ['presentation', 'credential', 'statement', 'kind'], value: 'aere-status-list' }, ['identity.form'], { levels: OPRIT });
    d('form-binding', 'the binding is of another kind', { op: 'set', path: ['presentation', 'binding', 'kind'], value: 'aere-delegation' }, ['identity.form'], { levels: OPRIT });
    d('issuer-trusted', 'the verifier trusts another issuer', { op: 'set', path: ['trustedIssuers'], value: [X.strangerId] }, ['identity.issuer-trusted']);
    d('credential-revoked', 'the issuer\'s current status list has the bit of this credential set', { op: 'set', path: ['statusLists', 0], value: X.lists.revoked }, ['identity.credential-revoked']);
    d('credential-revoked-second-list', 'two current lists of the issuer, one of them revokes: a revocation is not lifted by another list', { op: 'add', path: ['statusLists', 1], value: X.lists.revoked }, ['identity.credential-revoked']);
    d('status-list', 'the issuer signed a status list that does not decompress', { op: 'set', path: ['statusLists', 0], value: X.lists.unreadable }, ['identity.status-list']);
    d('status-list-index', 'the issuer\'s list is shorter than the index the credential names', { op: 'set', path: ['statusLists', 0], value: X.lists.short }, ['identity.status-list']);
    d('binding-disclosures-removed', 'a disclosure taken out after the presenter signed', { op: 'remove', path: ['presentation', 'disclosures', 0] }, ['identity.binding-disclosures']);
    d('binding-disclosures-added', 'a disclosure the issuer signed, added after the presenter signed (the holder did not choose to show it)', { op: 'add', path: ['presentation', 'disclosures', 2], value: X.undisclosed }, ['identity.binding-disclosures']);
    d('presentation-signature', 'the ML-DSA-65 half of the presenter\'s signature has one character changed', { op: 'set', path: ['presentation', 'signature', 'mldsa65'], value: schimba(sg.mldsa65) }, ['identity.presentation-signature']);
    d('presentation-signature-ed25519', 'the Ed25519 half of the presenter\'s signature has one character changed', { op: 'set', path: ['presentation', 'signature', 'ed25519'], value: schimba(sg.ed25519) }, ['identity.presentation-signature']);
    d('presentation-signature-no-ml-dsa', 'the ML-DSA-65 half of the presenter\'s signature removed: the classical half alone is not a signature here', { op: 'remove', path: ['presentation', 'signature', 'mldsa65'] }, ['identity.presentation-signature']);
    d('presentation-signature-alg', 'the signature declares ed25519 alone', { op: 'set', path: ['presentation', 'signature', 'alg'], value: 'ed25519' }, ['identity.presentation-signature']);
    d('audience', 'the presentation was made for this verifier and is shown to another', { op: 'set', path: ['audience'], value: 'https://another-verifier.example' }, ['identity.audience']);
    d('nonce', 'the verifier gave another nonce (a replay)', { op: 'set', path: ['nonce'], value: 'n-another' }, ['identity.nonce']);
    d('freshness', 'the verifier\'s clock is an hour after the presentation was made', { op: 'set', path: ['now'], value: X.later }, ['identity.freshness']);
    d('clock-years-later', 'the verifier\'s clock is years later: the credential has expired and the presentation is old', { op: 'set', path: ['now'], value: X.muchLater }, ['identity.credential-window', 'identity.freshness']);
    // one change at a producer: only who holds the key can make these
    const p = (baza) => (nume, titlu, prez, r, nota, o = {}) => invalid(`${baza.replace(/\.valid$/, '')}.${nume}`, titlu, baza, null, r, { levels: o.levels, producer: { note: nota, input: intrare(prez, o.input || {}), changed: [['presentation'], ...(o.changed || [])] } });
    const pd = p(bd), pl = p(bl);
    pd('issuer-id-impostor', 'an impostor issues the credential with its own keys under the id of the issuer the verifier trusts', F.issuerImpostor, ['identity.issuer-id'], 'another issuer wrote the trusted issuer\'s id beside its own keys and signed with them (this credential names no status list)');
    pd('issuer-classical-key', 'the issuer\'s "ML-DSA-65" key is an Ed25519 key, the id is the hash of those keys and both halves of the signature are Ed25519: a classical key is not a post-quantum one because of the field it sits in', F.issuerClassicalKey.presentation, ['identity.credential-signature', 'identity.issuer-id'],
      'an issuer with two Ed25519 keys (made and discarded at generation) put the second in the mldsa65 field, derived its id with the published formula and signed with both', { input: { trustedIssuers: [F.issuerClassicalKey.issuerId] }, changed: [['trustedIssuers']] });
    pd('holder-id', 'the credential and the presenter name a holder id that the holder keys do not derive', F.holderId, ['identity.holder-id'], 'the issuer signed another holder id beside the holder\'s keys, and the holder presented under that id');
    pd('credential-signature', 'the ML-DSA-65 half of the issuer\'s signature has one character changed, and the holder presents the credential so', F.credentialSignatureMlDsa, ['identity.credential-signature'], 'the holder presented a credential whose issuer signature was changed (ML-DSA-65 half)');
    pd('credential-signature-ed25519', 'the Ed25519 half of the issuer\'s signature has one character changed', F.credentialSignatureEd25519, ['identity.credential-signature'], 'the holder presented a credential whose issuer signature was changed (Ed25519 half)');
    pd('credential-signature-claim-edited', 'the holder edited a plain claim of the credential and presents it', F.claimEdited, ['identity.credential-signature'], 'the holder changed the plain claim employer after issuance and signed a presentation of the changed credential');
    pd('credential-window-expired', 'the credential expired the day before', F.expired, ['identity.credential-window'], 'the issuer issued the same claims valid until the day before the presentation');
    pd('credential-window-not-yet', 'the credential is valid only from the next day', F.notYetValid, ['identity.credential-window'], 'the issuer issued the same claims valid from the day after the presentation');
    pd('sd-distinct', 'the issuer signed the same digest twice', F.sdTwice, ['identity.sd-distinct'], 'the issuer signed a credential whose sd list repeats a digest');
    pd('disclosure-readable', 'a disclosure with a salt of eight bytes among those shown', F.disclosureShortSalt, ['identity.disclosure-readable'], 'the holder added a disclosure with an eight-byte salt and signed for the list');
    pd('disclosure-signed', 'a disclosure the holder made up (age_over_21), signed for by the holder and not by the issuer', F.disclosureFabricated, ['identity.disclosure-signed'], 'the holder added a disclosure whose digest the issuer never signed and signed for the list');
    pd('disclosure-once', 'the same disclosure shown twice', F.disclosureTwice, ['identity.disclosure-once'], 'the holder listed one disclosure twice and signed for the list');
    pd('disclosure-plain', 'the issuer signed a disclosure for a claim the credential also has in the clear, with another value', F.disclosureOverPlain, ['identity.disclosure-plain'], 'the issuer added to sd the digest of a disclosure named like the plain claim employer; the holder shows it');
    pd('claim-name', 'the issuer signed a plain claim whose name is not allowed', F.claimName, ['identity.claim-name'], 'the issuer signed a credential with a plain claim named "bad name"');
    pd('binding-credential', 'the presenter signed for another credential than the one shown', F.otherCredential, ['identity.binding-credential'], 'the holder signed a binding that names the hash of another credential');
    pd('presenter', 'a stranger presents the holder\'s credential with the holder\'s disclosures, signed with the stranger\'s keys', F.stranger, ['identity.presenter'], 'someone who is not the holder made and signed the presentation');
    pd('unreadable', 'the presenter signed a binding whose time is not a time', F.createdAt, ['identity.unreadable'], 'the holder signed a binding with createdAt "yesterday"', { levels: OPRIT });
    // the delegated presentation: one operation
    const l = (nume, titlu, op, r, o = {}) => invalid('identity-presentation/delegated.' + nume, titlu, bl, op, r, o);
    l('delegation-revoked', 'the holder revoked the first link before the presentation', { op: 'add', path: ['revocations'], value: [X.revocations.byHolder] }, ['identity.delegation-revoked']);
    l('delegation-revoked-by-giver', 'the phone revoked the link it gave to the session key', { op: 'add', path: ['revocations'], value: [X.revocations.byGiver] }, ['identity.delegation-revoked']);
    l('chain-cut', 'the last link taken out after the session key signed: the chain is not the one signed, and the presenter is not its last delegate', { op: 'remove', path: ['presentation', 'delegations', 1] }, ['identity.binding-delegations', 'identity.presenter']);
    // the delegated presentation: one change at a producer
    pl('binding-delegations', 'the session key signed for no chain and shows one', F.chainUnsigned, ['identity.binding-delegations'], 'the delegate signed a binding with an empty delegation list and attached the chain');
    pl('chain-length', 'a chain of nine links', F.chainNine, ['identity.chain-length'], 'the holder, the phone and the session key delegated to one another nine times', { levels: OPRIT });
    pl('delegation-form', 'the only link is of another kind, signed so by the holder', F.linkForm, ['identity.delegation-form'], 'the holder signed a link of kind aere-delegation-v0 to the phone, and the phone presents', { levels: OPRIT });
    pl('delegation-ids', 'the link and the presenter name a delegate id that the delegate keys do not derive', F.linkIds, ['identity.delegation-ids'], 'the holder signed another delegate id beside the phone\'s keys, and the phone presented under that id');
    pl('delegation-from', 'a stranger delegates the holder\'s credential to the phone', F.linkFromStranger, ['identity.delegation-from'], 'someone who is not the holder gave the first link');
    pl('delegation-parent', 'the second link names no parent', F.linkNoParent, ['identity.delegation-parent'], 'the phone gave the session key a link that does not name the link it comes from');
    pl('delegation-signature', 'the ML-DSA-65 half of the link\'s signature has one character changed, and the phone presents the chain so', F.linkSignature, ['identity.delegation-signature'], 'the phone presented a link whose signature was changed (ML-DSA-65 half)');
    pl('delegation-scope-field', 'the scope of the link has a field the verifier does not know', F.linkScopeUnknownField, ['identity.delegation-scope'], 'the holder signed a link whose scope carries an extra field');
    pl('delegation-scope-unsorted', 'the scope of the link is not in its normal form', F.linkScopeUnsorted, ['identity.delegation-scope'], 'the holder signed a link whose claims are not sorted');
    pl('delegation-window', 'the link expired an hour before the presentation', F.linkExpired, ['identity.delegation-window'], 'the holder gave a link valid from two hours to one hour before');
    pl('delegation-depth-zero', 'the first link allows no further delegation and the phone delegated anyway', F.linkDepthZero, ['identity.delegation-depth', 'identity.delegation-narrows'], 'the holder gave the phone a link of depth 0; the phone signed a second link under it');
    pl('delegation-depth-negative', 'the second link is given a negative depth, so that it "narrows" a first link of depth 0', F.linkDepthNegative, ['identity.delegation-depth'], 'the holder gave the phone a link of depth 0; the phone signed a second link of depth -1 under it');
    pl('delegation-narrows', 'the phone widens the claims the holder allowed it', F.linkWidens, ['identity.delegation-narrows'], 'the phone signed a second link whose claims are "*"');
    pl('delegation-credential', 'the link is for another credential', F.linkOtherCredential, ['identity.delegation-credential'], 'the holder gave a link scoped to another credential id');
    pl('delegation-claims', 'the phone shows a claim outside the scope of its link', F.linkOtherClaims, ['identity.delegation-claims'], 'the holder gave a link for one claim; the phone disclosed two');
    pl('delegation-audience', 'the link is for another verifier', F.linkOtherAudience, ['identity.delegation-audience'], 'the holder gave a link scoped to another audience'); }
  // (J) a device bundle (device identity): the manufacturer's credential for the device key, a firmware release, the ownership chain,
  // the owner's authorization, the device's fresh attestation, judged with what the verifier brings (clock, nonce, audience, trusted
  // manufacturers, the recall list, the firmware policy, the status records, its reading of the notarized envelope)
  { const DK = Object.keys(HARTA).filter((r) => r.startsWith('device.')); const X = P.device; const A = 'device-bundle'; const F = X.forged; const T1 = [X.transfers[0]];
    const pachet = (o = {}) => DV.bundle({ manufacture: X.manufacture, firmware: X.firmware, transfers: T1, authorization: X.authorization, attestation: X.attestation, ...o });
    const intrare = (b, o = {}) => ({ bundle: b, now: X.now, nonce: X.nonce, audience: X.audience, trustedManufacturers: X.trusted, statusLists: [X.lists.clean], firmwarePolicies: [X.policies.current], statusRecords: [X.records.active], ...o });
    const AP = { authenticity: 'PASSED' }, OPRIT = { authenticity: 'NOT_MEASURED' }, NI = { integrity: 'NOT_MEASURED' }, NA = { authenticity: 'NOT_MEASURED' }; const schimba = (c) => (c[0] === 'A' ? 'B' : 'A') + c.slice(1);
    const src = 'producers (device identity: manufacture, releaseFirmware, firmwarePolicy, transferOwnership, authorize, statusRecord, attest, proofOfDevice), five hybrid key pairs and two ML-DSA-65 device keys made and discarded at generation';
    const bd = 'device-bundle/sold-once.valid', bs = 'device-bundle/with-software.valid', bw = 'device-bundle/witnessed.valid', bm = 'device-bundle/manufacture-only.partial', bc = 'device-bundle/chain-only.partial', ba = 'device-bundle/attestation-only.partial';
    valid(bd, A, 'a device made by a manufacturer the verifier trusts, sold once, authorized by its owner, attesting to the verifier\'s nonce; the recall list, the firmware policy and the status registry were read', src, intrare(pachet()), { exercises: DK, levels: AP });
    valid(bs, A, 'the same device, the release names a Proof of Software attestation of its image and the verifier is handed it', src, intrare(pachet({ firmware: X.firmwareWithSoftware }), { softwareAttestation: X.software }), { exercises: DK, levels: AP });
    valid(bw, A, 'the same device with the AIP-23 envelope of its attestation and the verifier\'s own reading of when that envelope was on the chain', src, intrare(pachet({ anchor: { ...X.envelope, notarization: { chainId: X.reading.chainId, note: 'a claim written for this vector: nothing was notarized' } } }), { anchors: [X.reading] }), { exercises: DK, levels: AP });
    // what was not brought or not read: nothing fails, and the verdict is not VALID
    const fara = (id, titlu, baza, op, levels, o = {}) => valid(id, A, titlu, src, aplica(V.find((x) => x.id === baza).input, op), { exercises: DK, verdict: 'PARTIAL', levels: { ...AP, ...levels }, base: baza, mutation: op, ...o });
    const dinProd = (id, titlu, input, levels) => valid(id, A, titlu, src, input, { exercises: DK, verdict: 'PARTIAL', levels: { ...AP, ...levels } });
    fara('device-bundle/no-nonce.partial', 'the verifier gives no nonce: an old attestation could be replayed', bd, { op: 'remove', path: ['nonce'] }, NI);
    fara('device-bundle/no-audience.partial', 'the verifier gives no audience: an attestation made for another verifier would be accepted', bd, { op: 'remove', path: ['audience'] }, NI);
    fara('device-bundle/no-trusted-manufacturers.partial', 'the verifier names no manufacturer it trusts: anyone can sign a manufacture credential', bd, { op: 'remove', path: ['trustedManufacturers'] }, NA);
    fara('device-bundle/recall-list-not-read.partial', 'the manufacturer\'s recall list was not handed to the verifier', bd, { op: 'remove', path: ['statusLists', 0] }, NI);
    fara('device-bundle/firmware-policy-not-read.partial', 'no firmware policy was handed: a retracted or outdated firmware cannot be seen', bd, { op: 'remove', path: ['firmwarePolicies', 0] }, NI);
    fara('device-bundle/status-not-read.partial', 'the status registry was not read: a suspension or a retirement cannot be seen, so the verdict is not VALID', bd, { op: 'remove', path: ['statusRecords', 0] }, NI);
    fara('device-bundle/status-of-a-stranger.partial', 'the only status record handed is a stranger\'s: it is ignored, and the registry counts as not read', bd, { op: 'set', path: ['statusRecords', 0], value: X.records.retiredByStranger }, NI);
    fara('device-bundle/no-attestation.partial', 'the bundle brings no attestation: nothing was said by the device now', bd, { op: 'remove', path: ['bundle', 'attestation'] }, NI);
    fara('device-bundle/no-authorization.partial', 'the bundle brings no authorization: nothing says what the device may do', bd, { op: 'remove', path: ['bundle', 'authorization'] }, NI);
    fara('device-bundle/no-firmware.partial', 'the bundle brings no firmware release: the digest the device attests names nothing a manufacturer signed', bd, { op: 'remove', path: ['bundle', 'firmware'] }, NI);
    fara('device-bundle/software-not-read.partial', 'the release names a Proof of Software attestation that was not handed', bs, { op: 'remove', path: ['softwareAttestation'] }, NI);
    fara('device-bundle/notarization-not-read.partial', 'the envelope claims a notarization and the verifier read nothing on the chain: a claim is not a reading', bw, { op: 'remove', path: ['anchors'] }, { anchoring: 'NOT_MEASURED' });
    dinProd(bm, 'the manufacture credential alone: who made the device and which key is its key, nothing more', intrare(DV.bundle({ manufacture: X.manufacture }), { statusRecords: [] }), NI);
    dinProd(bc, 'the manufacture credential and two transfers: the device was sold twice', intrare(DV.bundle({ manufacture: X.manufacture, transfers: X.transfers }), { statusRecords: [] }), NI);
    dinProd(ba, 'an attestation alone: a key speaking for itself', intrare(DV.bundle({ attestation: X.attestation }), { statusRecords: [] }), NI);
    dinProd('device-bundle/hardware-root.partial', 'an attestation that carries a hardware root: this verifier does not judge one, and the verdict says so', intrare(pachet({ attestation: F.hardwareRoot })), NA);
    // revocations that have no effect: VALID stays VALID
    valid('device-bundle/suspension-lifted.valid', A, 'the owner suspended the device and later said active again: the later record of the same signer holds', src, aplica(aplica(V.find((x) => x.id === bd).input, { op: 'set', path: ['statusRecords', 0], value: X.records.suspendedByOwner }), { op: 'add', path: ['statusRecords', 1], value: X.records.activeLaterByOwner }), { exercises: DK, levels: AP });
    { const op = { op: 'add', path: ['statusRecords', 1], value: X.records.retiredByStranger }; valid('device-bundle/retired-by-a-stranger.valid', A, 'a "retired" record signed by a stranger is ignored', src, aplica(V.find((x) => x.id === bd).input, op), { exercises: DK, levels: AP, base: bd, mutation: op }); }
    // one operation on what the verifier brings, or on a field nobody hashed
    const d = (nume, titlu, op, r, o = {}) => invalid('device-bundle/sold-once.' + nume, titlu, bd, op, r, o);
    d('form', 'the file is of another kind', { op: 'set', path: ['bundle', 'kind'], value: 'aere-presentation' }, ['device.form'], { levels: OPRIT });
    d('form-null', 'the bundle is the JSON value null', { op: 'set', path: ['bundle'], value: null }, ['device.form'], { levels: OPRIT });
    d('manufacture-form', 'the credential inside is of another type', { op: 'set', path: ['bundle', 'manufacture', 'statement', 'type'], value: 'ExampleMembership' }, ['device.manufacture-form'], { levels: { ...OPRIT, ...NI } });
    d('manufacturer-trusted', 'the verifier trusts another manufacturer', { op: 'set', path: ['trustedManufacturers'], value: [X.strangerId] }, ['device.manufacturer-trusted']);
    // the hash of the signed credential is what the first transfer names: on a sold device a changed signature also unhooks the chain
    d('manufacture-signature-and-chain', 'the ML-DSA-65 half of the manufacturer\'s signature has one character changed on a device that was sold: the signature fails, and the first transfer no longer names this credential', { op: 'set', path: ['bundle', 'manufacture', 'signature', 'mldsa65'], value: schimba(X.manufacture.signature.mldsa65) }, ['device.manufacture-signature', 'device.transfer-prev']);
    d('manufacture-revoked', 'the manufacturer\'s current recall list has the bit of this device set', { op: 'set', path: ['statusLists', 0], value: X.lists.revoked }, ['device.manufacture-revoked']);
    d('manufacture-revoked-second-list', 'two current lists of the manufacturer, one of them recalls: a recall is not lifted by another list', { op: 'add', path: ['statusLists', 1], value: X.lists.revoked }, ['device.manufacture-revoked']);
    d('manufacture-status-list', 'the manufacturer signed a recall list that does not decompress', { op: 'set', path: ['statusLists', 0], value: X.lists.unreadable }, ['device.manufacture-status-list']);
    d('firmware-form', 'the sequence number of the release is a string', { op: 'set', path: ['bundle', 'firmware', 'statement', 'sequence'], value: '2' }, ['device.firmware-form'], { levels: OPRIT });
    d('firmware-signature', 'the ML-DSA-65 half of the release signature has one character changed', { op: 'set', path: ['bundle', 'firmware', 'signature', 'mldsa65'], value: schimba(X.firmware.signature.mldsa65) }, ['device.firmware-signature']);
    d('firmware-signature-version', 'the version label edited after the release was signed', { op: 'set', path: ['bundle', 'firmware', 'statement', 'version'], value: '9.9.9' }, ['device.firmware-signature']);
    d('firmware-retracted', 'the manufacturer retracted this release: its digest is in the current policy', { op: 'set', path: ['firmwarePolicies', 0], value: X.policies.retracts }, ['device.firmware-retracted']);
    d('firmware-retracted-second-policy', 'two current policies, one retracts the release: a retraction is not lifted by another policy', { op: 'add', path: ['firmwarePolicies', 1], value: X.policies.retracts }, ['device.firmware-retracted']);
    d('firmware-rollback', 'the manufacturer raised the floor above this release (sequence 2, floor 3): the firmware is outdated', { op: 'set', path: ['firmwarePolicies', 0], value: X.policies.floorThree }, ['device.firmware-rollback']);
    d('firmware-rollback-second-policy', 'two current policies, a loose one and a strict one: the strict floor holds', { op: 'add', path: ['firmwarePolicies', 1], value: X.policies.floorThree }, ['device.firmware-rollback']);
    d('transfer-form', 'the transfer is of another kind', { op: 'set', path: ['bundle', 'transfers', 0, 'statement', 'kind'], value: 'aere-device-transfer-v0' }, ['device.transfer-form'], { levels: { ...OPRIT, ...NI } });
    d('authorization-form', 'the authorization is of another kind', { op: 'set', path: ['bundle', 'authorization', 'statement', 'kind'], value: 'aere-delegation' }, ['device.authorization-form'], { levels: OPRIT });
    d('authorization-signature', 'the granted actions widened after the owner signed', { op: 'add', path: ['bundle', 'authorization', 'statement', 'actions', 2], value: 'zz.everything' }, ['device.authorization-signature']);
    d('status-retired', 'the manufacturer retired the device, and the registry was read', { op: 'add', path: ['statusRecords', 1], value: X.records.retiredByManufacturer }, ['device.status-retired']);
    d('status-suspended', 'the owner\'s latest record suspends the device', { op: 'add', path: ['statusRecords', 1], value: X.records.suspendedByOwner }, ['device.status-suspended']);
    d('attestation-form', 'the attestation is of another kind', { op: 'set', path: ['bundle', 'attestation', 'statement', 'kind'], value: 'aere-device-status' }, ['device.attestation-form'], { levels: OPRIT });
    d('attestation-signature', 'the action edited after the device signed', { op: 'set', path: ['bundle', 'attestation', 'statement', 'action'], value: 'door.unlock' }, ['device.attestation-signature']);
    d('attestation-signature-scheme', 'the attestation signature declares another scheme', { op: 'set', path: ['bundle', 'attestation', 'signature', 'alg'], value: 'ed25519' }, ['device.attestation-signature']);
    d('audience', 'the attestation was made for this verifier and is shown to another', { op: 'set', path: ['audience'], value: 'https://another-gateway.example' }, ['device.audience']);
    d('nonce', 'the verifier gave another nonce: the attestation is a replay', { op: 'set', path: ['nonce'], value: 'n-another' }, ['device.nonce']);
    d('freshness', 'the verifier\'s clock is an hour after the attestation was made', { op: 'set', path: ['now'], value: X.later }, ['device.freshness']);
    invalid('device-bundle/retired-then-active.status-retired', 'the manufacturer retired the device and the owner later said active: the manufacturer\'s retirement is never lifted', 'device-bundle/suspension-lifted.valid', { op: 'add', path: ['statusRecords', 2], value: X.records.retiredByManufacturer }, ['device.status-retired']);
    invalid('device-bundle/with-software.firmware-software', 'the Proof of Software attestation handed was edited: it no longer hashes to what the release names', bs, { op: 'set', path: ['softwareAttestation', 'statement', 'subject', 'version'], value: '2.0.1' }, ['device.firmware-software']);
    invalid('device-bundle/witnessed.witness-time', 'the verifier read the envelope on the chain ten minutes BEFORE the time the device wrote in its attestation', bw, { op: 'set', path: ['anchors', 0, 'at'], value: X.readingEarlier }, ['device.witness-time']);
    invalid('device-bundle/witnessed.witness-envelope', 'the envelope edited after its hash', bw, { op: 'set', path: ['bundle', 'anchor', 'statement', 'posture'], value: 'firmware-sequence-9' }, ['device.witness-envelope']);
    { const m = (nume, titlu, op) => invalid('device-bundle/manufacture-only.' + nume, titlu, bm, op, ['device.manufacture-signature']);
      m('manufacture-signature', 'the ML-DSA-65 half of the manufacturer\'s signature has one character changed', { op: 'set', path: ['bundle', 'manufacture', 'signature', 'mldsa65'], value: schimba(X.manufacture.signature.mldsa65) });
      m('manufacture-signature-ed25519', 'the Ed25519 half of the manufacturer\'s signature has one character changed', { op: 'set', path: ['bundle', 'manufacture', 'signature', 'ed25519'], value: schimba(X.manufacture.signature.ed25519) });
      m('manufacture-signature-no-ml-dsa', 'the ML-DSA-65 half of the manufacturer\'s signature removed: the classical half alone is not a signature here', { op: 'remove', path: ['bundle', 'manufacture', 'signature', 'mldsa65'] });
      m('manufacture-signature-model', 'the model edited after the manufacturer signed', { op: 'set', path: ['bundle', 'manufacture', 'statement', 'claims', 'model'], value: 'AX-900' }); }
    // one change at the producer: a link signed again by its key holder, the paths that moved declared
    const prod = (baza, nume, titlu, input, changed, r, nota, o = {}) => invalid(baza.replace(/\.[a-z]+$/, '.') + nume, titlu, baza, null, r, { producer: { note: nota, input, changed }, ...o });
    const cuM = (m) => intrare(DV.bundle({ manufacture: m }), { statusRecords: [] }), M_ = [['bundle', 'manufacture']];
    prod(bm, 'manufacturer-id', 'an impostor writes the trusted manufacturer\'s id beside its own keys and signs', cuM(F.manufacturerImpostor), M_, ['device.manufacturer-id'], 'another manufacturer wrote the trusted one\'s id beside its own keys and signed with its own keys');
    prod(bm, 'manufacture-holder', 'the manufacturer names somebody else as the holder of the credential (ownership without a signed transfer)', cuM(F.manufactureHolder), M_, ['device.manufacture-holder'], 'the manufacturer signed the credential with another identity as its holder');
    prod(bm, 'manufacture-window', 'the manufacture credential expired the day before', cuM(F.manufactureExpired), M_, ['device.manufacture-window'], 'the manufacturer issued the same credential valid until the day before');
    prod(bm, 'device-key', 'the manufacturer certifies an Ed25519 key as the device key: a classical key is not a post-quantum one because of the field it sits in', cuM(F.deviceKeyClassical), M_, ['device.device-key'], 'the manufacturer signed an Ed25519 public key as the device key, with the id of that key');
    prod(bm, 'device-id', 'the manufacturer signs a device id that the device key does not derive', cuM(F.deviceId), M_, ['device.device-id'], 'the manufacturer signed another device id beside the device key');
    prod(bm, 'unreadable', 'the manufacturer signed a validity that is not a time', cuM(F.manufactureTime), M_, ['device.unreadable'], 'the manufacturer signed validUntil "next year"', { levels: OPRIT });
    const cuL = (t) => intrare(DV.bundle({ manufacture: X.manufacture, transfers: t }), { statusRecords: [] }), L2 = [['bundle', 'transfers', 1]]; const cuT2 = (t) => cuL([X.transfers[0], t]);
    prod(bc, 'transfer-from', 'THE FORMER OWNER SELLS AGAIN: the second transfer is given by the manufacturer, who had already sold the device', cuT2(F.transferFromFormerOwner), L2, ['device.transfer-from'], 'the manufacturer, no longer the owner, signed the second transfer');
    prod(bc, 'transfer-prev', 'the second transfer names the manufacture credential instead of the first transfer', cuT2(F.transferPrev), L2, ['device.transfer-prev'], 'the owner signed a second transfer whose prev is not the first transfer');
    prod(bc, 'transfer-time', 'the second transfer is dated before the first', cuT2(F.transferBackdated), L2, ['device.transfer-time'], 'the owner signed a second transfer dated twenty days before');
    prod(bc, 'transfer-device', 'the second transfer is a transfer of another device', cuT2(F.transferOtherDevice), L2, ['device.transfer-device'], 'the owner signed a second transfer that names another device id');
    prod(bc, 'transfer-ids', 'the recipient id of the second transfer is not derived from the recipient keys', cuT2(F.transferIds), L2, ['device.transfer-ids'], 'the owner signed another recipient id beside the recipient keys');
    prod(bc, 'transfer-signature', 'the second transfer is signed by a stranger in the owner\'s name', cuT2(F.transferByStranger), L2, ['device.transfer-signature'], 'a stranger signed the owner\'s transfer statement');
    prod(bc, 'chain-length', 'a chain of sixty-five transfers', cuL(F.chainLong), [['bundle', 'transfers']], ['device.chain-length'], 'the two owners transferred the device to one another sixty-five times', { levels: OPRIT });
    const cuF = (f, x = X.attestation) => intrare(pachet({ firmware: f, attestation: x })), cuA = (a) => intrare(pachet({ authorization: a })), cuX = (x) => intrare(pachet({ attestation: x }));
    const BF = [['bundle', 'firmware']], BA = [['bundle', 'authorization']], BX = [['bundle', 'attestation']];
    prod(bd, 'firmware-signer', 'a release signed by somebody who is not the manufacturer of the device', cuF(F.firmwareByStranger), BF, ['device.firmware-signer'], 'a stranger released the same image for the same model and signed with its own keys', { levels: NI });
    prod(bd, 'firmware-model', 'a genuine release of the manufacturer for another model', cuF(F.firmwareOtherModel), BF, ['device.firmware-model'], 'the manufacturer released the same image for model BX-1');
    prod(bd, 'firmware-rollback-old-release', 'FIRMWARE ROLLED BACK: the device runs a genuine older release (sequence 1) and the manufacturer\'s floor is 3', intrare(pachet({ firmware: F.firmwareOld, attestation: F.attestationOfOld }), { firmwarePolicies: [X.policies.floorThree] }), [...BF, ...BX, ['firmwarePolicies', 0]], ['device.firmware-rollback'], 'the device attests the older release of the manufacturer, and the verifier read the policy with floor 3');
    prod(bd, 'attestation-firmware', 'the bundle shows the new release and the device says it runs the old digest', cuX(F.attestationOfOld), BX, ['device.attestation-firmware'], 'the device attested the digest and the sequence of the older release');
    prod(bd, 'authorization-owner', 'THE FORMER OWNER STILL SIGNS: the manufacturer, having sold the device, grants an authorization under the current head', cuA(F.authorizationByFormerOwner), BA, ['device.authorization-owner'], 'the previous owner signed an authorization under the current ownership head');
    prod(bd, 'authorization-ownership', 'the owner\'s authorization is given under the head of before the sale', cuA(F.authorizationOldHead), BA, ['device.authorization-ownership'], 'the owner signed an authorization that names the manufacture credential as the ownership head');
    prod(bd, 'authorization-window', 'the authorization expired an hour before', cuA(F.authorizationExpired), BA, ['device.authorization-window'], 'the owner granted the same actions from two days to one hour before');
    prod(bd, 'authorization-action', 'the device asks for an action its owner did not grant', cuA(F.authorizationOtherAction), BA, ['device.authorization-action'], 'the owner granted door.unlock only');
    prod(bd, 'authorization-device', 'an authorization of another device by the same owner', cuA(F.authorizationOtherDevice), BA, ['device.authorization-device'], 'the owner signed the same grant for another device id');
    prod(bd, 'authorization-signature-purpose', 'the owner\'s signature made for another purpose (status) shown as the signature of the authorization', cuA(F.authorizationPurpose), [['bundle', 'authorization', 'signature']], ['device.authorization-signature'], 'the owner signed the authorization statement with the purpose "status"');
    prod(bd, 'attestation-device', 'A CLONE WITH ANOTHER KEY: its own key and the id of that key, behind the real device\'s manufacture credential', cuX(F.cloneOwnId), BX, ['device.attestation-device'], 'another device key attested the same nonce, firmware, head and action');
    prod(bd, 'attestation-device-claimed-id', 'a clone with another key that claims the real device\'s id', cuX(F.cloneClaimsId), BX, ['device.attestation-device', 'device.attestation-key'], 'another device key signed the statement with its own key under the real device id');
    prod(bd, 'attestation-signature-clone', 'a clone keeps the real key in the statement and signs with its own', cuX(F.cloneSigns), [['bundle', 'attestation', 'signature']], ['device.attestation-signature'], 'another device key signed the real device\'s statement');
    prod(bd, 'attestation-ownership', 'the device names the ownership head of before the sale', cuX(F.attestationOldHead), BX, ['device.attestation-ownership'], 'the device attested under the manufacture credential as the ownership head');
    prod(ba, 'attestation-key', 'an attestation whose "ML-DSA-65" key is an Ed25519 key, signed with it, the signature declared ml-dsa-65', intrare(DV.bundle({ attestation: F.attestationClassical }), { statusRecords: [] }), BX, ['device.attestation-key'], 'an Ed25519 key attested under the ML-DSA-65 name, with the id of that key');
    prod(bw, 'witness-envelope-of-another', 'the envelope of another attestation attached to this one', intrare(pachet({ anchor: F.envelopeOfAnother }), { anchors: [X.reading] }), [['bundle', 'anchor']], ['device.witness-envelope'], 'the envelope of an attestation made one second later was attached');

    // ---- (2026-10-05, after an adversarial review) whose status record counts, and each half of the compound checks
    const REC = X.records, baza = (id) => V.find((x) => x.id === id).input;
    const tot = (id, titlu, b, op, levels = AP) => valid(id, A, titlu, src, aplica(baza(b), op), { exercises: DK, verdict: id.endsWith('.partial') ? 'PARTIAL' : 'VALID', levels, base: b, mutation: op });   // not INVALID, one operation from its base
    const adauga = (k, rec) => ({ op: 'add', path: ['statusRecords', k], value: rec });
    // the owner of NOW: its retirement counts whatever ownership head the record names, and with none
    d('status-retired-by-owner', 'the owner retired the device (its record names the current ownership head)', adauga(1, REC.retiredByOwner), ['device.status-retired']);
    d('status-retired-by-owner-no-head', 'THE OWNER OF NOW RETIRES THE DEVICE in a record that names no ownership head, beside its own current "active": it is the owner\'s record all the same', adauga(1, REC.retiredByOwnerNoHead), ['device.status-retired']);
    // sold on to a second identity: the records of the owner BEFORE do not bind the owner of now; they are named, and the verdict stands
    const br = 'device-bundle/resold.valid', bb = 'device-bundle/bought-back.valid';
    const cuLant = (l, o = {}) => intrare(DV.bundle({ manufacture: X.manufacture, firmware: X.firmware, transfers: l.transfers, authorization: l.authorization, attestation: l.attestation }), o);
    valid(br, A, 'the same device sold on by its first owner to a second identity, which authorizes it and says active under the new ownership head', src, cuLant(X.resold, { statusRecords: [REC.activeBySecond] }), { exercises: DK, levels: AP });
    tot('device-bundle/resold-after-retirement.valid', 'RETIREMENT, THEN A SALE: the first owner retired the device and then sold it. Its retirement does not bind the owner of now (a seller could date one before the sale after it); the verifier names it and what it says, and the verdict stands', br, adauga(1, REC.retiredByFirstOwner));
    tot('device-bundle/resold-after-suspension.valid', 'suspension, then a sale: the same, the state the verifier names is "suspended"', br, adauga(1, REC.suspendedByFirstOwner));
    tot('device-bundle/resold-seller-retires-after.valid', 'the seller signs a retirement under the NEW ownership head, after the sale: it does not bind the owner of now, and is named', br, adauga(1, REC.retiredByFirstOwnerUnderNewHead));
    invalid('device-bundle/resold.status-retired-by-manufacturer', 'the manufacturer\'s retirement is never lifted: not by a sale either', br, adauga(1, REC.retiredByManufacturer), ['device.status-retired']);
    // sold, and bought back: what the owner signed under its FIRST ownership holds now that it owns the device again
    valid(bb, A, 'the same device sold twice and bought back by its first owner, which says active under its third ownership head', src, cuLant(X.boughtBack, { statusRecords: [REC.activeUnderThirdHead] }), { exercises: DK, levels: AP });
    invalid('device-bundle/bought-back.status-suspended-first-ownership', 'the suspension the owner signed under its FIRST ownership holds now that it owns the device again (it can only harm itself)', bb, adauga(1, REC.suspendedByOwner), ['device.status-suspended']);
    invalid('device-bundle/bought-back.status-retired-first-ownership', 'the retirement the owner signed under its first ownership holds as well', bb, adauga(1, REC.retiredByOwner), ['device.status-retired']);
    // records that are named and change nothing
    tot('device-bundle/retired-under-an-id-not-derived.valid', 'a "retired" record signed with the owner\'s keys under an id those keys do not derive is not the owner\'s record: ignored', bd, adauga(1, REC.retiredOwnerKeysOtherId));
    tot('device-bundle/retirement-of-another-device.valid', 'the registry also holds the manufacturer\'s retirement of ANOTHER device: it does not concern this one', bd, adauga(1, REC.retiredOtherDevice));
    tot('device-bundle/retirement-not-yet-in-effect.valid', 'the manufacturer dated a retirement 120 s after the verifier\'s clock (beyond the tolerance of 60 s): it is not in effect yet, and the verifier names it', bd, adauga(1, REC.retiredByManufacturerAhead));
    // the firmware policy: of another model, expired, or one that cannot be read
    tot('device-bundle/policy-of-another-model.partial', 'the only firmware policy handed is the manufacturer\'s policy for another model', bd, { op: 'set', path: ['firmwarePolicies', 0], value: X.policies.otherModel }, { ...AP, ...NI });
    tot('device-bundle/policy-expired.partial', 'the only firmware policy handed has expired', bd, { op: 'set', path: ['firmwarePolicies', 0], value: X.policies.expired }, { ...AP, ...NI });
    tot('device-bundle/policy-unreadable.partial', 'A SIGNED POLICY WHOSE RETRACTED ENTRY IS NOT A DIGEST (the 64 hex digits of this release without 0x) is not read as a policy that retracts nothing', bd, { op: 'set', path: ['firmwarePolicies', 0], value: X.policies.retractedNotADigest }, { ...AP, ...NI });
    tot('device-bundle/policy-unreadable-beside-a-clean-one.partial', 'the same policy beside a clean current one: still not read as clean', bd, { op: 'add', path: ['firmwarePolicies', 1], value: X.policies.retractedNotADigest }, { ...AP, ...NI });
    // the attestation's time: a tolerance for a clock that runs fast, never a date chosen in the future
    { const input = cuX(X.attestationJustAhead); valid('device-bundle/attested-just-ahead.valid', A, 'the device dated its attestation 30 s after the verifier\'s clock: inside the tolerance of 60 s', src, input, { exercises: DK, levels: AP }); }
    prod(bd, 'freshness-ahead', 'AN ATTESTATION DATED 120 s AHEAD of the verifier\'s clock: beyond its tolerance of 60 s, well inside the allowed age', cuX(F.attestationAhead), BX, ['device.freshness'], 'the device dated the same attestation 120 s after the verifier\'s clock');
    prod(bd, 'attestation-firmware-sequence', 'the device attests the digest of the release shown under another sequence number', cuX(F.attestationOtherSequence), BX, ['device.attestation-firmware'], 'the device attested the digest of the release with sequence 9');
    prod(bd, 'attestation-firmware-digest', 'the device attests the sequence number of the release shown with another digest', cuX(F.attestationOtherDigest), BX, ['device.attestation-firmware'], 'the device attested the digest of the older release with the sequence of the new one');
    // the authorization window, judged on the verifier's clock AND at the time the device attested
    prod(bd, 'authorization-window-not-yet', 'the authorization begins in an hour', cuA(F.authorizationNotYet), BA, ['device.authorization-window'], 'the owner granted the same actions from an hour later');
    prod(bd, 'authorization-window-after-attestation', 'the authorization was not in force yet when the device attested: it begins 63 s after the attestation (on the verifier\'s clock, with its tolerance, it has begun)', cuA(F.authorizationAfterAttestation), BA, ['device.authorization-window'], 'the owner granted the same actions from 63 s after the attestation');
    prod(bd, 'authorization-window-ended-between', 'the authorization ended between the attestation and the verification', cuA(F.authorizationEndedBetween), BA, ['device.authorization-window'], 'the owner granted the same actions until 2 s after the attestation, 3 s before the verifier\'s clock');
    // the manufacture credential: not valid yet; a holder that is the manufacturer in one half only; the device key in another base64 text
    prod(bm, 'manufacture-window-not-yet', 'the manufacture credential is not valid yet: it starts the day after', cuM(F.manufactureNotYet), M_, ['device.manufacture-window'], 'the manufacturer issued the same credential valid from the day after');
    prod(bm, 'manufacture-holder-other-id', 'the manufacture credential names as holder another id beside the manufacturer\'s own keys', cuM(F.manufactureHolderOtherId), M_, ['device.manufacture-holder'], 'the manufacturer signed a holder with its own keys under another id');
    prod(bm, 'manufacture-holder-other-keys', 'the manufacture credential names as holder the manufacturer\'s id beside other keys', cuM(F.manufactureHolderOtherKeys), M_, ['device.manufacture-holder'], 'the manufacturer signed a holder with its own id beside the keys of somebody else');
    prod(bm, 'device-key-not-canonical', 'the manufacturer certifies the device key written in another base64 text (a padding character added): one key has one text', cuM(F.deviceKeyNotCanonical), M_, ['device.device-key'], 'the manufacturer signed the same device key with a padding character added to its text');
    prod(ba, 'attestation-key-not-canonical', 'the attestation carries the device key in another base64 text', intrare(DV.bundle({ attestation: F.attestationKeyNotCanonical }), { statusRecords: [] }), BX, ['device.attestation-key'], 'the device signed the same statement with a padding character added to the text of its key');
    // the ownership chain: the position of a transfer; and, with no manufacture credential beside it, the id of who gives the first one
    prod(bc, 'transfer-prev-position', 'the second transfer carries position 7 (the hash of the link before it is right)', cuT2(F.transferPosition), L2, ['device.transfer-prev'], 'the owner signed the second transfer with the sequence number 7');
    const bu = 'device-bundle/chain-unrooted.partial';
    dinProd(bu, 'one transfer with no manufacture credential beside it: the chain has nothing to start from and is checked only against itself', intrare(DV.bundle({ transfers: T1 }), { statusRecords: [] }), NI);
    prod(bu, 'transfer-ids-giver', 'with no manufacture credential beside it, the GIVER of the first transfer carries an id its keys do not derive', intrare(DV.bundle({ transfers: [F.transferGiverId] }), { statusRecords: [] }), [['bundle', 'transfers', 0]], ['device.transfer-ids'], 'the giver signed the first transfer under another id beside its own keys');
    // a signature has ONE text: the same bytes in another base64 text are refused (one operation each, on the text of a signature)
    const AB = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/';
    const altText = (s) => { const p = s.indexOf('='); const t = p < 0 ? s + '=' : s.slice(0, p - 1) + AB[AB.indexOf(s[p - 1]) ^ 1] + s.slice(p); if (t === s || !Buffer.from(t, 'base64').equals(Buffer.from(s, 'base64'))) throw new Error('altText: not the same bytes in another text'); return t; };
    invalid('device-bundle/chain-only.transfer-signature-not-canonical', 'the Ed25519 half of the second transfer\'s signature is the same bytes in another base64 text (the unused bits of its last character changed)', bc, { op: 'set', path: ['bundle', 'transfers', 1, 'signature', 'ed25519'], value: altText(X.transfers[1].signature.ed25519) }, ['device.transfer-signature']);
    d('attestation-signature-not-canonical', 'the attestation signature is the same bytes in another base64 text (a padding character added)', { op: 'set', path: ['bundle', 'attestation', 'signature', 'value'], value: altText(X.attestation.signature.value) }, ['device.attestation-signature']);
    invalid('device-bundle/manufacture-only.manufacture-signature-not-canonical', 'the ML-DSA-65 half of the manufacturer\'s signature is the same bytes in another base64 text', bm, { op: 'set', path: ['bundle', 'manufacture', 'signature', 'mldsa65'], value: altText(X.manufacture.signature.mldsa65) }, ['device.manufacture-signature']);

    // ---- the other conditions of the compound checks (each vector is written for ONE condition; the control of the halves plants each out)
    // status: who lifts a suspension, what expires, what a date that cannot be read undoes
    tot('device-bundle/bought-back-active-of-first-ownership.partial', 'bought back: the only record is the owner\'s "active" of its FIRST ownership, which is not believed under another ownership head', bb, { op: 'set', path: ['statusRecords', 0], value: REC.active }, { ...AP, ...NI });
    invalid('device-bundle/suspension-lifted.status-suspended-by-manufacturer', 'the manufacturer suspended the device: the owner\'s later "active" does not lift a suspension it did not make', 'device-bundle/suspension-lifted.valid', { op: 'set', path: ['statusRecords', 0], value: REC.suspendedByManufacturer }, ['device.status-suspended']);
    d('status-suspended-record-expired', 'a suspension does not expire with its record: the record is past its validity and still holds', { op: 'set', path: ['statusRecords', 0], value: REC.suspendedByOwnerExpired }, ['device.status-suspended']);
    tot('device-bundle/active-record-expired.partial', 'the only "active" record has expired: the registry must be read again', bd, { op: 'set', path: ['statusRecords', 0], value: REC.activeExpired }, { ...AP, ...NI });
    d('status-suspended-same-number', 'two records of the owner with the same number, one says suspended: the stricter holds', adauga(1, REC.suspendedSameNumber), ['device.status-suspended']);
    d('status-retired-date-not-a-time', 'a retirement of the manufacturer whose date is not a time is applied all the same', adauga(1, REC.retiredByManufacturerNoDate), ['device.status-retired']);
    d('status-retired-dated-just-ahead', 'a retirement the manufacturer dated 30 s after the verifier\'s clock is inside the tolerance: in effect', adauga(1, REC.retiredByManufacturerJustAhead), ['device.status-retired']);
    // the recall list and the firmware policy: whose, and when
    tot('device-bundle/recall-list-of-another-manufacturer.partial', 'the only recall list handed has the right id and is signed by ANOTHER manufacturer (it recalls the device): it is not the manufacturer\'s list', bd, { op: 'set', path: ['statusLists', 0], value: X.lists.byAnotherManufacturer }, { ...AP, ...NI });
    tot('device-bundle/recall-list-expired.partial', 'the only recall list handed has expired: it is not read as "not recalled"', bd, { op: 'set', path: ['statusLists', 0], value: X.lists.expired }, { ...AP, ...NI });
    tot('device-bundle/policy-not-yet.partial', 'the only firmware policy handed is not in force yet', bd, { op: 'set', path: ['firmwarePolicies', 0], value: X.policies.notYet }, { ...AP, ...NI });
    tot('device-bundle/policy-floor-unreadable-beside-a-clean-one.partial', 'a signed policy whose floor is not a whole number, beside a clean one', bd, { op: 'add', path: ['firmwarePolicies', 1], value: X.policies.floorNotANumber }, { ...AP, ...NI });
    tot('device-bundle/policy-validity-unreadable-beside-a-clean-one.partial', 'a signed policy whose validity is not a time, beside a clean one', bd, { op: 'add', path: ['firmwarePolicies', 1], value: X.policies.validityNotATime }, { ...AP, ...NI });
    d('firmware-retracted-upper-case', 'the manufacturer\'s tooling wrote the retracted digest in upper case: it is the same digest', { op: 'set', path: ['firmwarePolicies', 0], value: X.policies.retractsUpperCase }, ['device.firmware-retracted']);
    { const alta = clona(X.software); alta.statement.subject.version = '2.0.1'; alta.statementHash = sha256(Buffer.from(JSON.stringify(alta.statement), 'utf8'));
      prod(bs, 'firmware-software-not-the-one-named', 'the Proof of Software attestation handed lists the image and is NOT the one the release names', intrare(pachet({ firmware: X.firmwareWithSoftware }), { softwareAttestation: alta }), [['softwareAttestation']], ['device.firmware-software'], 'another attestation of the same image was handed: its statement differs and its hash was recomputed'); }
    // ownership and authorization
    prod(bc, 'transfer-time-future', 'the second transfer is dated a month after the verifier\'s clock', cuT2(F.transferFuture), L2, ['device.transfer-time'], 'the owner signed a second transfer dated thirty days ahead');
    const cuAX = (a_, x_) => intrare(pachet({ authorization: a_, attestation: x_ }));
    prod(bd, 'authorization-window-begins-after-tolerance', 'the authorization begins after the verifier\'s clock and its tolerance; the attestation, dated 35 s ahead, is later still', cuAX(F.authorizationBeginsAfterTolerance, F.attestationAheadInTolerance), [...BA, ...BX], ['device.authorization-window'], 'the owner granted the same actions from 70 s after the verifier\'s clock, and the device dated its attestation 35 s ahead');
    prod(bd, 'authorization-window-ends-before-attestation', 'the authorization ends before the time the device wrote in its attestation (dated 35 s ahead, inside the tolerance)', cuAX(F.authorizationEndsBeforeAttestation, F.attestationAheadInTolerance), [...BA, ...BX], ['device.authorization-window'], 'the owner granted the same actions until 1 s after the verifier\'s clock, and the device dated its attestation 35 s ahead');
    // with no manufacture credential beside them, the id of who signs a release and of who grants is derived from its keys here alone
    const brl = 'device-bundle/release-only.partial', bg = 'device-bundle/grant-only.partial';
    dinProd(brl, 'a firmware release alone: nothing says which device it is for', intrare(DV.bundle({ firmware: X.firmware }), { statusRecords: [] }), NI);
    prod(brl, 'firmware-signer-id', 'with no manufacture credential beside it, the signer of the release carries an id its keys do not derive', intrare(DV.bundle({ firmware: F.firmwareSignerId }), { statusRecords: [] }), BF, ['device.firmware-signer'], 'the signer signed the release under another id beside its own keys');
    dinProd(bg, 'an authorization and an attestation with no chain beside them: nothing says whose the device is', intrare(DV.bundle({ authorization: X.authorization, attestation: X.attestation }), { statusRecords: [] }), NI);
    prod(bg, 'authorization-owner-id', 'with no chain beside it, the owner that grants carries an id its keys do not derive', intrare(DV.bundle({ authorization: F.authorizationOwnerId, attestation: X.attestation }), { statusRecords: [] }), BA, ['device.authorization-owner'], 'the owner signed the authorization under another id beside its own keys');
    dinProd('device-bundle/manufacture-hardware-root.partial', 'a manufacture credential that carries a hardware root (an endorsement of the device key): this verifier does not judge one, and the verdict says so', cuM(F.manufactureHardwareRoot), { ...NI, ...NA });
    // the witness, and the form of the bundle
    { const fals2 = clona(X.envelope); fals2.statement.deviceId = F.cloneOwnId.statement.deviceId; fals2.statementHash = sha256(Buffer.from(JSON.stringify(fals2.statement), 'utf8'));
      prod(bw, 'witness-envelope-other-device', 'a forged envelope: the hash of this attestation under ANOTHER device id, its statementHash recomputed', intrare(pachet({ anchor: fals2 }), { anchors: [X.reading] }), [['bundle', 'anchor']], ['device.witness-envelope'], 'the envelope was rewritten with another device id and hashed again'); }
    tot('device-bundle/reading-of-another-envelope.partial', 'the verifier\'s reading is of ANOTHER envelope: the notarization this one claims was not read', bw, { op: 'set', path: ['anchors', 0, 'statementHash'], value: '0x' + '22'.repeat(32) }, { ...AP, anchoring: 'NOT_MEASURED' });
    // signed by who may, and not readable by this verifier: never read as clean
    tot('device-bundle/recall-list-unreadable-beside-a-clean-one.partial', 'a recall list of the manufacturer whose validity is not a time (it recalls the device), beside a clean current one: it is not read as "not recalled"', bd, { op: 'add', path: ['statusLists', 1], value: X.lists.validityNotATime }, { ...AP, ...NI });
    tot('device-bundle/policy-of-another-version-beside-a-clean-one.partial', 'a signed policy of a version this verifier does not read (it retracts the release), beside a clean one', bd, { op: 'add', path: ['firmwarePolicies', 1], value: X.policies.otherVersion }, { ...AP, ...NI });
    tot('device-bundle/status-record-of-another-version.partial', 'a record signed by the manufacturer in a version this verifier does not read (it says retired), beside the owner\'s current "active": the registry is not read as clean', bd, adauga(1, REC.retiredByManufacturerOtherVersion), { ...AP, ...NI });
    tot('device-bundle/reading-in-milliseconds.partial', 'the verifier\'s reading of this envelope carries its time in milliseconds: it is not a reading, and the notarization claimed counts as not read', bw, { op: 'set', path: ['anchors', 0, 'at'], value: X.reading.at * 1000 }, { ...AP, anchoring: 'NOT_MEASURED' });
    d('form-version', 'a bundle of another version', { op: 'set', path: ['bundle', 'v'], value: 2 }, ['device.form'], { levels: OPRIT });
    d('form-transfers-not-a-list', 'a bundle whose transfers are not a list', { op: 'set', path: ['bundle', 'transfers'], value: 'x' }, ['device.form'], { levels: OPRIT });
    // ---- (2026-10-06, after a second adversarial review) the conditions that had no vector: the order of a list, an ending 30 s past, a
    // form the producers refuse to write; then what is handed in another shape, the device id as written, a link with a member more
    const R2 = X.r2, Q2 = R2.records, cuS = (l) => intrare(pachet(), { statusRecords: l }), SR_ = [['statusRecords']];
    prod(bd, 'status-suspended-highest-number-listed-first', 'the registry lists [suspended 5, active 3]: the record with the highest number holds, not the last one in the list', cuS([Q2.suspendedFive, Q2.activeThree]), SR_, ['device.status-suspended'], 'the owner signed "suspended" as its record 5 and "active" as its record 3, and the registry lists them in that order');
    prod(bd, 'status-suspended-same-number-listed-first', 'the registry lists [suspended 5, active 5]: of two records with one number the stricter holds, whichever comes last', cuS([Q2.suspendedFive, Q2.activeFive]), SR_, ['device.status-suspended'], 'the owner signed "suspended" and "active" under the same number 5, and the registry lists the suspension first');
    valid('device-bundle/suspension-lifted-listed-first.valid', A, 'the registry lists [active 6, suspended 5]: the later record of the signer lifts its suspension, whatever the order of the list', src, cuS([Q2.activeSix, Q2.suspendedFive]), { exercises: DK, levels: AP });
    tot('device-bundle/active-record-number-not-whole.partial', 'the only record is an "active" of the owner whose number is not whole (1.5): it cannot be placed in order, and is not believed', bd, { op: 'set', path: ['statusRecords', 0], value: Q2.activeNumberNotWhole }, { ...AP, ...NI });
    tot('device-bundle/suspended-record-number-as-text.partial', 'beside a current "active", a "suspended" of the owner whose number is written as text ("7"): it cannot be placed in order, and is not passed over', bd, adauga(1, Q2.suspendedNumberAsText), { ...AP, ...NI });
    tot('device-bundle/active-record-expired-30s.partial', 'the only "active" expired 30 s before the verifier\'s clock: an ending has no tolerance', bd, { op: 'set', path: ['statusRecords', 0], value: Q2.activeExpired30s }, { ...AP, ...NI });
    tot('device-bundle/active-record-validity-with-offset.partial', 'the only record is an "active" whose validity is written with a zone offset (+03:00): not an RFC 3339 UTC time, and not believed', bd, { op: 'set', path: ['statusRecords', 0], value: Q2.activeValidityWithOffset }, { ...AP, ...NI });
    tot('device-bundle/recall-list-of-another-id.partial', 'the only recall list handed is the manufacturer\'s own, current and clean, under ANOTHER id than the one the credential names', bd, { op: 'set', path: ['statusLists', 0], value: R2.lists.otherId }, { ...AP, ...NI });
    tot('device-bundle/recall-list-of-another-id-beside.valid', 'beside the list the credential names, another list of the manufacturer whose bit 7 is set: it is the bit of another list, not a recall of this device', bd, { op: 'add', path: ['statusLists', 1], value: R2.lists.otherIdRevoked });
    tot('device-bundle/recall-list-expired-30s.partial', 'the only recall list expired 30 s before the verifier\'s clock: an ending has no tolerance', bd, { op: 'set', path: ['statusLists', 0], value: R2.lists.expired30s }, { ...AP, ...NI });
    tot('device-bundle/policy-expired-30s.partial', 'the only firmware policy expired 30 s before the verifier\'s clock: an ending has no tolerance', bd, { op: 'set', path: ['firmwarePolicies', 0], value: R2.policies.expired30s }, { ...AP, ...NI });
    tot('device-bundle/policy-floor-negative.partial', 'a signed policy with a negative floor (-1), the only one handed: not read as a floor', bd, { op: 'set', path: ['firmwarePolicies', 0], value: R2.policies.floorNegative }, { ...AP, ...NI });
    prod(bm, 'manufacture-window-expired-30s', 'the manufacture credential expired 30 s before the verifier\'s clock: an ending has no tolerance', cuM(R2.manufactureExpired30s), M_, ['device.manufacture-window'], 'the manufacturer issued the same credential valid until 30 s before the verifier\'s clock');
    dinProd('device-bundle/manufacture-begins-in-tolerance.partial', 'the manufacture credential alone, beginning 30 s after the verifier\'s clock: a beginning has the tolerance of 60 s, and nothing refuses it', cuM(R2.manufactureBeginsInTolerance), NI);
    prod(bm, 'manufacture-form-selective-disclosure', 'a manufacture credential with a claim under selective disclosure, signed by the manufacturer: every claim of a device is in the clear', cuM(R2.manufactureSelectiveDisclosure), M_, ['device.manufacture-form'], 'the manufacturer signed the same credential with an entry in its list of claims under selective disclosure', { levels: { ...OPRIT, ...NI } });
    prod(bs, 'firmware-software-not-a-proof-of-software', 'the release names, by its hash, an attestation that is not a Proof of Software attestation, and that one is handed', intrare(pachet({ firmware: R2.firmwareNamesNotProofOfSoftware }), { softwareAttestation: R2.notProofOfSoftware }), [...BF, ['softwareAttestation']], ['device.firmware-software'], 'the manufacturer signed a release that names the hash of a statement of another kind, and that statement was handed to the verifier');
    d('authorization-signature-scheme', 'the authorization signature (the right bytes) declares another scheme', { op: 'set', path: ['bundle', 'authorization', 'signature', 'alg'], value: 'rsa-pss' }, ['device.authorization-signature']);
    prod(bd, 'unreadable-time-without-zone', 'an authorization signed by the owner whose end is written without a time zone (a parser would read it as local time): not an RFC 3339 UTC time', cuA(R2.authorizationEndWithoutZone), BA, ['device.unreadable'], 'the owner signed the same authorization with its end written without the Z', { levels: OPRIT });
    prod(bd, 'freshness-330s', 'an attestation made 330 s before the verifier\'s clock: 30 s past the allowed age of 300 s', cuX(R2.attestationOld330s), BX, ['device.freshness'], 'the device dated the same attestation 330 s before the verifier\'s clock');
    valid('device-bundle/attested-300s-before.valid', A, 'an attestation made exactly 300 s before the verifier\'s clock: at the edge of the allowed age, inside it', src, cuX(R2.attestationOld300s), { exercises: DK, levels: AP });
    dinProd('device-bundle/chain-of-64.partial', 'the manufacture credential and a chain of exactly 64 transfers, the most that is read: read', cuL(R2.chainOf64), NI);
    // the witness: which of two readings, the kind of the envelope and of its statement, a time that is not a number
    const citire2 = { statementHash: X.reading.statementHash, at: X.readingEarlier, chainId: X.reading.chainId };
    invalid('device-bundle/witnessed.witness-time-second-reading', 'two readings of the envelope, the second one ten minutes BEFORE the time the device wrote in its attestation: the earliest reading is the bound', bw, { op: 'add', path: ['anchors', 1], value: citire2 }, ['device.witness-time']);
    prod(bw, 'witness-time-earlier-reading-first', 'the same two readings in the other order', aplica(aplica(baza(bw), { op: 'set', path: ['anchors', 0], value: citire2 }), { op: 'add', path: ['anchors', 1], value: X.reading }), [['anchors']], ['device.witness-time'], 'the verifier made two readings of the envelope, the earlier one listed first');
    invalid('device-bundle/witnessed.witness-envelope-kind', 'the envelope carries the kind of another envelope, the rest untouched', bw, { op: 'set', path: ['bundle', 'anchor', 'kind'], value: 'aere-proof-of-ai-attestation' }, ['device.witness-envelope']);
    prod(bw, 'witness-envelope-statement-kind', 'the statement of the envelope is of another kind, its hash recomputed', intrare(pachet({ anchor: R2.envelopeStatementOtherKind }), { anchors: [X.reading] }), [['bundle', 'anchor']], ['device.witness-envelope'], 'the envelope was rewritten with a statement of another kind and hashed again');
    tot('device-bundle/reading-time-as-text.partial', 'the verifier\'s reading carries its time as text, ten minutes before the date of the attestation: it is not a reading (as a number it would refuse the attestation)', bw, { op: 'set', path: ['anchors', 0, 'at'], value: String(X.readingEarlier) }, { ...AP, anchoring: 'NOT_MEASURED' });
    // what the verifier is handed in another shape is not read, and the verdict says so
    tot('device-bundle/registry-with-a-list-inside.partial', 'the registry handed as [active, [retired]] (a list inside the list): the retirement was not read, and the verdict is not VALID', bd, adauga(1, [REC.retiredByManufacturer]), { ...AP, ...NI });
    tot('device-bundle/registry-with-a-registry-object-inside.partial', 'the registry handed as [active, { records: [retired] }] (a registry object as an element): what is inside was not read', bd, adauga(1, { records: [REC.retiredByManufacturer] }), { ...AP, ...NI });
    tot('device-bundle/policies-with-a-list-inside.partial', 'the policies handed as [clean, [one that retracts this release]]: what is inside the inner list was not read', bd, { op: 'add', path: ['firmwarePolicies', 1], value: [X.policies.retracts] }, { ...AP, ...NI });
    tot('device-bundle/recall-lists-with-a-list-inside.partial', 'the recall lists handed as [clean, [one that recalls this device]]: what is inside the inner list was not read', bd, { op: 'add', path: ['statusLists', 1], value: [X.lists.revoked] }, { ...AP, ...NI });
    tot('device-bundle/readings-with-a-list-inside.partial', 'the readings handed as [[a reading ten minutes before the date of the attestation]]: it was not read', bw, { op: 'set', path: ['anchors', 0], value: [citire2] }, { ...AP, anchoring: 'NOT_MEASURED' });
    // the device id a status record names is compared like a digest; one that is not a device id is not passed over when its signer may retire the device
    d('status-retired-device-id-upper-case', 'THE MANUFACTURER\'S RETIREMENT names the device id with its hex in upper case (its tooling writes it so): it is this device', adauga(1, Q2.retiredByManufacturerUpperCaseId), ['device.status-retired']);
    tot('device-bundle/active-record-device-id-upper-case.valid', 'the only record is the owner\'s "active" with the device id in upper case: it is this device\'s record', bd, { op: 'set', path: ['statusRecords', 0], value: Q2.activeUpperCaseId });
    tot('device-bundle/status-record-device-id-not-an-id.partial', 'THE OWNER\'S RETIREMENT names the device id with a space after it: not a device id, and it may be meant for this device, so the registry is not read as clean', bd, adauga(1, Q2.retiredByOwnerIdWithSpace), { ...AP, ...NI });
    // another manufacturer the verifier trusts speaks about this device key: not applied, and not passed over
    dinProd('device-bundle/status-of-another-trusted-manufacturer.partial', 'ANOTHER manufacturer, which the verifier also trusts, signed a retirement of this device key: it is not applied to another manufacturer\'s device, and the verdict is not VALID', intrare(pachet(), { trustedManufacturers: R2.trustedBoth, statusRecords: [REC.active, Q2.retiredByOtherManufacturer] }), NI);
    tot('device-bundle/status-of-an-untrusted-manufacturer.valid', 'the same record from a manufacturer the verifier does not trust is a stranger\'s record: ignored', bd, adauga(1, Q2.retiredByOtherManufacturer));
    // a link is exactly { statement, signature } and a signature exactly its members: one member more is another text of the same signed statement
    const mm = (id, titlu, b, cale, r) => invalid(id, titlu, b, { op: 'add', path: cale, value: 'x' }, r);
    mm('device-bundle/chain-only.transfer-signature-member-more', 'the last transfer with a member more in its signature object (the statement and the signature bytes untouched): one link would have two hashes', bc, ['bundle', 'transfers', 1, 'signature', 'note'], ['device.transfer-signature']);
    mm('device-bundle/chain-only.transfer-member-more', 'the last transfer with a member more beside its statement and its signature', bc, ['bundle', 'transfers', 1, 'note'], ['device.transfer-signature']);
    mm('device-bundle/manufacture-only.manufacture-member-more', 'the manufacture credential with a member more beside its statement and its signature', bm, ['bundle', 'manufacture', 'note'], ['device.manufacture-signature']);
    mm('device-bundle/manufacture-only.manufacture-signature-member-more', 'the manufacture credential with a member more in its signature object', bm, ['bundle', 'manufacture', 'signature', 'note'], ['device.manufacture-signature']);
    mm('device-bundle/release-only.firmware-member-more', 'the firmware release with a member more beside its statement and its signature', brl, ['bundle', 'firmware', 'note'], ['device.firmware-signature']);
    mm('device-bundle/grant-only.authorization-member-more', 'the authorization with a member more beside its statement and its signature', bg, ['bundle', 'authorization', 'note'], ['device.authorization-signature']);
    mm('device-bundle/attestation-only.attestation-member-more', 'the attestation with a member more beside its statement and its signature', ba, ['bundle', 'attestation', 'note'], ['device.attestation-signature']);
    mm('device-bundle/attestation-only.attestation-signature-member-more', 'the attestation with a member more in its signature object', ba, ['bundle', 'attestation', 'signature', 'note'], ['device.attestation-signature']);
    tot('device-bundle/active-record-signature-member-more.partial', 'a status record with a member more in its signature object is not a signed record: the only "active" is not believed', bd, { op: 'add', path: ['statusRecords', 0, 'signature', 'note'], value: 'x' }, { ...AP, ...NI }); }
  // (E) a dataset: a record, a range answer, a consistency proof, an availability sample
  const DS = P.dataset; const REC = ['dataset.form', 'dataset.commitment', 'dataset.field', 'dataset.inclusion']; const src = 'producer (verifiable-data), random salts, generated ' + P.at;
  valid('dataset-record/r5.valid', 'dataset-record', 'one record against the commitment of version 2, two fields disclosed', src, { record: DS.record, commitment: DS.newer }, { exercises: REC });
  const inr = (nume, titlu, op, r) => invalid('dataset-record/r5.' + nume, titlu, 'dataset-record/r5.valid', op, [r]);
  const altHex = (h) => h.slice(0, -1) + (h.endsWith('0') ? '1' : '0');
  inr('form', 'the field commitments are not an object', { op: 'set', path: ['record', 'c'], value: 'x' }, 'dataset.form');
  inr('commitment', 'the record names another commitment', { op: 'set', path: ['record', 'commitmentHash'], value: altHex(DS.record.commitmentHash) }, 'dataset.commitment');
  inr('field', 'a disclosed value changed after commitment', { op: 'set', path: ['record', 'disclosed', 'age', 'value'], value: DS.record.disclosed.age.value + 1 }, 'dataset.field');
  inr('field-no-salt', 'a disclosed field shown without its salt', { op: 'remove', path: ['record', 'disclosed', 'age', 'salt'] }, 'dataset.field');
  inr('inclusion', 'one hash of the log proof changed', { op: 'set', path: ['record', 'logProof', 'path', 0], value: altHex(DS.record.logProof.path[0]) }, 'dataset.inclusion');
  const ANS = [...REC, 'dataset.index', 'dataset.range', 'dataset.order', 'dataset.completeness'];
  if (DS.answer.rows.length < 4) throw new Error('the fresh dataset answer has under four rows; regenerate with --proaspat');
  valid('dataset-answer/age-30-45.valid', 'dataset-answer', 'a range query on an indexed field: every row, and the two neighbours that prove nothing is missing', src, { answer: DS.answer, commitment: DS.newer }, { exercises: ANS });
  const rasp = (nume, titlu, op, r) => invalid('dataset-answer/age-30-45.' + nume, titlu, 'dataset-answer/age-30-45.valid', op, [r]);
  rasp('commitment', 'an answer that names another version than the commitment it is checked against', { op: 'set', path: ['answer', 'version'], value: DS.answer.version - 1 }, 'dataset.commitment');
  rasp('index-size', 'the answer states another index size than the commitment', { op: 'set', path: ['answer', 'indexSize'], value: DS.answer.indexSize + 1 }, 'dataset.commitment');
  rasp('index-undisclosed', 'a row that does not disclose the queried field', { op: 'remove', path: ['answer', 'rows', 1, 'disclosed', 'age'] }, 'dataset.index');
  rasp('index', 'one hash of a row\'s index proof changed', { op: 'set', path: ['answer', 'rows', 1, 'indexProof', 'path', 0], value: altHex(DS.answer.rows[1].indexProof.path[0]) }, 'dataset.index');
  rasp('range', 'the answer claims a narrower range than the rows it returns', { op: 'set', path: ['answer', 'to'], value: DS.answer.rows[0].disclosed.age.value }, 'dataset.range');
  rasp('completeness', 'a row dropped from the middle of the run', { op: 'remove', path: ['answer', 'rows', 1] }, 'dataset.completeness');
  { // the two forgeries only the SERVER of an answer can make: a matching row withheld and shown as the neighbour that closes the run
    const b = V.find((x) => x.id === 'dataset-answer/age-30-45.valid'); const vecin = (r) => ({ pos: r.pos, value: r.disclosed.age.value, i: r.i, recordLeaf: BAZA.frunzaInregistrare(r.id, r.c), indexProof: r.indexProof });
    const dupa = clona(b.input); const ultima = dupa.answer.rows.pop(); dupa.answer.after = vecin(ultima);
    invalid('dataset-answer/age-30-45.completeness-last', 'the last matching row withheld and shown as the neighbour after the run (its value is still in range)', 'dataset-answer/age-30-45.valid', null, ['dataset.completeness'], { producer: { note: 'the server dropped the last row and presented it as the neighbour after', input: dupa, changed: [['answer', 'rows', dupa.answer.rows.length], ['answer', 'after']] } });
    const inainte = clona(b.input); const prima = inainte.answer.rows.shift(); inainte.answer.before = vecin(prima);
    invalid('dataset-answer/age-30-45.completeness-first', 'the first matching row withheld and shown as the neighbour before the run', 'dataset-answer/age-30-45.valid', null, ['dataset.completeness'], { producer: { note: 'the server dropped the first row and presented it as the neighbour before', input: inainte, changed: [['answer', 'rows'], ['answer', 'before']] } }); }
  { // order sits under the index root: two publishers of the same two records, one builds the index sorted, the other not
    const recs = [{ id: 'x', k: 'b', salt: '00'.repeat(16) }, { id: 'y', k: 'a', salt: '11'.repeat(16) }].map((r) => { const c = { k: BAZA.angajamentCamp('k', r.k, r.salt) }; return { ...r, c, leaf: BAZA.frunzaInregistrare(r.id, c) }; });
    const log = merkleTree(recs.map((r) => r.leaf)); const dov = (p) => ({ index: p.index, treeSize: p.treeSize, path: p.path });
    const publica = (ordine, nume) => { const idx = merkleTree(ordine.map((i) => BAZA.frunzaIndex('k', recs[i].k, i, recs[i].leaf)));
      const c = { v: 1, format: BAZA.FORMAT, name: nume, version: 1, size: 2, logRoot: log.root(), createdAt: '2026-10-03T00:00:00.000Z', indexes: { k: { root: idx.root(), size: 2 } }, previous: null };
      const rand = (pos) => { const i = ordine[pos]; return { pos, i, id: recs[i].id, c: recs[i].c, disclosed: { k: { value: recs[i].k, salt: recs[i].salt } }, logProof: dov(log.inclusionProof(i, 2)), indexProof: dov(idx.inclusionProof(pos, 2)) }; };
      return { answer: { v: 1, kind: BAZA.KIND_RASPUNS, name: nume, version: 1, commitmentHash: BAZA.hashAngajament(c), field: 'k', from: 'a', to: 'b', indexSize: 2, rows: [rand(0), rand(1)], before: null, after: null }, commitment: c }; };
    valid('dataset-answer/two-records.valid', 'dataset-answer', 'two records, the index built in sorted order', 'producer formulas (verifiable-data), fixed salts', publica([1, 0], 'two-records'), { exercises: ANS });
    invalid('dataset-answer/two-records.order', 'the same two records from a publisher whose index is not sorted: every proof holds, the order does not', 'dataset-answer/two-records.valid', null, ['dataset.order'],
      { producer: { note: 'the publisher built the index in record order instead of sorted order; the index root, the commitment hash and the rows follow from that', input: publica([0, 1], 'two-records'), changed: [['commitment', 'indexes', 'k', 'root'], ['answer', 'commitmentHash'], ['answer', 'rows']] } }); }
  valid('dataset-consistency/v1-v2.valid', 'dataset-consistency', 'version 1 is a prefix of version 2', src, { proof: DS.consistency, older: DS.older, newer: DS.newer }, { exercises: ['dataset.commitment', 'dataset.consistency'] });
  invalid('dataset-consistency/v1-v2.commitment', 'the proof names another newer commitment', 'dataset-consistency/v1-v2.valid', { op: 'set', path: ['proof', 'to', 'commitmentHash'], value: altHex(DS.consistency.to.commitmentHash) }, ['dataset.commitment']);
  invalid('dataset-consistency/v1-v2.consistency', 'one hash of the consistency path changed', 'dataset-consistency/v1-v2.valid', { op: 'set', path: ['proof', 'proof', 'path', 0], value: altHex(DS.consistency.proof.path[0]) }, ['dataset.consistency']);
  valid('dataset-sample/four-of-sixteen.valid', 'dataset-sample', 'four positions drawn from a seed, each served and verified', src, { commitment: DS.newer, k: DS.sample.k, seed: DS.sample.seed, served: DS.sample.served }, { exercises: [...REC, 'dataset.sample'] });
  invalid('dataset-sample/four-of-sixteen.sample', 'the publisher does not serve one of the sampled records', 'dataset-sample/four-of-sixteen.valid', { op: 'remove', path: ['served', Object.keys(DS.sample.served)[0]] }, ['dataset.sample']);
  return V;
}

const text = (v) => JSON.stringify(v, null, 1) + '\n';
function fisiere(vectori) {
  const out = new Map(); const reguli = {};
  for (const v of vectori) { if (out.has(v.id + '.json')) throw new Error('two vectors with the id ' + v.id); out.set(v.id + '.json', text(v)); for (const r of v.expected.failed) (reguli[r] || (reguli[r] = [])).push(v.id); }
  const artifacte = {}; for (const v of vectori) artifacte[v.artifact] = (artifacte[v.artifact] || 0) + 1;
  const index = { v: 1, kind: 'aere-conformance-vector-index', count: vectori.length, artifacts: artifacte, offline: vectori.filter((v) => !v.requires.length).length, online: vectori.filter((v) => v.requires.length).length,
    rules: Object.fromEntries(Object.keys(reguli).sort().map((r) => [r, reguli[r]])), vectors: vectori.map((v) => ({ id: v.id, artifact: v.artifact, verdict: v.expected.verdict, requires: v.requires, sha256: sha256(Buffer.from(out.get(v.id + '.json'), 'utf8')) })) };
  out.set('INDEX.json', text(index)); return out;
}
const peDisc = (d, pre = '') => (fs.existsSync(d) ? fs.readdirSync(d, { withFileTypes: true }).flatMap((e) => (e.isDirectory() ? peDisc(path.join(d, e.name), pre + e.name + '/') : [pre + e.name])) : []);

if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
  const a = process.argv.slice(2);
  if (a.includes('--proaspat')) await proaspat(a.includes('--tot'), a.flatMap((x, i) => (x === '--refa' && a[i + 1] ? [a[i + 1]] : [])));
  const out = fisiere(construieste());
  if (a.includes('--verifica')) {
    let dif = 0; for (const [f, t] of out) { const p = path.join(DIR, f); if (!fs.existsSync(p) || fs.readFileSync(p, 'utf8').replace(/\r\n/g, '\n') !== t) { dif++; console.log('DIFERIT: ' + f); } }
    const straine = peDisc(DIR).filter((f) => !out.has(f)); if (straine.length) { dif += straine.length; console.log('STRAINE: ' + straine.join(', ')); }
    console.log(dif ? `DIFERIT (${dif})` : `LA ZI (${out.size - 1} vectors + INDEX.json)`); process.exitCode = dif ? 1 : 0;
  } else {
    for (const f of peDisc(DIR)) if (!out.has(f)) fs.rmSync(path.join(DIR, f));
    for (const [f, t] of out) { const p = path.join(DIR, f); fs.mkdirSync(path.dirname(p), { recursive: true }); fs.writeFileSync(p, t); }
    const idx = JSON.parse(out.get('INDEX.json')); console.log(`written ${idx.count} vectors (${idx.offline} offline, ${idx.online} need testnet 28001): ` + Object.entries(idx.artifacts).map(([k, n]) => k + ' ' + n).join(', '));
  }
}